Agenda Security Workshop Control Plane Forwarding Plane Management Plane

Size: px

Start display at page:

Download "Agenda Security Workshop Control Plane Forwarding Plane Management Plane"

かずきうなだ
5 years ago
Views:

1 JANOG Interdomain Routing Security Workshop 7 July 2004 Miya Kohno (mkohno@cisco.com)

2 Agenda Security Workshop (@SanJose) Control Plane Forwarding Plane Management Plane

3 Agenda Security Workshop (@SanJose) Control Plane Forwarding Plane Management Plane

4 Security SanJose (26 May 2004) NANOG31(@SF) Cisco SanJose Tim Battle (AT&T Security Operations) Jared Mauch (Verio/NTT Operations) Ryan McDowell (Sprint Operations) Christopher L. Morrow (MCI Security Operations) Cisco

5 AT&T Receive ACL for GRP protection WRED for preventing buffer over utilization urpf + ACL for source address assurance Netflow for monitoring and detecting NW anomalies --- getting very important Remote Triggered Blackholes for diverting traffic to null0 and scrubbling device Configuration auditing for preventing mis-configuration Command Automation for quick trouble shooting

6 AT&T Consistency of configurations and commands across platforms. Feature commands should be identical between platforms and images. Consistency of services across SP platform (Netflow, racls)

7 Sprint Issues Lack of MIB for urpf drops Lack of MIB for racl matches Lack of uniform feature support across platforms urpf, racl, source-tracker Inability to kill listening processes e.g. UDP/496 (PIM-RP-DISC) ACLs are pathetic Need a bit mask to filter on any bit(s) anywhere in an IP packet BGP reorganization Too many CLIs BGP route analysis Only way to get full view is screen scrape

8 Sprint Issues BGP max-prefix Needs to try and reestablish or just stop accepting routes above limit No easy way to see how many routes advertised to BGP peer Put advertised routes in show ip bgp summary show ip bgp <domain-name> broken urpf any route needed Not just strict mode Source-Tracker Automatic shutoff if pps rate exeeds threshold Only show counts that match an ACL (e.g. TCP/80/SYN) Netflow Show cache that maches src/dst address, etc. SSH host keys n routers Need a way to copy to new RP

9 NTT/Verio - Challenges Not consistent or implemented on all IOS devices Interface ACLs don t scale No way to globally apply acl to all interfaces to block worm traffic (e.g. ms-sql/slammer) urpf setting global on 6k Lack of consistent packet inspection techniques in router configuration

10 NTT/Verio - Challenges How to stop (filter, police, otherwise) attacks rapidly? Rapidly pushing out configuration changes to hundreds of devices Differences in configuration semantics create troubles and inconsistency (platform, sw rev) Avoiding configuration drift Signaling across existing database infrastructure via BGP?

11 MCI Line Rate ACLs on all interfaces ACLs on all interfaces on all platforms Full packet match capability Line Rate ACLs on all platforms (core) Don t limit acls to edge platforms, todays core is tomorrows edge TTL filtering in ACLs and Services Set outbaound ttl/default-ttl

12 What s important Consistency, Consistency, Consistency!! Scalability Simplicity Stability

13 Agenda Security Workshop (@SanJose) Control Plane Forwarding Plane Management Plane

14 Control Plane Control Plane Peering Relationship Guarded Trust TCP MD5 BGP over Ipsec (?!) BTSH/GTSM (RFC3682) prefix AS originate S-BGP, SO-BGP (?!!!!)

15 Guarded Trust Egress Filter Ingress Filter Prefixes ISP A ISP B Prefixes Guarded Trust, Mutual Suspicion (J) ISP A ISP B Global Internet Table X prefixes ISP B ISP A X prefixes egress filter ISP A ISP B X prefixes igress filter ISP A ingress filter ISP B egress filter

16 TCP MD5 TCP MD5 Authentication Key distribution RFC1321 MD5. RFC2385 MD5 with BGP RFC3562 MD5 key TCP MD5

17 BGP over IPSec IP sec Transport Peering Relation draft-ward-bgp-ipsec?!!! IPsec

18 TTL sanity check BTSH BGP TTL security hack draft-gill-btsh GTSM Generalized TTL security Mechanism RFC TTL reject TTL=255 ebgp speaker TTL =255 ebgp speaker TTL A ebgp

19 TTL sanity check device BGP speaker accept BGP speaker 254 TTL reject TTL=255 A ebgp accept

20 Forwarding Plane ACL with performance and scalability urpf Strict Loose (triggered black hole filtering ) Netflow Traffic

21 Management Plane Default Access Denied AAA & encryption protocols for console login SSH, SSL, IPSec Isolation of Management Ports

22 Agenda Security Workshop (@SanJose) Control Plane Forwarding Plane Management Plane

23 What s Next???! BGP over IPSec?! S-BGP / SO-BGP? Ptomaine Prefix Taxonomy Ongoing Measurement & Internetwork Experiment RPSEC Routing Protocol Security Requirements Working Group

24 S-BGP/SO-BGP Peering Relationship route flaps excessive routes AS prefix originate authorize prefix originate AS reachable prefix peer S-BGP, SO-BGP?!! S-BGP: SO-BGP: ftp://ftp-eng.cisco.com/sobgp/index.html

25 SO-BGP S-BGP SO-BGP central authority deploy AS deployment BGP UPDATE

26 SO-BGP Certificate Transport Certificate Processing Update Processing

27 Certificate Transport SO-BGP Transport Certificate SO-BGP device draft-ng-sobgp-bgpextensions New BGP SECURITY message Certificates are carried within TLVs security

28 Certificate Operation EntityCert Signer AS AS PubKey PolicyCert AS Policy AuthCert Auth AS AS Address Signature Signature Signature AS AS AS AS PubKey PubKey PubKey PubKey known valid keys policy database Auth database topology database topology graph Origin AS Path Prefix Update

29 Update Processing AS path hop(the origin AS) AuthCert Prefix AS authorize AuthCert AuthCert database policy database received Update Origin AS Path Prefix topology graph

30 Update Processing AS path AS path AuthCert database policy database received Update Origin AS Path Prefix topology graph

31 SO-BGP Deployment Deployment Options Incremental Deployment

32 Deployment Options ebgp peering point(as certificate ebgp certificate sobgp processing certificate exchange

33 Deployment Options ibgp AS certificate certificate Edge RADIUS UPDATE validation sobgp processing certificate exchange

34 Deployment Options multihop ebgp certificate sobgp processing certificate exchange

35 Deployment Options third party certificate Validation process certificate sobgp processing certificate exchange

36 Incremental Deployment SO-BGP AS ebgp multihop certificate sobgp AS certificate validation certificate update PolicyCerts connectivity AS Path second hop validate AS PATH validation no sobgp second hop validation sobgp no sobgp

37 SO-BGP

38 Inter-domain security feedback loop

39 Thank you!

untitled

untitled Peers Working Together to Battle Attacks to the Internet JANOG17 20 Jan 2006 Matsuzaki Yoshinobu Tomoya Yoshida Taka Mizuguchi NSP-SEC/NSE-SEC-JP Agenda