Advanced IOS XR Security (2012 San Diego)

ACHTUNG This session is about IOS XR, which runs on: CRS-1 CRS-3 XR12000 ASR9000 This session will not cover IOS, IOS XE, or NXOS If you wish to learn about security on other systems, please attend:BRKSEC-2202 Understanding and Preventing Layer 2 Attacks in IPv4 and IPv6 networksBRKSEC-2145 MPLS VPN SecurityBRKSEC-2345 Critical Infrastructure ProtectionBRKSEC-3007 Advanced Cisco IOS Security FeaturesBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 3

Housekeeping We value your feedback- dont forget to complete your online session evaluations after each session & the Overall Conference Evaluation which will be available online from Thursday Visit the World of Solutions and Meet the Engineer Visit the Cisco Store to purchase your recommended readings Please switch off your mobile phones After the event don’t forget to visit Cisco Live Virtual: www.ciscolivevirtual.comBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 4

Overview

Agenda Overview ‒ Control Plane Protection – Local Packet Transport Services (LPTS) ‒ LPTS Overview ‒ Configuring LPTS ‒ Monitoring LPTS Troubleshooting LPTS ‒ Receive traffic not processed by LPTS Data Plane Protection ‒ Access Control Lists (ACL) ‒ Traditional Methods ‒ MPP Overview Management Plane Protection (MPP) ‒ Configuring MPP ‒ Troubleshooting MPPBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 6

Why are we here? To talk about protecting router aka “device” level resources from being compromised How IOS XR implements protection for control, data, and management planes How to configure these features in IOS XR How to troubleshoot and validate operation of protection in IOS XR Explain how IOS XR implementation compares to traditional CoPP based solutions for IOSBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 7

Router level Control, Management, andData Plane Attack methods ‒Typically multiple hops away from the router Remote attacks ‒Sent to some destination IP on the device under attack ‒1 hop away from device under attack Directly connected attacks ‒Sent to destination IP on the device under attack ‒Some inline tool to become “man in the middle” Inline attacks ‒Requires physical access to something on the wire ‒Manipulation of packets or data gathering Goal of all attacks are to compromise device resources or redirect flows for data gathering purposesBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 8

Types of Attacks ‒ TTL attacks Pipe Cloggers ‒ ICMP: unreachables, redirects, subnet pings ‒ Ping of death – ping with size > 64 Kbyte ‒ State Overflowers/Resource Hogs ‒ Unauthorized route injection (routing protocols) ‒ Buffer overflow – attacker has to know the specific vulnerability within the code and protocol. ‒ TCP SYN Flood IPv6 ICMP: ND, RD, etc. ‒ Unauthorized Access Gainers ‒ Dictionary attacks ‒ SNMP attack ‒ Unauthorized access (Telnet, SSH, HTTPS, SNMP) Spoofing valid protocol packets And plenty more ways to wreak havocBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 9

Control Plane Management Plane• TTL Security – BGP, OSPF, BFD • Instance limit – Telnet, SSH, VTY• Authentication – BGP, OSPF, ISIS, EIGRP, LDP, • Peer Filtering – HTTP, Telnet, SSH, SNMP MSDP, RSVP • AAA – tacacs, radius• Resource Limits – OSPF, ISIS, EIGRP, BGP, RIB, • MPP – Management Plane Protection PIM, IGMP, MSDP• Hardware and Software policers via LPTS IOS XR Security at a glanceData Plane Operating System• uRPF • Process restart ability• ACLs • Protected memory• Ucode punt path policing • Critical resource monitoring and throttling (CPU hog, mem leak, wdsysmon) • IPC rate limits • Code signing 10

10000 ft view of “Receive” packet pathIngress Line Card (LC) Route Processor CPU LC-CPU F A Distributed RP (dRP) CPU B PIFIB Egress LC ucode (TCAM, dynamic) R Ingress Packet Switching Engine I For-us traffic such as L2, BFD, ARP ucode C For-us traffic processed by LPTS – mgmt, L3 control plane, ICMP Transit trafficBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 11

Control Plane Protection

Local Packet Transport Services:High-level view for protection Control Plane Transit Traffic Application1 Received Traffic on RP Application1 Forwarding LPTS on RP Information Internal Base (FIB) FIB (IFIB) Local Stack on LC Bad packets LPTS enables applications to reside on any or all RPs, DRPs, or LCs Active/Standby, Distributed Applications, Local processing IFIB forwarding is based on matching control plane flows Built in “firewall” for control plane traffic LPTS is transparent and automatic BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 13

Local Packet Transport ServiceLPTS Overview There is no longer a single RP IOS XR is a fully distributed operating system with applications running in multiple physical locations LPTS enables distributed applications to reside on any or all RPs, DRPs, or LCs Filters and polices local ‘receive’ packets and sends them only to the nodes that need them Packet rate correlates with trust Handles fragments, also checks TTL/hop count High Availability for NSR (Non-Stop Routing)BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 14

