1 1 00:00:00,520 --> 00:00:02,430 Inspection and policing. 2 2 00:00:02,430 --> 00:00:03,310 In this lesson, 3 3 00:00:03,310 --> 00:00:05,830 we're going to discuss how we conduct inspection and policing 4 4 00:00:05,830 --> 00:00:08,180 on our networks to increase its insecurity. 5 5 00:00:08,180 --> 00:00:11,550 This includes dynamic ARP inspection, DHCP snooping, 6 6 00:00:11,550 --> 00:00:14,770 Router Advertisement Guard, and control plane policing. 7 7 00:00:14,770 --> 00:00:17,260 First, we have dynamic ARP inspection. 8 8 00:00:17,260 --> 00:00:20,640 Dynamic ARP inspection, or DAI, is a security feature 9 9 00:00:20,640 --> 00:00:22,730 that validates the address resolution protocol 10 10 00:00:22,730 --> 00:00:24,930 or ARP packets within your network. 11 11 00:00:24,930 --> 00:00:27,350 Dynamic ARP inspection allows a network administrator 12 12 00:00:27,350 --> 00:00:30,020 to intercept, log, and discard ARP packets 13 13 00:00:30,020 --> 00:00:32,900 with invalid Mac address to IP address bindings. 14 14 00:00:32,900 --> 00:00:34,940 This protects the network from certain on-path 15 15 00:00:34,940 --> 00:00:36,640 or man-in-the-middle attacks. 16 16 00:00:36,640 --> 00:00:38,710 To prevent ARP cash poisoning attacks, 17 17 00:00:38,710 --> 00:00:41,230 a switch needs to ensure that only valid ARP requests 18 18 00:00:41,230 --> 00:00:44,780 and responses are being relayed across the network device. 19 19 00:00:44,780 --> 00:00:45,930 Dynamic ARP inspection 20 20 00:00:45,930 --> 00:00:48,180 inspects all ARP requests and responses, 21 21 00:00:48,180 --> 00:00:50,440 and then verifies them for valid Mac address 22 22 00:00:50,440 --> 00:00:53,230 to IP address bindings before the local ARP cache 23 23 00:00:53,230 --> 00:00:55,920 is going to be updated or that packet gets forwarded 24 24 00:00:55,920 --> 00:00:57,610 to the appropriate destination. 25 25 00:00:57,610 --> 00:00:59,510 If an invalid ARP packet is found, 26 26 00:00:59,510 --> 00:01:02,210 it's going to be dropped and it will not be forwarded. 27 27 00:01:02,210 --> 00:01:04,040 For dynamic ARP inspection to work, 28 28 00:01:04,040 --> 00:01:06,200 the system must maintain a trusted database 29 29 00:01:06,200 --> 00:01:08,580 of Mac address and IP address bindings. 30 30 00:01:08,580 --> 00:01:10,300 As each ARP packet is inspected, 31 31 00:01:10,300 --> 00:01:12,820 it's going to be checked against this trusted database. 32 32 00:01:12,820 --> 00:01:14,100 To create this database, 33 33 00:01:14,100 --> 00:01:16,630 the network devices will conduct DHCP snooping 34 34 00:01:16,630 --> 00:01:18,500 in order to build their list of bindings. 35 35 00:01:18,500 --> 00:01:19,550 In addition to this, 36 36 00:01:19,550 --> 00:01:21,360 you can also configure your network devices 37 37 00:01:21,360 --> 00:01:23,900 to use user configured ARP access control lists 38 38 00:01:23,900 --> 00:01:25,880 that contains statically configured Mac addresses 39 39 00:01:25,880 --> 00:01:27,600 and IP address bindings. 40 40 00:01:27,600 --> 00:01:29,290 Finally, dynamic ARP inspection 41 41 00:01:29,290 --> 00:01:31,090 can also drop any ARP packets 42 42 00:01:31,090 --> 00:01:33,400 where the IP addresses in the packet are invalid 43 43 00:01:33,400 --> 00:01:36,370 or where the Mac addresses in the body of the ARP packet 44 44 00:01:36,370 --> 00:01:39,370 do not match the address specified in the ethernet header. 45 45 00:01:39,370 --> 00:01:41,830 Second, we have DHCP snooping. 46 46 00:01:41,830 --> 00:01:44,820 DHCP snooping is a DHCP security feature 47 47 00:01:44,820 --> 00:01:47,430 that provides security by inspecting DHCP traffic 48 48 00:01:47,430 --> 00:01:49,910 and filtering untrusted DHCP messages 49 49 00:01:49,910 --> 00:01:53,600 by building and maintaining a DHCP snooping binding table. 