How to Securely Operate an IPv6 Network (2012 San Diego)

Abstract This intermediate session describes how an IPv6 network can be securely operated. The session explains how the management, control and data planes can be secured. It also covers topics such as forensic, telemetry and lawful intercept. The content is mainly geared to Service Providers but enterprises may also find it useful. It is targeted to security and network architects with operational background. There is also an enterprise version of this session BRKSEC-2003 which is more protocol oriented than operational. Beware that there is 50% overlap between BRKSEC-2003 and BRKSPG-2603.BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 3

For Reference Slides For Your Reference There are more slides in the hand-outs than presented during the class Those slides are mainly for reference and are indicated by the book icon on the top right corner (as on this slide) Reference URL has a QR code for your convenienceBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 4

―This presentation does not cover the common parts with IPv4 network: Physical security Role-based access control & AAA Configuration management & change control …‖

Agenda Management Plane Control Plane ‒ Routing Information ‒ Neighbor Discovery ‒ Control Plane Protection Data Plane ‒ Anti-spoofing ‒ Access Control List ‒ Tunnel loops Telemetry Forensic Lawful Intercept SummaryBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 6

Management PlaneControl Plane 7

Management over IPv6 SSH, syslog, SNMP, NetFlow all work over IPv6 Dual-stack management plane ‒ More resilient: works even if one IP version is down ‒ More exposed: can be attacked over IPv4 and IPv6 RADIUS over IPv6 is recent (IOS 15.2(1)T, IOS-XE rls 3.2S) ‒ But, IPv6 RADIUS attributes can be transported over IPv4 As usual, infrastructure ACL is your friend (more to come) as well as out- of-band managementBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 8

IPv6 ACL to Protect VTY For Your Reference ipv6 access-list VTY permit ipv6 2001:db8:0:1::/64 any line vty 0 4 ipv6 access-class VTY in Must be done before enabling IPv6 on any interface Beware thre is no equivalent for HTTP => use ACL In IOS-XR, the command is ‗access-class VTY ingress‘, the IPv4 and IPv6 ACL must have the same nameBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 9

Control Plane: Routing ProtocolsControl Plane 10

Preventing IPv6 Routing AttacksProtocol Authentication BGP, ISIS, EIGRP no change: ‒ An MD5 authentication of the routing update OSPFv3 has changed and pulled MD5 authentication from the protocol and instead rely on transport mode IPsec (for authentication and confidentiality) ‒ But see draft-ietf-ospf-auth-trailer-ospfv3 IPv6 routing attack best practices ‒ Use traditional authentication mechanisms on BGP and IS-IS ‒ Use IPSec to secure protocols such as OSPFv3BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 11

OSPF or EIGRP Authentication For Your Reference interface Ethernet0/0 ipv6 ospf 1 area 0 ipv6 ospf authentication ipsec spi 500 md5 1234567890ABCDEF1234567890ABCDEF interface Ethernet0/0 ipv6 authentication mode eigrp 100 md5 ipv6 authentication key-chain eigrp 100 MYCHAIN key chain MYCHAIN key 1 key-string 1234567890ABCDEF1234567890ABCDEF accept-lifetime local 12:00:00 Dec 31 2006 12:00:00 Jan 1 2008 send-lifetime local 00:00:00 Jan 1 2007 23:59:59 Dec 31 2007 BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 12

For YourBGP Route Filters Reference Pretty obvious for customer links For peering, a relaxed one ipv6 prefix-list RELAX deny 3ffe::/16 le 128 ipv6 prefix-list RELAX deny 2001:db8::/32 le 128 ipv6 prefix-list RELAX permit 2001::/32 ipv6 prefix-list RELAX deny 2001::/32 le 128 ipv6 prefix-list RELAX permit 2002::/16 ipv6 prefix-list RELAX deny 2002::/16 le 128 ipv6 prefix-list RELAX deny 0000::/8 le 128 ipv6 prefix-list RELAX deny fe00::/9 le 128 ipv6 prefix-list RELAX deny ff00::/8 le 128 ipv6 prefix-list RELAX permit 2000::/3 le 48 ipv6 prefix-list RELAX deny 0::/0 le 128 Source: http://www.space.net/~gert/RIPE/ipv6-filters.htmlBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 13