Local Packet Transport Service LPTS implementation in Hardware LPTS has Hardware policers on line cards to limit traffic sent to local or remote nodes LPTS entries in TCAM classifies packets to select a policer to apply The policer value can be tuned to 0 (to drop all packet matching classification criteria) Polices on protocol (BGP, OSPF, SSH) and flow state (BGP established, BGP configured, and BGP listen) Policing done on the LC Hardware ASIC before packets hit RP/LC CPU All filters are automatically and dynamically installed by the IOS XR infrastructureBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 15

How Local Packet Transport ServicesWorks

IOS XR LPTS in action Router bgp  LPTS is an automatic, built in “firewall” for neighbor 2010::4:48:99 control plane traffic. ttl_security … !  Every Control and Management packet from mpls ldp the line card is rate limited in hardware to … ! protect RP and LC CPU from attacks LC 1 IFIB TCAM HW Entries Socket LPTSLocal port Remote port Rate PriorityAny ICMP ANY ANY 1000 low BGPany 179 any any 100 mediumany 179 2010::4:48:99 any 1000 medium ttl LDP2010::4:48:1 179 2010::4:48:99 2223 10000 medium 2552010::200:0::2 13232 2010:200:0::1 646 100 medium SSH LC 2 IFIB TCAM HW Entries … TCP Handshake BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 17

“Receive” Packet Flow Execute a sweep range ping For LC CPU to a CRS-1 and you will see packets droppingPort 0 INGRESSQ SPONGE RX PSE PreIFIB FABRICQ Reass. L3 Engine There are multiple queues towards LC-CPU with different priority (bfd, critical, high, medium, low, netflow): • L2 control is sent to critical queue • CDP, ICMP echo to high priority queue CPU CPU • Fragments, TTL expired, to medium priority queue • BFD is enqueued to a BFD dedicatedPort 0 SPONGE queue – processed by high priority thread EGRESSQ TX PSE FABRICQ (prio = 40) Reass. L3 Engine ICMP Echo req Layer 2 pkts L3 Line Card Fabric RP BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 18

Inside the LC CPU BFD Netflow HDLC CDP ICMP raw UDP TCP NetIO CPU Queues from IngressQ Critical High Med Low Prio Prio PrioBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 19

Locally Destined Packet Flow CPU RP CPU QueuesPort 0 PreIFIB SPONGE RX PSE INGRESSQ Reass. FABRICQ L3 Engine There are multiple queues towards RP-CPU netio processing with different priorities (high, medium, low): • IGP, BGP and LDP established to high priority queue • BGP and LDP configured to med priority queue, RSVP, AAA, PIM CPU CPU • SNMP, Telnet, SSH, ICMP echo reply, Unknown BGP and others CPU to low priority queue SPONGE EGRESSQ TX PSE Reass. FABRICQ L3 Engine Control packet path Port 0 L3 Line Card Fabric RP BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 20

LPTS data structures ‒ Secondary look-up table when Pre-IFIB is incomplete IFIB ‘slices’ are distributed across (D)RPs ‒ Distributed into slices – TCP slice, UDP slice, IS-IS slice, etc ‒ More complex packet inspection and operations Software Pre-IFIB on each LC and (D)RP ‒ Hashing fragments to different (D)RPs based on src/dst. Pre-IFIB (Pifib) in LC Ingress PSE TCAM HardwareBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 22

LPTS PIFIB Key Fields Sample LPTS Entry show lpts pifib RP/0/RP0/CPU0:RTPTME-CRS# hardware entry location 0/0/CPU0L4 Protocol : TCPVRF ID : default ----------------------------------------Source IP : 2010:8:8::5 V - Vital; M - Fabric Multicast; C - Moose Congestion Flag; L - Listener Tag; T -Port/Type : Port:28043 Min TTL;Source Port : 179 F - Flow Type;Is Fragment : 0 DestNode - Destination Node; DestAddr - Destination Fabric Address;Is SYN : any Sq - Ingress Shaping Queue; Dq - Destination Queue;Interface : any Po - Policer; Ct - Stats Counter;V/M/C/L/T/F : 1/0/1/IPv6_STACK/0/BGP-known Lookup priority; Sp - Storage Priority; Lp -DestNode : 0/RP0/CPU0 Ar - Average rate limit; Bu - Burst;DestAddr : 30 HAr - Hardware Average rate limit; HBu - HardwareSq/Dq/Ct : 24/6/0x7ff60 Burst;Accepted/Dropped : 6305/0 Rsp - Relative sorting position;Lp/Sp : 1/255 Rtp - Relative TCAM position;# of TCAM entries : 1 na - Not Applicable or Not AvailablePo/Ar/Bu : 113/25000pps/100msHPo/HAr/HBu : 113/25000pps/100msState : Entry in TCAMRsp/Rtp : 35/35 BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 23