50 50 00:01:53,600 --> 00:01:54,940 Now, an untrusted message 51 51 00:01:54,940 --> 00:01:57,600 is any message that's received from outside of the network 52 52 00:01:57,600 --> 00:01:58,970 or outside of the firewall 53 53 00:01:58,970 --> 00:02:00,650 and that could be used to create an attack 54 54 00:02:00,650 --> 00:02:01,880 within your network. 55 55 00:02:01,880 --> 00:02:03,940 The DHCP snooping binding table 56 56 00:02:03,940 --> 00:02:06,400 is going to contain the Mac address, the IP address, 57 57 00:02:06,400 --> 00:02:09,250 the lease time, the binding type, the villa number, 58 58 00:02:09,250 --> 00:02:10,400 and the interface information 59 59 00:02:10,400 --> 00:02:12,740 that corresponds to the local untrusted interface 60 60 00:02:12,740 --> 00:02:13,870 of a switch. 61 61 00:02:13,870 --> 00:02:16,240 The binding table does not contain information 62 62 00:02:16,240 --> 00:02:17,850 regarding hosts interconnected 63 63 00:02:17,850 --> 00:02:19,700 with a trusted interface though, 64 64 00:02:19,700 --> 00:02:21,820 only the untrusted interfaces. 65 65 00:02:21,820 --> 00:02:23,920 So this is used outside of your network 66 66 00:02:23,920 --> 00:02:25,780 on the way in or out of that network, 67 67 00:02:25,780 --> 00:02:27,360 not within your network. 68 68 00:02:27,360 --> 00:02:29,170 Now when we talk about an untrusted interface, 69 69 00:02:29,170 --> 00:02:31,890 this is any interface that's configured to receive messages 70 70 00:02:31,890 --> 00:02:34,180 from outside your network or firewall. 71 71 00:02:34,180 --> 00:02:35,730 Since they're outside of your network, 72 72 00:02:35,730 --> 00:02:38,250 they're automatically considered to be untrusted. 73 73 00:02:38,250 --> 00:02:39,920 A trusted interface, on the other hand, 74 74 00:02:39,920 --> 00:02:41,520 is any interface that is configured 75 75 00:02:41,520 --> 00:02:44,210 to receive only messages from within your network. 76 76 00:02:44,210 --> 00:02:46,500 Remember, if they're coming from inside your network, 77 77 00:02:46,500 --> 00:02:47,900 we consider it trusted. 78 78 00:02:47,900 --> 00:02:49,340 If it's coming from outside of your network, 79 79 00:02:49,340 --> 00:02:51,220 we consider it untrusted. 80 80 00:02:51,220 --> 00:02:53,460 Essentially, when we use DHCP snooping, 81 81 00:02:53,460 --> 00:02:54,940 it's going to act like a firewall 82 82 00:02:54,940 --> 00:02:57,910 between untrusted hosts and DHCP servers. 83 83 00:02:57,910 --> 00:02:58,880 It provides us with a way 84 84 00:02:58,880 --> 00:03:01,160 to differentiate between untrusted interfaces 85 85 00:03:01,160 --> 00:03:02,880 connected to an end-user device 86 86 00:03:02,880 --> 00:03:05,810 and trusted interfaces connected to the DHCP server 87 87 00:03:05,810 --> 00:03:07,180 or another switch. 88 88 00:03:07,180 --> 00:03:09,260 For DHCP snooping to be effective, 89 89 00:03:09,260 --> 00:03:11,560 you need to configure your switches and your VLANs 90 90 00:03:11,560 --> 00:03:14,730 to allow DHCP snooping by your network devices. 91 91 00:03:14,730 --> 00:03:17,480 Next, we have Router Advertisement Guard. 92 92 00:03:17,480 --> 00:03:20,870 The IPv6 Router Advertisement Guard, or RA-Guard, 93 93 00:03:20,870 --> 00:03:23,100 is a mechanism that's going to be commonly employed 94 94 00:03:23,100 --> 00:03:24,560 to mitigate attack vectors 95 95 00:03:24,560 --> 00:03:29,060 based on forged ICMPv6 router advertisement messages. 96 96 00:03:29,060 --> 00:03:32,610 In IPv6, router advertisements can be used by network hosts 97 97 00:03:32,610 --> 00:03:34,270 to automatically configure themselves 98 98 00:03:34,270 --> 00:03:36,160 with their own IPv6 address 99 99 00:03:36,160 --> 00:03:38,170 and pick out their own default router 100 100 00:03:38,170 --> 00:03:39,560 based on the information they're seeing 101 101 00:03:39,560 --> 00:03:41,280 within a router advertisement. 