Link-Local Addresses vs. Global Addresses Link-Local addresses, fe80::/10, (LLA) are isolated ‒ Cannot reach outside of the link ‒ Cannot be reached from outside of the link  Could be used on the infrastructure interfaces ‒ Routing protocols (inc BGP) work with LLA ‒ Benefit: no remote attack against your infrastructure: implicit infrastructure ACL ‒ Note: need to provision loopback for ICMP generation (notably traceroute and PMTUD) ‒ See also: draft-behringer-lla-only ‒ LLA can be configured statically (not the EUI-64 default) to avoid changing neighbor statements when changing MAC interface FastEthernet 0/0 ipv6 address fe80::1/64 link-localBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 14

Control Plane: Neighbor DiscoveryControl Plane

Scanning Made Bad for CPURemote Neighbor Cache Exhaustion Potential router CPU/memory attacks if aggressive scanning ‒ Router will do Neighbor Discovery... And waste CPU and memory ‒ Can also be performed locally NS: 2001:db8::3 NS: 2001:db8::2 NS: 2001:db8::1 NS: 2001:db8::3 NS: 2001:db8::2 NS: 2001:db8::1 NS: 2001:db8::3 NS: 2001:db8::2 NS: 2001:db8::1 2001:db8::/64BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 16

Mitigating Remote Neighbor Cache Exhaustion Built-in rate limiter but no option to tune it ‒ Since 15.1(3)T: ipv6 nd cache interface-limit ‒ Or IOS-XE 2.6: ipv6 nd resolution data limit ‒ Destination-guard is coming with First Hop Security phase 3 Using a /64 on point-to-point links => a lot of addresses to scan! ‒ Using /127 could help (RFC 6164) Using infrastructure ACL prevents this scanning ‒ iACL: edge ACL denying packets addressed to your routers ‒ Easy with IPv6 because new addressing scheme can be done  Internet edge/presence: a target of choice ‒ Ingress ACL permitting traffic to specific statically configured (virtual) IPv6 addresses onlyBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 17

Simple Fix forRemote Neighbor Cache Exhaustion Ingress ACL allowing only valid destination and dropping the rest NDP cache & process are safe Requires DHCP or static configuration of hosts NS: 2001:db8::1 NA: 2001:db8::1 2001:db8::/64BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public

ARP Spoofing is now NDP Spoofing:Threats ARP is replaced by Neighbor Discovery Protocol ‒ Nothing authenticated ‒ Static entries overwritten by dynamic ones Stateless Address Autoconfiguration ‒ rogue RA (malicious or not) ‒ All nodes badly configured DoS Traffic interception (Man In the Middle Attack) Attack tools exist (from THC – The Hacker Choice) ‒ Parasit6 ‒ Fakerouter6 ‒ ...BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 19

ARP Spoofing is now NDP Spoofing:Mitigation MOSTLY-GOOD NEWS: nothing yet like dynamic ARP inspection for IPv6 on all platforms ‒ First phase (Port ACL & RA Guard) available since Summer 2010 ‒ Second phase (NDP & DHCP snooping) starting to be available since Summer 2011 ‒ http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-first_hop_security.html GOOD NEWS: Secure Neighbor Discovery ‒ SeND = NDP + crypto ‒ IOS 12.4(24)T ‒ But not in Windows Vista, 2008 and 7, Mac OS/X, iOS, Android ‒ Crypto means slower... Other GOOD NEWS: ‒ Private VLAN works with IPv6 ‒ Port security works with IPv6 ‒ IEEE 802.1X works with IPv6 (except downloadable ACL)BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 20

Mitigating Rogue RA: Host Isolation Prevent Node-Node Layer-2 Promiscuous Port RA communication by using: RA ‒ Private VLANs (PVLAN) where nodes Isolated (isolated port) can only contact the official router (promiscuous port) Port ‒ WLAN in ‗AP Isolation Mode‘ RA ‒ 1 VLAN per host (SP access network with Broadband Network Gateway) RA Link-local multicast (RA, DHCP request, etc) sent only to the local official router: no harm RABRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 21