LPTS PIFIB Lookup Results Sample LPTS Entry show lpts pifib hardware RP/0/RP0/CPU0:RTPTME-CRS#L4 Protocol : TCP entry location 0/0/CPU0VRF ID : defaultSource IP : ---------------------------------------- 2010:8:8::5Port/Type : V - Vital; M - Fabric Multicast; Port:28043Source Port : 179 C - Moose Congestion Flag; L - Listener Tag; T - Min TTL;Is Fragment : 0 F - Flow Type;Is SYN : any DestNode - Destination Node;Interface : any DestAddr - Destination Fabric Address; Sq - Ingress Shaping Queue; Dq - Destination Queue;V/M/C/L/T/F : 1/0/1/IPv6_STACK/0/BGP-known Counter; Po - Policer; Ct - StatsDestNode : 0/RP0/CPU0Lp - Lookup priority; Sp - Storage Priority;DestAddr : 30 Ar - Average rate limit; Bu - Burst; HAr - Hardware Average rate limit; HBu - Hardware Burst;Sq/Dq/Ct : 24/6/0x7ff60 - Relative sorting position; RspAccepted/Dropped : 6305/0 Rtp - Relative TCAM position;Lp/Sp : 1/255 na - Not Applicable or Not Available# of TCAM entries : 1Po/Ar/Bu : 113/25000pps/100msHPo/HAr/HBu : 113/25000pps/100msState : Entry in TCAMRsp/Rtp : 35/35 BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 24

LPTS Software Entries (summary view)RP/0/RP0/CPU0:CRS1-4#show lpts pifib brief location 0/7/CPU0 Type VRF-ID Local, Remote Address.Port L4 Interface Deliver ---------- -------- -------------------------- ----- ------------ ------------- ISIS * - - - any 0/2/CPU0 IPv4_frag * any any any any R IPv4 default 224.0.0.1 any IGMP Gi0/7/1/0 0/RP0/CPU0 IPv4 default any.23 any TCP Gi0/7/1/0 0/RP0/CPU0 IPv4 default 224.0.0.22 any IGMP Gi0/7/1/1 0/RP0/CPU0 IPv4 default 224.0.0.13 any PIM Gi0/7/1/1 0/RP0/CPU0… IPv4 default 10.8.8.4.20244 10.8.8.5.17 TCP any 0/RP0/CPU0 IPv4 default any.179 10.8.8.5 TCP any 0/RP0/CPU0 IPv4 default 10.10.20.34.23 10.10.20.10 TCP any 0/RP0/CPU0 IPv4 default 192.168.254.4.49716 192.16 TCP any 0/RP0/CPU0… IPv6 * any.ECHOREQ any ICMP6 any XI IPv6 * any.NDRTRSLCT any ICMP6 any XI IPv6 * any.NDRTRADV any ICMP6 any XI IPv6 * any.NDNBRSLCT any ICMP6 any XI IPv6 * any.NDNBRADV any ICMP6 any XI IPv6 * any.NDREDIRECT any ICMP6 any XI IPv6 * ff02::5 any OSPF any 0/RP0/CPU0 IPv6 * ff02::6 any OSPF any 0/RP0/CPU0 BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 25

LPTS entries for BGP router bgp 100 nsr address-family ipv4 unicast !L4 Protocol : TCP L4 Protocol : TCP neighbor 172.30.255.3VRF ID VRF ID : default remote-as : default 100Source IP : 172.30.255.3 Source IP : 172.30.255.3 update-source Loopback0Port/Type : Port:11013 Port/Type : Port:179 address-family ipv4 unicastSource Port : 179 Source Port : anyIs Fragment : 0 Is Fragment : 0Is SYN : any Is SYN : anyInterface : any Interface : any V/M/C/L/T/F :V/M/C/L/T/F : 1/1/1/IPv4_STACK/0/BGP-known 1/0/1/IPv4_LISTENER/0/BGP-cfg-peerDestNode : FGID 11775 DestNode : 0/RP0/CPU0DestAddr : 11775 DestAddr : 62Sq/Dq/Ct : 24/5/0x7ff32 Sq/Dq/Ct : 24/6/0x7ff34Accepted/Dropped : 15344/0 Accepted/Dropped : 1/0Lp/Sp : 1/255 Lp/Sp : 1/255# of TCAM entries : 1 # of TCAM entries : 1Po/Ar/Bu : 113/25000pps/100ms Po/Ar/Bu : 114/10000pps/100msHPo/HAr/HBu : 113/25000pps/100ms HPo/HAr/HBu : 114/10000pps/100msState : Entry in TCAM State : Entry in TCAMRsp/Rtp : 33/33 Rsp/Rtp : 40/40 BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 26

LPTS entries for IS-IS RP/0/RP0/CPU0:CRS1-4#show placement program all | i isis isis instance test 0/2/CPU0L4 Protocol : - RP/0/RP0/CPU0:CRS1-4#show placement program all | i bgpDestination IP : any bgp instance 0 0/RP0/CPU0 [0/RP1/CPU0]Source IP : anyPort/Type : anySource Port : anyIs Fragment : 0 router isis testIs SYN : any net 44.4444.4444.4444.4444.00Interface : TenGigE0/0/0/1 (0x1080040)/3 interface Loopback4444V/M/C/L/T/F : 1/0/1/CLNS_STACK/0/ISIS-known address-family ipv4 unicastDestNode : 0/2/CPU0 !DestAddr : 8 !Sq/Dq/Ct : 24/6/0x7ffac interface TenGigE0/0/0/1Accepted/Dropped : 0/0 circuit-type level-1Lp/Sp : 0/255 address-family ipv4 unicast# of TCAM entries : 1Po/Ar/Bu : 108/20000pps/100msHPo/HAr/HBu : 108/20000pps/100msState : Entry in TCAMRsp/Rtp : 0/0 BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 27

