-: Inspection and policing. 2 2
In this lesson, 3 3
we're going to discuss how we conduct inspection and policing 4 4
on our networks to increase its insecurity. 5 5
This includes dynamic ARP inspection, DHCP snooping, 6 6
Router Advertisement Guard, and control plane policing. 7 7
First, we have dynamic ARP inspection. 8 8
Dynamic ARP inspection, or DAI, is a security feature 9 9
that validates the address resolution protocol 10 10
or ARP packets within your network. 11 11
Dynamic ARP inspection allows a network administrator 12 12
to intercept, log, and discard ARP packets 13 13
with invalid Mac address to IP address bindings. 14 14
This protects the network from certain on-path 15 15
or man-in-the-middle attacks. 16 16
To prevent ARP cash poisoning attacks, 17 17
a switch needs to ensure that only valid ARP requests 18 18
and responses are being relayed across the network device. 19 19
Dynamic ARP inspection 20 20
inspects all ARP requests and responses, 21 21
and then verifies them for valid Mac address 22 22
to IP address bindings before the local ARP cache 23 23
is going to be updated or that packet gets forwarded 24 24
to the appropriate destination. 25 25
If an invalid ARP packet is found, 26 26
it's going to be dropped and it will not be forwarded. 27 27
For dynamic ARP inspection to work, 28 28
the system must maintain a trusted database 29 29
of Mac address and IP address bindings. 30 30
As each ARP packet is inspected, 31 31
it's going to be checked against this trusted database. 32 32
To create this database, 33 33
the network devices will conduct DHCP snooping 34 34
in order to build their list of bindings. 35 35
In addition to this, 36 36
you can also configure your network devices 37 37
to use user configured ARP access control lists 38 38
that contains statically configured Mac addresses 39 39
and IP address bindings. 40 40
Finally, dynamic ARP inspection 41 41
can also drop any ARP packets 42 42
where the IP addresses in the packet are invalid 43 43
or where the Mac addresses in the body of the ARP packet 44 44
do not match the address specified in the ethernet header. 45 45
Second, we have DHCP snooping. 46 46
DHCP snooping is a DHCP security feature 47 47
that provides security by inspecting DHCP traffic 48 48
and filtering untrusted DHCP messages 49 49
by building and maintaining a DHCP snooping binding table. 50 50
Now, an untrusted message 51 51
is any message that's received from outside of the network 52 52
or outside of the firewall 53 53
and that could be used to create an attack 54 54
within your network. 55 55
The DHCP snooping binding table 56 56
is going to contain the Mac address, the IP address, 57 57
the lease time, the binding type, the villa number, 58 58
and the interface information 59 59
that corresponds to the local untrusted interface 60 60
of a switch. 61 61
The binding table does not contain information 62 62
regarding hosts interconnected 63 63
with a trusted interface though, 64 64
only the untrusted interfaces. 65 65
So this is used outside of your network 66 66
on the way in or out of that network, 67 67
not within your network. 68 68
Now when we talk about an untrusted interface, 69 69
this is any interface that's configured to receive messages 70 70
from outside your network or firewall. 71 71
Since they're outside of your network, 72 72
they're automatically considered to be untrusted. 73 73
A trusted interface, on the other hand, 74 74
is any interface that is configured 75 75
to receive only messages from within your network. 76 76
Remember, if they're coming from inside your network, 77 77
we consider it trusted. 78 78
If it's coming from outside of your network, 79 79
we consider it untrusted. 80 80
Essentially, when we use DHCP snooping, 81 81
it's going to act like a firewall 82 82
between untrusted hosts and DHCP servers. 83 83
It provides us with a way 84 84
to differentiate between untrusted interfaces 85 85
connected to an end-user device 86 86
and trusted interfaces connected to the DHCP server 87 87
or another switch. 88 88
For DHCP snooping to be effective, 89 89
you need to configure your switches and your VLANs 90 90
to allow DHCP snooping by your network devices. 91 91
Next, we have Router Advertisement Guard. 92 92
The IPv6 Router Advertisement Guard, or RA-Guard, 93 93
is a mechanism that's going to be commonly employed 94 94
to mitigate attack vectors 95 95
based on forged ICMPv6 router advertisement messages. 96 96
In IPv6, router advertisements can be used by network hosts 97 97
to automatically configure themselves 98 98
with their own IPv6 address 99 99
and pick out their own default router 100 100
based on the information they're seeing 101 101
within a router advertisement. 102 102
Now, this could introduce a security risk 103 103
to your network though 104 104
because a host could create a default route 105 105
out of the network based on a suspicious 106 106
or malicious router advertisement sent by an attacker. 107 107
So, to prevent this, 108 108
we need to configure IPv6 Router Advertisement Guards, 109 109
or RA-Guards, to filter router advertisements 110 110
as they're going across your network. 111 111
RA-Guards operate at layer two of the OSI model 112 112
for IPv6 networks. 113 113
Now, your configuration can be set up very easily 114 114
and very effectively 115 115
by simply adding a configuration that says, 116 116
"don't allow RAs on this interface". 117 117
With that simple line, the switch will then filter out 118 118
all router advertisements from the internet 119 119
and then your internal host devices 120 120
can't fall victim to setting up malicious routes 121 121
to a hacker control gateway. 122 122
Finally, we have Control Plane Policing, or CPP. 123 123
The control plane in policing, or CPP feature, 124 124
is going to allow users to configure a quality of service 125 125
or QoS filter that will manage the traffic flow 126 126
of control plane packets to protect the control plane 127 127
of your Cisco iOS routers and switches 128 128
against the nihilist service and reconnaissance attacks. 129 129
This helps to protect the control plane, 130 130
while maintaining packet forwarding and protocol states, 131 131
despite an attack or heavy load on that router or switch. 132 132
This is known as policing and not an inspection 133 133
because we're dealing with maintaining 134 134
a good quality of service level for this router. 135 135
Notice, we're talking all about 136 136
the control plane here as well. 137 137
This means we're looking at the switch 138 138
under the logical functional components of that router. 139 139
Things like the data plane, the management plane, 140 140
and the control plane, and the service planes, 141 141
just as we would be in a software defined network or SDN. 142 142
This control plane policing 143 143
ensures that the rate limiting of traffic 144 144
is modified dynamically 145 145
to ensure the device doesn't become overloaded, 146 146
that it doesn't have an overly high CPU utilization, 147 147
and that it doesn't create 148 148
an unacceptably low quality of service 149 149
due to periods of high demands or malicious attacks.