Secure Neighbor Discovery (SeND)RFC 3971 Cryptographically Generated Addresses (CGA) ‒ IPv6 addresses whose interface identifiers are cryptographically generated RSA signature option ‒ Protect all messages relating to neighbor and router discovery Timestamp and nonce options ‒ Prevent replay attacks Certification paths for authorized Routers ‒ Anchored on trusted parties, expected to certify the authority of the routers on some prefixes Requires IOS 12.4(24)TBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 22

Cisco Current RoadmapSecuring Link Operations: IETF SAVI WGFirst Hop Trusted Device Advantages Certificate server ‒ central administration, central operation ‒ Complexity limited to first hop ‒ Transitioning lot easier ‒ Efficient for threats coming from the link ‒ Efficient for threats coming from outside Time server Disadvantages ‒ Applicable only to certain topologies ‒ Requires first-hop to learn about end-nodes ‒ First-hop is a bottleneck and single-point of failureBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 23

First Hop Security: RAguard since 2010 Port ACL blocks all ICMPv6 RA from hosts interface FastEthernet0/2 ipv6 traffic-filter ACCESS_PORT in access-group mode prefer port RA RA-guard lite (12.2(33)SXI4 & 12.2(54)SG ): also dropping all RA RA received on this port interface FastEthernet0/2 ipv6 nd raguard access-group mode prefer port RA RA-guard (12.2(50)SY) RA ipv6 nd raguard policy HOST device-role host ipv6 nd raguard policy ROUTER device-role router ipv6 nd raguard attach-policy HOST vlan 100 RA interface FastEthernet0/0 ipv6 nd raguard attach-policy ROUTERBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 24

First Hop Security in June 2012 IPv6 port ACL & RA Guard lite: 12.2(54)SG, 3.2.0SG, 15.0(2)SG, 12.2(33)SXI4 NDP inspection (binding integrity guard): 12.2(50)SY and 15.0(1)SYFor more Information:http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-roadmap.htmlhttp://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-first-hop-security.htmlBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 25

IPv6 First Hop SecurityMore to Come  DHCP Guard  Destination Guard  Source Guard  Prefix Guard  Multi Switch  DAD Proxy operation  Binding Table  RA Throttler Recovery  NDP Multicast  SVI support Suppress Several of those features are already in WLC 7.2BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 26

CPE to CPE Communication IPv4 vs. IPv6 SP want to inspect/bill all user to user traffic IPv4 WAN addresses must SP Broadband Network Gateway communicate (NAT…) 2001:db8:bad::/64 ‒ Usually in the same layer 2 192.2.0.0/24 domain… tricks to force traffic to BNG Eric‘s CPE Ole‘s CPE IPv6 WAN addresses have no reason to communicate 2001:db8:café::/64 ‒ IPv6 LAN addresses must 192.168.1.0/24 192.168.1.0/24 2001:db8:babe::/64 communicate ‒ BNG inspection is easy: this is routed traffic BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 27

Control Plane ProtectionControl Plane

For YourControl Plane Protection for IPv6 Reference Against DoS with NDP, Hop-by-Hop, Hop Limit Expiration... Software routers (ISR, 7200): works with CoPPr (CEF exceptions) policy-map COPPr class ICMP6_CLASS police 8000 class OSPF_CLASS police 200000 class class-default police 8000 ! control-plane cef-exception service-policy input COPPrBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 29

For YourControl Plane Policing for IPv6 ReferenceProtecting the RP Against DoS with NDP, Hop-by-Hop, Hop Limit Expiration... Cat 6K with Sup720 & 7600 ‒ IPv6 shares mls rate-limit with IPv4 for NDP & HL expiration mls rate-limit all ttl-failure 1000 mls rate-limit unicast cef glean 1000BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 30

Data PlaneControl Plane

DoS ExamplePing-Pong over Physical Point-to-Point Same as in IPv4, on real P2P without NDP, if not for me, then send it on the other side... Could produce looping traffic Classic IOS and IOS-XE platforms implement RFC 4443 so this is not a threat ‒ Except on 76xx see CSCtg00387 (tunnels) and few others ‒ IOS-XR see CSCsu62728 ‒ Else use /127 on P2P link (see also RFC 6164) ‒ Or use infrastructure ACL or only link-local addresses 2) To 2001:db8::3 3) To 2001:db8::3 R2 R1 Serial 0/0 Serial 0/0 2001:db8::1/64 2001:db8::2/64 4) To 2001:db8::3 5) To 2001:db8::3BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. .... Cisco Public 32