Configuring Local Packet TransportServices

LPTS policers are configurable globally or per linecard  Users can set rate values for each type of trafficlpts pifib hardware police flow fragment rate 0 flow bgp default rate 0 fragment icmp-local ipsec-known rsh-known ospf-mc-known icmp-app ipsec-default rsh-default ospf-mc_default icmp-default msdp-known udp-known ospf-uc-known icmp-control msdp-cfg-peer udp-listen ospf-uc-default ldp-tcp-known msdp-default udp-cfg-peer isis-known ldp-tcp-cfg-peer snmp udp-default isis-default ldp-tcp-defalut ntp tcp-known eigrp ldp-udp ssh-known tcp-listen rip lmp-tcp-known ssh-default tcp-cfg-peer bgp-known lmp-tcp-cfg-peer http-known tcp-default bgp-cfg-peer lmp-tcp-defalut http-default mc-known bgp-default lmp-udp shttp-known mc-default pim-mc all-routers shhtp-default raw-listen pim-uc rsvp telnet-known raw-default Igmp rsvp-udp telnet-default ip-sla ike css-known BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 29

Verifying LPTS policer valuesRP/0/RP0/CPU0:CRS1-4#show lpts pifib hardware police location 0/7/CPU0------------------------------------------------------------- Node 0/7/CPU0:------------------------------------------------------------- lpts pifib hardware policeFlowType Policer Type Cur. Rate Def. Rate Accepted fragment rate 0 flow Dropped---------------------- ------- ------- ---------- ---------- ---------- bgp default rate 0 flow ----------unconfigured-default 100 Static 500 500 0 0Fragment 106 Global 0 1000 0 0OSPF-mc-known 107 Static 20000 20000 0 0OSPF-mc-default 111 Static 5000 5000 0 0OSPF-uc-known 161 Static 5000 5000 0 0OSPF-uc-default 162 Static 1000 1000 0 0BGP-known 113 Static 25000 25000 18263 0BGP-cfg-peer 114 Static 10000 10000 6 0BGP-default 115 Global 0 10000 0 2PIM-mcast 116 Static 23000 23000 19186 0PIM-ucast 117 Static 10000 10000 0 0IGMP 118 Static 3500 3500 9441 0ICMP-local 119 Static 2500 2500 1020 0ICMP-default 121 Static 2500 2500 0 0LDP-TCP-known 122 Static 25000 25000 0 0LDP-TCP-cfg-peer 152 Static 10000 10000 0 0LDP-TCP-default 154 Static 10000 10000 0 0……cut…… BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 30

Tightening LPTS If you can use only p2p OSPF network type lpts pifib hardware police flow ospf multicast known rate 0 flow ospf multicast default rate 0 Note that OSPF p2p network type is the recommended setting even on Ethernet interfaces unless you have multiple (>2) routers on the same segment Do we really need BGP, LDP-TCP, MSDP default…for ‒ flow bgp-default rate 0 unconfigured sessions? ‒ flow ldp-tcp-default rate 0 ‒ flow msdp-default rate 0 ‒ flow udp-default rate 0 Further investigation needed for these (change at your own risk!) ‒ flow tcp-default rate 0 ‒ flow raw-default its affiliates. All rights reserved.BRKSEC-3172 © 2012 Cisco and/or rate 0 Cisco Public 31

Monitoring Local Packet TransportServices

Monitoring methods for LPTS ‒ Does not have SNMP MIB  CLI based show commands (previous slides) ‒ http://forums.cisco.com/eforum/servlet/EEM?page=eem&fn=script&scriptId=1721  EEM Scripting for LPTS Alertingevent manager environment EEM_LPTS_CHECK_INTERVAL 300event manager environment EEM_LPTS_CHECK_FLOWTYPES BGP-known *event manager environment EEM_LPTS_CHECK_LOCATIONS 0/0/CPU0 0/4/CPU0event manager environment EEM_LPTS_CHECK_THRESHOLD 1 50%event manager directory user policy disk0:/scripts/event manager policy lpts-threshold-alerting.tcl username scripts BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 33

Troubleshooting Local PacketTransport Services

Verifying table entries and counters ‒ show lpts binding brief - Individual client requests Verify the bindings ‒ show lpts clients - Is there a client for every node configured for traffic? ‒ show lpts flows brief - Arbitrated, resolved requests turned into flows for ifib. ‒ sh lpts ifib slices all - Useful if slice location migrates due to extra RP/DRP Verify the lpts entries in RP netio ‒ sh lpts ifib entry brief - Verify final software fib entry. resources. ‒ sh lpts ifib statistics location r/s/m – Valid only on RPs and DRPs*. ‒ sh lpts pifib entry brief location r/s/m – Summary view Verify the linecard pifib software and hardware entries ‒ sh lpts pifib entry location r/s/m – Gives software stats. ‒ sh lpts pifib hardware entry brief location r/s/m – Summary view ‒ sh lpts pifib hardware entry statistics location r/s/m -- Counters ‒ sh lpts pifib hardware usage location r/sm – TCAM resource utilization ‒ sh lpts pifib hardware police location r/sm – Policer valuesBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 35

