Relying on the Network Infrastructure
If the strong authentication mitigation technique cannot be used, or when it is deemed not secure enough, the only remaining technique is to prevent hosts from transmitting VRRP packets. You can implement this with inbound ACL on all routers and switches. Because the ACL relies on IP addresses, you must use an antispoofing mechanism, such as IP source guard. Also, an operational cost exists because the ACL is linked to IP addresses of the VRRP routers; therefore, if one router changes its IP address, the ACL needs to be changed.
The ACL depends on the exact network topology, so Example 10-3 is just an example for you to modify based on your exact configuration.
References 163
Example 10-3 uses IOS to forbid any hosts but 192.168.0.7 and 192.168.0.9 to send a VRRP message.
Example 10-3 Using IOS ACL to Prevent VRRP Spoofing
Example 10-3 uses IOS to forbid any hosts but 192.168.0.7 and 192.168.0.9 to send a VRRP message.
Example 10-3 Using IOS ACL to Prevent VRRP Spoofing
|
interface FastEthernet0/0 |
|||||
|
ip access-group 101 in |
|||||
|
access-list 101 permit 112 host 192 |
168. |
9.7 |
host |
224.0 |
0.18 |
|
access-list 101 permit 112 host 192 |
168. |
9.9 |
host |
224.0 |
0.18 |
|
access-list 101 deny 112 any any |
|||||
|
access-list 101 permit ip any any |
Continue reading here: Diving Deep into CDP
Was this article helpful?