Keeping Insiders Honest
It is important to understand the intersection of port-based access-control solutions and related policy-enforcement mechanisms. It is too easy for an unsecured individual to gain physical and logical access to a network. A solution to this problem is 802.1X, which keeps the outsiders out and can serve as a way to extend the level of trust in a networked system by proving someone's identity. As a potential benefit, the network now becomes aware of authorized sessions, and it can enforce policies. This provides the capability to keep insiders honest. You also have the potential to increase the level of accountability for whom you might actually be doing business.
Port-Security Integration
Port security was originally developed to address the security risk of content-addressable memory (CAM) table exhaustion. Hence, port security can limit the number of addresses that can be learned on a port as a defense against MAC address table exhaustion attacks. The underlying implementation is to secure addresses only when they are being learned in accordance with the Layer 2 bridging model.
In practice, this means that implementing port security should secure host addresses only if the traffic received from those addresses is not Layer 2 control-packet traffic (CDP, STP, PAgP, Link Aggregation Control Protocol [LACP], DTP, and so on). These types of Layer 2 frames do not trigger host learning and, thus, cannot be used to overflow the MAC address table. In practice, this subjectively makes 802.1X technically superior to technologies (such as port security) because it implicitly disallows all traffic other than EAPOL before a valid port authorization takes place. By default, CAM table exhaustion is accounted for. Even after 802.1X authorizes a port, most catalyst-switch implementations attempt to ensure the validity of the authorized session by locking it on a port down to the single MAC address that was authenticated through 802.1X. Previously, when a secure port goes down and comes back up, MAC addresses that were previously learned and secured on a port were lost. As a result, a new host could then be learned on a port without causing any violation. The only way to control this behavior was to configure sticky port security in an attempt to lock single MAC addresses down to certain ports if needed. However, sticky port security saves any MAC address learned on a port, which is similar to statically configured MAC addresses on the port. Then, MAC addresses can be preserved across link up/down or switch reloads.
Sticky port security allows for a MAC address to be learned only once, and it is secured permanently after that. Technically, although this might limit the number of MACs learned on a port, no form of authentication exists in this at all. 802.1X is superior to this because it does not care about how a device actually authenticates, but it can support the notion of authentication in general. From a switch's perspective, upon linkup, 802.1X is prioritized over port security. This means that the switch must authenticate a user before it can secure (or even learn) a MAC address. When enabled together on the same port, port security and
802.1X can allow the system to limit the number of hosts to be learned and secured on the port in addition to authenticating that host. The default behavior of 802.1X (without port security) is to implicitly deny all traffic until a supplicant successfully authenticates. Until then, only EAPOL packets are allowed; all other packets are silently dropped. After the supplicant successfully authenticates, the default access for the port is changed depending on the 802.1X host mode (which is examined next). By default, only EAPOL packets are handled in this single-auth mode, and all other packets are dropped. When a supplicant authenticates, 802.1X informs port security to secure the MAC address on the port. If this succeeds, access is granted. If this process does not succeed, access can be denied. In this way, 802.1X can be backward-compatible with existing port-security techniques, whether they are predominantly static or dynamic in nature.
NOTE For more information on port security, see Chapter 2.
DHCP-Snooping Integration
DHCP snooping can keep track of the binding between MAC addresses and dynamically assigned IP addresses. It is enabled on a per-VLAN basis and intercepts all DHCP messages bridged within a VLAN. Combined with 802.1X on a port, this provides a unique value proposition from an overall security standpoint. Like 802.1X, IP Source Guard can also be enabled on an individual Layer 2 port. 802.1X is literally a per-port traffic filter (implicitly denying everything, with the exception of EAPOL) until a port becomes authorized. After a port authorizes, it is implicitly allowed to communicate. IP Source Guard can leverage DHCP snooping to enable a per-port IP traffic filter for protection against spoofing. It uses DHCP snooping or static bindings to effectively build an inbound port access control list (PACL) on every port on which it is enabled.
NOTE For more information on DHCP-Snooping, see Chapter 5, "Leveraging DHCP Weaknesses."
Address Resolution Protocol Inspection Integration
Address Resolution Protocol (ARP) is a Layer 2 protocol that maps IP addresses to MAC (hardware) addresses. ARP is a stateless network layer protocol, does not have any authentication built into it, and can be spoofed as a result. A networked device trusts ARP request/reply messages without ensuring that they come from the correct devices. In combination with 802.1X, however, you can reasonably prove that an end user or device attaching to a LAN edge port is not an outsider. 802.1X and Dynamic ARP Inspection
(DAI) then interoperate to keep this insider honest. This confirms that authentication alone does not prove trustworthiness. Chapter 6, "Exploiting IPv4 ARP," discusses ARP limitations and mitigation techniques.
Putting It Together
Potential attack vectors exist in most networked systems. The majority of access edge attacks attempt to exploit the inability of a device to track the attacker or for a networked system to recognize an alteration of the forwarding path. Most common attacks at the network edge range from MAC flooding attacks, to spanning-tree attacks, to ARP attacks, or the storming of other packet types. 802.1X is a port-based access-control solution. It provides an improved solution for the authentication of various types of users or devices while directly providing an increased benefit to the attack vectors in a switched-LAN environment. Compared to previous approaches of access control, 802.1X offers enterprises several benefits that can interoperate with existing security solutions with a low degree of overlap. 802.1X is superior to other versions of access control and might address some security issues better than a mitigation technique itself can (in many ways).
After 802.1X completes, an authenticated session is typically bound to the MAC address used to authorize a port. This enforcement process ensures the validity of the authenticated session. This mitigates the threat of a network port to be compromised by any other non-802.1X client that might appear on the wire. After a switch port is authorized by 802.1X, all subsequent traffic that matches the security policy on the port is forwarded until events occur to cause the port to become unauthorized. 802.1X assumes that an authenticator port is physically and directly connected to a supplicant for a single host per-port topology. It does not directly support connections to a hub-based shared Ethernet segment or an unauthenticated switch. Else, a single authenticated device could gain access for other unauthorized systems. Thus, authenticators need to detect the presence of multiple devices on its ports and be able to deny access if desired. This is a default condition of the configuration shown previously; it is known as single-auth mode. Operationally, additional MAC addresses that appear on the wire are treated as security violations. This includes VMWare type devices or any machines that attempt to transmit gratuitous ARP frames.
802.1X typically represents authentication. Authentication alone does not assume trustworthiness. Even with 802.1X, an attacker with physical access to a LAN can still sniff traffic and spoof an authenticated MAC address. This level of attack, although valid, does not typically exist in wireless because encryption is used, and the supplicant and authenticator have a mutually derived key that an attacker doesn't know. With wireless topologies that support encryption and authentication, even if an attacker could spoof the MAC and IP, frames are dropped and an attacker should not be able to easily decode frames. Until wired 802.1X has encryption built in to validate supplicant traffic, it is exposed to this attack. Although 802.1X completely raises the bar for security measures in a LAN alone, other techniques (such as physical security, access to cabling, and so on) for mitigation to thwart attackers are recommended. To understand the future of link-layer encryption, see Chapter 18, "IEEE 802.1AE."
NOTE This does not account for lower-layer protocols, such as 802.11, in use for wireless topologies.
Continue reading here: Multihost Mode
Was this article helpful?