LPTS Debugs ‒ On LC, shows LC CPU activity only (not PSE) debug lpts packet location <r/s/m> ‒ On RP/DRP, shows secondary look-ups and packet delivery ‒ One message per layer per packet. ‒ Limit to packets matching an ACL. debug lpts packet {ipv4acl | ipv6acl} <name> ‒ Display <n> packets, then stop. debug lpts packet snapshot-size <n> ‒ Packets dropped by LPTS. debug lpts packet drops ‒ IFIB generation information. debug lpts pa {irib | ifib | error} ‒ What’s getting into the Pre-IFIB. debug lpts pifibm {events | errors} location <r/s/m>BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 36

“debug lpts packet” exampleRP/0/0/CPU0:Jul 16 18:12:19.035 : netio[64]: lpts ifib [0xda3159b4/104 if 0x02000400 IP4 10.0.2.1 -> 10.0.2.2 ICMP 0 0] to local stackRP/0/0/CPU0:Jul 16 18:12:28.294 : netio[64]: lpts decaps [0xda314bb4/4474 if 0x02000400 CLNS] to local stackRP/0/0/CPU0:Jul 16 18:12:28.697 : netio[64]: lpts decaps [0xda3159b4/32 if 0x02000400 IP4 10.0.2.1 -> 224.0.1.9 IGMP 22 0] to local stackRP/0/0/CPU0:Jul 16 18:12:29.898 : netio[64]: lpts pifib [0xda3159b4/62 Mg0/0/CPU0/0 IP4 10.91.36.2.1985 -> 224.0.0.2.1985 UDP] to local MCAST4_FMRP/0/0/CPU0:Jul 16 18:12:29.899 : netio[64]: lpts ifib [0xda3159b4/62 Mg0/0/CPU0/0 IP4 10.91.36.2.1985 -> 224.0.0.2.1985 UDP] no matching entry in MCAST4_FM slice, droppingBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 37

LPTS always on debugsTraces ‒ show lpts trace global Global Traces ‒ Captures process starts, slice assignments, dependencies ‒ show lpts trace {pa | fm | ff | platf} Per-Process Traces ‒ Transactions, errors, and platform-specific information.BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 38

Data Plane Protection Methods

Data Plane Exceptions“Receive” traffic not processed by LPTSType Policer (pps) Queue  Most traffic directly processed by LC priority CPU is handled by LC microcodeCDP 1000 High without LPTS (no dynamic state)ARP 1000 High  Different priority queues towards theL2 control 1000 Critical CPUIPv4 options 2500 Medium  Each traffic type is policedIPv4 TTL expire 1000 Low  Eg.IPv6 Link Local 10000 Medium BFD uses its own queue whichIPv6 TTL expire 500 Low Has the highest priorityBFD asynch 7000 BFD  BFD with TTL<254 is droppedBFD echo 7000 BFD  Use “show controller pseBFD TTL error drop na stats” to get statsSampled Netflow Varies* Netflow *Depends on platform/HWBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 41

show controller pse stats ingressloc r/s/mRP/0/RP0/CPU0:CRS1-4#show controllers pse statistics ingress location 0/7/CPU0Punt Stats Punted Policed & Dropped---------- ------ -----------------L2 control 285049 0CDP 125624 0ARP 252 0IPv4 TTL expiration 13562720 17668788471IPv4 BFD echo 262338 4890440IPv6 link local 4326 0Drop Stats Dropped---------- -------L2 unknown 896912IPv4 not enabled 38342IPv4 BFD TTL error 933027779Debug Stats Count----------- -----PPE idle counter 46869398697124 BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 42

Data Plane protection with ACLs ‒ Think region or logical segmentation of the network should an attack occur that Considerations of points to have ACLs for containment needs limiting Ability to filter on TTL, packet length, fragments, EHs Interface level statistics in hardware Interface ACL processing happens before LPTS processing Logging gives ability for forensics and is rate limited on number of packets sent to the CPU to avoid over running CPU resources ‒ ipv4/ipv6 access-group common <name> Nested infrastructure ACLs (ACL Chaining)BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 43

ACL Chaining Example Configurationipv6 access-list acl-common-v6 10 permit ipv6 host 2001:db8::202:202:202:202 host 2001:db8::204:175:175:1 log-input 15 deny ipv6 any host 2001:db8::204:175:175:1 20 permit ipv6 host 2001:db8::202:202:202:202 host 2001:db8::205:175:175:1 log-input 25 deny ipv6 any host 2001:db8::205:175:175:1 30 permit ipv6 host 2001:db8::202:202:202:202 host 2001:db8::206:175:175:1 log-input 35 deny ipv6 any host 2001:db8::206:175:175:1ipv6 access-list acl-unique1-v6 10 permit ipv6 host 2001:db8::202:202:202:202 host 2001:db8::207:175:175:1 log-input 15 deny ipv6 any host 2001:db8::207:175:175:1 20 permit ipv6 any anyInterface GigabitEthernet 0/1/1/1 ipv6 access-group common acl-common-v6 acl-unique1-v6 ingressBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 44