102 102 00:03:41,280 --> 00:03:42,900 Now, this could introduce a security risk 103 103 00:03:42,900 --> 00:03:43,800 to your network though 104 104 00:03:43,800 --> 00:03:45,780 because a host could create a default route 105 105 00:03:45,780 --> 00:03:47,760 out of the network based on a suspicious 106 106 00:03:47,760 --> 00:03:50,830 or malicious router advertisement sent by an attacker. 107 107 00:03:50,830 --> 00:03:52,310 So, to prevent this, 108 108 00:03:52,310 --> 00:03:55,670 we need to configure IPv6 Router Advertisement Guards, 109 109 00:03:55,670 --> 00:03:58,260 or RA-Guards, to filter router advertisements 110 110 00:03:58,260 --> 00:04:00,330 as they're going across your network. 111 111 00:04:00,330 --> 00:04:02,920 RA-Guards operate at layer two of the OSI model 112 112 00:04:02,920 --> 00:04:04,900 for IPv6 networks. 113 113 00:04:04,900 --> 00:04:07,610 Now, your configuration can be set up very easily 114 114 00:04:07,610 --> 00:04:08,810 and very effectively 115 115 00:04:08,810 --> 00:04:10,517 by simply adding a configuration that says, 116 116 00:04:10,517 --> 00:04:13,040 "don't allow RAs on this interface". 117 117 00:04:13,040 --> 00:04:15,430 With that simple line, the switch will then filter out 118 118 00:04:15,430 --> 00:04:17,610 all router advertisements from the internet 119 119 00:04:17,610 --> 00:04:19,600 and then your internal host devices 120 120 00:04:19,600 --> 00:04:21,850 can't fall victim to setting up malicious routes 121 121 00:04:21,850 --> 00:04:23,520 to a hacker control gateway. 122 122 00:04:23,520 --> 00:04:27,120 Finally, we have Control Plane Policing, or CPP. 123 123 00:04:27,120 --> 00:04:29,760 The control plane in policing, or CPP feature, 124 124 00:04:29,760 --> 00:04:32,280 is going to allow users to configure a quality of service 125 125 00:04:32,280 --> 00:04:35,030 or QoS filter that will manage the traffic flow 126 126 00:04:35,030 --> 00:04:38,070 of control plane packets to protect the control plane 127 127 00:04:38,070 --> 00:04:40,220 of your Cisco iOS routers and switches 128 128 00:04:40,220 --> 00:04:43,020 against the nihilist service and reconnaissance attacks. 129 129 00:04:43,020 --> 00:04:44,800 This helps to protect the control plane, 130 130 00:04:44,800 --> 00:04:47,610 while maintaining packet forwarding and protocol states, 131 131 00:04:47,610 --> 00:04:51,310 despite an attack or heavy load on that router or switch. 132 132 00:04:51,310 --> 00:04:53,950 This is known as policing and not an inspection 133 133 00:04:53,950 --> 00:04:55,120 because we're dealing with maintaining 134 134 00:04:55,120 --> 00:04:57,620 a good quality of service level for this router. 135 135 00:04:57,620 --> 00:04:59,210 Notice, we're talking all about 136 136 00:04:59,210 --> 00:05:00,940 the control plane here as well. 137 137 00:05:00,940 --> 00:05:02,470 This means we're looking at the switch 138 138 00:05:02,470 --> 00:05:05,390 under the logical functional components of that router. 139 139 00:05:05,390 --> 00:05:07,530 Things like the data plane, the management plane, 140 140 00:05:07,530 --> 00:05:09,630 and the control plane, and the service planes, 141 141 00:05:09,630 --> 00:05:13,140 just as we would be in a software defined network or SDN. 142 142 00:05:13,140 --> 00:05:14,490 This control plane policing 143 143 00:05:14,490 --> 00:05:16,230 ensures that the rate limiting of traffic 144 144 00:05:16,230 --> 00:05:17,720 is modified dynamically 145 145 00:05:17,720 --> 00:05:19,720 to ensure the device doesn't become overloaded, 146 146 00:05:19,720 --> 00:05:22,560 that it doesn't have an overly high CPU utilization, 147 147 00:05:22,560 --> 00:05:23,830 and that it doesn't create 148 148 00:05:23,830 --> 00:05:25,760 an unacceptably low quality of service 149 149 00:05:25,760 --> 00:05:28,360 due to periods of high demands or malicious attacks.