Other traditional methods for protectingData Plane ‒ Honey Pots Blunt control-plane-mediated sinkholing ‒ Remote-triggered black hole (RTBH) via BGP QoS via MQC matching similar to ACL method Unicast RPF both loose and strict ‒ *No length limitations, but performance decrease (~20%) if more than 86 bytes IPv6 EH filtering within ACLs of IPv6 headers on CRSBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 45

Management Plane Protection

MPP OverviewManagement Protocols are secured at various levels By default Management protocols are off if MPP is configured MPP limits the interfaces exposed for management access MPP Peer filtering LPTS Rate Limits Feature specific Rate/Session LimitsBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 47

MPP Overview Management Plane Protection allows network operator to reserve a set of interfaces for management traffic either exclusively (ie, out-of- band) or along with transit traffic (ie, in-band) MPP is supported on all IOS XR platforms and there is no difference in terms of detailed MPP feature support IOS XR Management Plane protection offers many features – In-band Interface support – Out-of-band Interface support – Per interface and per protocol filtering – Peer Filtering • IPv4/IPv6 Host based • IPv4/IPv6 Subnet based Management Protocols supported - TFTP, TELNET, SSH (v1 & v2), SNMP and HTTP/HTTPSBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 48

How Management Plane ProtectionWorks

Management TrafficIOS XR with In-band MPP NOC Transit Traffic  I/F 1 is configured as MPP DCN IP/MPLS in-band interface. I/F 1 is also part of global Out-of- In-band band MPP routing/forwarding. I/F 1  Management traffic to RP from all non-MPP interfaces R LPTS P I is dropped (I/F 2 and I/F 3). E R /  RP Eth/Console/Aux t F continues to operate as h PCPU dedicated out-of-band. 3  MPP integrates with LPTS to provide HW-based filtering! I/F 2 BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 50

MPP In-band Support In-band Interface selection – Network Operator can select specific interfaces for in-band – Granularity of allowing different management protocols on different in-band interfaces In-band interface allows transit traffic along with management traffic Option of choosing all available interfaces as in-band using keyword “all” Option of enabling all supported management protocols on a particular interface using keyword “all” IPv4/IPv6 Peer filtering per protocol and per interface Support for dynamic routing protocols on in-band interfaces In-band interface support per SDR In-band interface support for VRF aware management protocols (SSH/SNMP)BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 51

IOS XR with out-of-band MPP Management Transit Transit NOC in OOB VRF I/F 1 and 3 are configured DCN as MPP out-of-band interface. I/F 1 and 3 are no Out-of- longer part of global band routing/forwarding I/F 1 Management traffic to RP LPTS from all non-MPP interfaces I is dropped (I/F 2) R / P RP RP Eth interfaces continues CPU F to operate as dedicated Out-of- E out-of-band. band t 3 h Routing/Forwarding allowed between OOB interfaces LPTS provides rate limiting I/F 2 BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 52

MPP Out-of-band Support  Uses the VRF concept for out-of-band interface support – Requests received on out-of-band interfaces are only acknowledged on out-of-band interfaces – No need for management protocols to be VRF aware – VRF for out-of-band network is configurable, default VRF is “MPP_OUTBAND_VRF” ‒ RP Ethernet will not participate in routing in the out-of-band VRF  Routing/Forwarding can be enabled on out-of-band interfaces  RP/DRP Ethernet Interfaces are default out-of-band interfaces  Keyword “all” for protocol and interface is supported  IPv4/IPv6 Peer filtering per protocol  Out-of-band interfaces support per SDRBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 53

Restrictions Currently MPP doesn’t keep track of the denied or dropped protocol requests The management protocols need to be enabled explicitly – MPP configuration doesn’t enable the protocol services. – MPP is only responsible for making the services available on different interfaces RP/DRP Ethernet interfaces are by default out-of-band interfaces and cannot be configured under MPP MPP configuration changes doesn’t affect active sessions established before the changes No MIB SupportBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 54

Management Plane ProtectionConfiguration

Before Configuring MPPWarning! – make sure you will not lock yourself out The RP’s dedicated mgmt ports automatically become Out-Of-Band access for MPP and allows all mgmt traffic towards the RP. RP mgmt intf will not shown as out-of-band intf in “show-run” even though they are active. All mgmt traffic to any other intf will be dropped unless the intf is configured either as In-band or Out-of-band intf under MPP for specific protocols Use commit confirmed to prevent lockout!BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 56

MPP In-band Configuration Tasks 1. Enable the protocol services - Protocols supported by MPP are SSH, Telnet, TFTP, HTTP and SNMP 2. Enable MPP for specific interfaces - Specify protocols on specific interfaces 3. Specify the source peers/subnets of the incoming management traffic for – Each protocol – Each specific interface 4. Apply management plane protection configuration 5. If management services are required in a particular VRF – For VRF aware management protocols (Telnet and SNMP) – Enable protocol services for the VRF and place the in-band interface under the same VRF – Non-VRF aware management services cannot be configured for MPPBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 57

Sample Config - 1 RP/0/RP1/CPU0:akki#show running-config | inc (ssh|snmp) ssh server Protocols snmp-server community PUBLIC SystemOwner Enabled RP/0/RP1/CPU0:akki#show running-config control-plane control-plane In-band management-plane Interface inband All Peers interface GigabitEthernet0/2/0/1 allowed for SSH allow SSH allow SNMP peer Peer Filtering address ipv4 1.1.1.1 for SNMP address ipv4 192.168.0.0/16 address ipv6 2000:21:1:1::1 address ipv6 2000:20::/64BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 58

MPP Out-of-band Configuration Tasks 1. Enable the protocol services - Protocols supported by MPP are SSH, Telnet, TFTP, HTTP and SNMP 2. Choose the interfaces for OOB - Choose specific protocols on specific interfaces 3. Place the interfaces under the MPP default VRF or the configured MPP VRF 4. Choose specific allowed peers/subnets for each protocol and for each specific interface 5. Apply management-plane protection configurationBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 59

Sample Config RP/0/RP1/CPU0:akki#show running-config interface gigabitEthernet 0/2/0/2 interface GigabitEthernet0/2/0/2 ipv4 address 1.1.1.2 255.255.255.0 ipv6 address 2000:20::1/64 vrf my_out_of_band VRF definition negotiation auto RP/0/RP0/CPU0:akki#show running-config vrf * vrf my_out_of_band address-family ipv4 unicast SSH server config address-family ipv6 unicast RP/0/RP0/CPU0:akki#show running-config | inc ssh ssh serverBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 60

Sample Config (contd..) RP/0/RP1/CPU0:akki#show running-config control-plane control-plane Changing management-plane OOB VRF out-of-band vrf my_out_of_band Out-of-band interface GigabitEthernet0/2/0/2 Interface allow SSH peer address ipv4 1.1.1.1 address ipv4 192.168.0.0/16 Peer Filtering address ipv6 2000:0:1:1::1 for SSH RP/0/RP1/CPU0:akki#show running-config router ospf router ospf 100 vrf my_out_of_band Routing in area 0 OOB VRF interface gigabitEthernet 0/2/0/2BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 61

Troubleshooting Management PlaneProtection (MPP)

Troubleshooting MPP -- LPTS RP/0/RP0/CPU0:CRS1-4#show lpts bindings brief | i (any.23 ) 0/RP0/CPU0 TCP LR IPV4 TCP default any.23 any Mg0/RP0/CPU0/0 0/RP0/CPU0 TCP LR IPV6 TCP default any.23 any Mg0/RP0/CPU0/0 0/RP0/CPU0 TCP LR IPV4 TCP default any.23 any Gi0/7/1/0 0/RP0/CPU0 TCP LR IPV6 TCP default any.23 any Gi0/7/1/0 0/RP0/CPU0 TCP LR IPV4 TCP default any.23 3.3.3.3 Gi0/7/1/3control-plane 0/RP0/CPU0 TCP LR IPV6 TCP default any.23 3:3:3::3 Gi0/7/1/3 0/RP0/CPU0 TCP LR IPV6 TCP management-plane default any.23 5:5:5::0/64 Gi0/7/1/3 inband RP/0/RP0/CPU0:CRS1-4# RP/0/RP0/CPU0:CRS1-4#show lpts interface Loopback87 bindings brief | i (any.161 ) 0/RP0/CPU0 UDP LR IPV4 UDP allow SNMP default any.161 any Mg0/RP0/CPU0/0 ! 0/RP0/CPU0 UDP LR IPV4 UDP default any.161 any Lo87 interface 0/RP0/CPU0 UDP LR IPV6 UDP GigabitEthernet0/7/1/0 default any.161 any Mg0/RP0/CPU0/0 allow SSH0/RP0/CPU0 UDP LR IPV6 UDP default any.161 any Lo87 RP/0/RP0/CPU0:CRS1-4# allow Telnet ! RP/0/RP0/CPU0:CRS1-4#show lpts bindings brief | i (any.22 ) interface GigabitEthernet0/7/1/3 allow Telnet peer address ipv4 3.3.3.3 address ipv6 3:3:3::3 address ipv6 5:5:5::0/64 !! BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 63

Troubleshooting MPP -- LPTS RP/0/RP0/CPU0:CRS1-4#show lpts pifib hardware entry bri location 0/7/cpu0 | i (.23 ) (def).23 3.3.3.3 TCP GigabitEthernet0/7/1/3 0/RP0/CPU0 24 7 (def).23 3:3:3::3 TCP GigabitEthernet0/7/1/3 0/RP0/CPU0 24control-plane 7 management-plane 5:5:5::0/64 (def).23 TCP GigabitEthernet0/7/1/3 0/RP0/CPU0 24 inband7 interface Loopback87 (def).23 any TCP GigabitEthernet0/7/1/0 0/RP0/CPU0 24 allow SNMP 7 ! (def).23 any TCP GigabitEthernet0/7/1/0 0/RP0/CPU0 24 interface GigabitEthernet0/7/1/0 7 allow SSH (def).23 10.10.20.100.33732 TCP any 0/RP0/CPU0 24 6 allow Telnet 2001:23:11::16.53964 (def).23 TCP any 0/RP0/CPU0 24 6 ! RP/0/RP0/CPU0:CRS1-4# interface GigabitEthernet0/7/1/3 RP/0/RP0/CPU0:CRS1-4#show lpts pifib hardware entry bri location 0/0/cpu0 | i (.23 ) allow Telnet peer (def).23 10.10.20.100.33732 TCP any 0/RP0/CPU0 24 6 address ipv4 2001:23:11::16.53964 (def).23 3.3.3.3 TCP any 0/RP0/CPU0 24 6 address ipv6 3:3:3::3 RP/0/RP0/CPU0:CRS1-4# address ipv6 5:5:5::0/64 !! BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 64

MPP show commands ‒ show mgmt-plane inband <interface> View the information of a particular in-band interface ‒ show mgmt-plane out-of-band <interface> View the information of a particular out-of-band interface ‒ show mgmt-plane out-of-band vrf View the out-of-band VRF ‒ show mgmt-plane interface <interface> View in-band/out-of-band interface informationBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 65

MPP debug commands ‒  debug management-plane details To enable MPP detail debugs ‒  debug management-plane errors To enable MPP error debugs ‒  debug management-plane events To enable MPP event debugs ‒  debug management-plane details job <jobid> To enable MPP detail debugs for a particular MPP enabled process. ‒  debug management-plane errors job <jobid> To enable MPP error debugs for a particular MPP enabled process.  debug management-plane events job <jobid> - To enable MPP event debugs for a particular MPP enabled process. Note: detail option outputs verbose information.BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 66

Monitoring commandsshow lpts ifib entry brief statisticsshow lpts ifib statsshow lpts pifib statistics location <r/s/m>show lpts pifib hardware entry statistics location <r/s/m> Check if there are LPTS drops on RP, LC-SW, or LC-HW LPTS policer drops could be due to higher incoming rate than the configured or default policer value – due to: misconfigured policer (too low rate) misbehaving device sending higher rate of management traffic malicious attack – getting blockedBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 67

Summary – IOS XR Security FTW! ‒ Device security is a critical piece of network reliability Uptime depends on more than defects or high availability features ‒ Data plane can handle way more packets/second than control plane ‒ Sophisticated hardware enables high-performance filtering IOS XR security features enable “Self-Defending Network” ‒ LPTS provides all the benefits of CoPP with minimal configuration ‒ MPP builds on LPTS to secure infrastructureBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 68

Questions?

Recommended Reading Cisco IOS XR Fundamentalshttp://www.ciscopress.com/title/1587052717 Router Security Strategies: Securing IP Network Traffic Planeshttp://www.ciscopress.com/title/1587053365BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 70

Enter to Win a 12-Book Library of Your Choice from Cisco Press Visit the Cisco Store in the World of Solutions, where you will be asked to enter this Session ID codeCheck the Recommended Reading brochure forsuggested products available at the Cisco Store BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 71

Complete Your Online Session Evaluation Give us your feedback and you could win fabulous prizes. Winners announced daily. Receive 20 Cisco Preferred Access points for each session evaluation you complete. Complete your session evaluation online now (open a Don’t forget to activate your browser through our wireless Cisco Live and Networkers Virtual account for access to all session network to access our portal) or materials, communities, and on-demand visit one of the Internet stations and live activities throughout the year. throughout the Convention Activate your account at any internet Center. station or visit www.ciscolivevirtual.com.BRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 72

Final Thoughts Get hands-on experience with the Walk-in Labs located in World of Solutions, booth 1042 Come see demos of many key solutions and products in the main Cisco booth 2924 Visit www.ciscoLive365.com after the event for updated PDFs, on- demand session videos, networking, and more! ‒ Facebook: https://www.facebook.com/ciscoliveus Follow Cisco Live! using social media: ‒ Twitter: https://twitter.com/#!/CiscoLive ‒ LinkedIn Group: http://linkd.in/CiscoLIBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 73

Glossary FIB: Forwarding Information Base RIB: Routing Information Base RP: Route Processor dRP: Distributed Route Processor LC: Line Card LPTS: Local Packet Transport Service MPP: Management Plane Protection CoPP: Control Plane Protection PSE: Packet Switching Engine IngressQ: Input queuing chip on LCs FabricQ: Output fabric queuing chip on LCsBRKSEC-3172 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 75

Advanced IOS XR Security (2012 San Diego)

by Cisco Security on Jun 19, 2012

Statistics

Views

Actions

1 Embed 1

Accessibility

Categories

Upload Details

Usage Rights

Report content

Advanced IOS XR Security (2012 San Diego) Presentation Transcript