IPv6 Bogon and Anti-Spoofing Filtering IPv6 nowadays has its bogons: ‒ http://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt Anti-spoofing in IPv6 same as IPv4 ‒ => Same technique for single-homed edge= uRPF Inter-Networking Device with uRPF Enabled IPv6 IPv6 Intranet X Intranet/Internet IPv6 Unallocated No Route to SrcAddr => Drop Source AddressBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 33

IPv6 uRPF and Cisco DevicesThe Theory-Practice Gap Supported everywhere except: ‒ 7600 & Cat 6K with Sup720/32: no IPv6 uRPF at all Sup 2T is OK ‒ Cat 3750, ME3400, ME3600, ME3800: no uRPF at all ‒ GSR only strict mode with 10G Engine 5 (else not supported) in 12.0(31)S ‒ ASR 9K requires release 4.1.1BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 34

Bogons Filtering  Detailed & updated list at: ‒ http://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt  Or simpler but more relaxed ipv6 access-list NO_BOGONS remark Always permit ICMP unreachable (Path MTU Discovery & co) permit icmp any any unreachable remark Permit only large prefix blocks from IANA permit ip 2001::/16 any permit ip 2002::/16 any permit ip 2003::/18 any permit ip 2400::/12 any permit ip 2600::/10 any permit ip 2800::/12 any permit ip 2a00::/12 any permit ip 2c00::/12 any Remark implicit deny at the end (but see later)Source: http://www.iana.org/assignments/ipv6-unicast-address-assignments/ipv6-unicast-address-assignments.xml BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 35

Cisco IOS IPv6 Extended Access Control Lists  Very much like in IPv4 ‒ Filter traffic based on Source and destination addresses Next header presence Layer 4 information ‒ Implicit deny all at the end of ACL ‒ Empty ACL means traffic allowed ‒ Reflexive and time based ACL  Known extension headers (HbH, AH, RH, MH, destination, fragment) are scanned until: ‒ Layer 4 header found ‒ Unknown extension header is found  Side note for 7600 & other switches: ‒ VLAN ACL only in 15.0(1)SY ‒ Port ACL on Nexus-7000, Cat 3750 (12.2(46)SE), Cat 4K (12.2(54)SG), Cat 6K (12.2(33)SXI4)See also: http://www.cisco.com/en/US/technologies/tk648/tk872/technologies_white_paper0900aecd8054d37d.htmlhttp://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-roadmap.htmlhttp://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-first_hop_security.html BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 36

IOS IPv6 Extended ACL Can match on ‒ Upper layers: TCP, UDP, SCTP port numbers, ICMPv6 code and type ‒ TCP flags SYN, ACK, FIN, PUSH, URG, RST ‒ Traffic class (only six bits/8) = DSCP, Flow label (0-0xFFFFF) IPv6 extension header ‒ routing matches any RH, routing-type matches specific RH ‒ mobility matches any MH, mobility-type matches specific MH ‒ dest-option matches any destination options ‒ auth matches AH ‒ hbh matches hop-by-hop (since 15.2(3)T) fragments keyword matches ‒ Non-initial fragments (same as IPv4) ‒ And the first fragment if the L4 protocol cannot be determined undetermined-transport keyword does not match ‒ TCP/UDP/SCTP and ports are in the fragment ‒ ICMP and type and code are in the fragment ‒ Everything else matches (including OSPFv3, …) ‒ Only for deny ACE Check your platform & release as your mileage can vary…BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 37

IOS-XR IPv6 Extended ACL 2nd & subsequent fragments are always permitted by default 1st fragment without layer-4 does not match any ACE Undetermined-transport keyword does not exist Header extension parsing is in µcode, no limit in the header chain length (except a very minor impact on the performance)BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 38

For YourExample: Rogue RA & DHCP Port ACL Reference ipv6 access-list ACCESS_PORT remark Block all traffic DHCP server -> client deny udp any eq 547 any eq 546 remark Block Router Advertisements deny icmp any any router-advertisement permit any any Interface gigabitethernet 1/0/1 switchport ipv6 traffic-filter ACCESS_PORT in Note: PACL replaces RACL for the interfaceBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 39

For YourEquivalent ICMPv6 Reference RFC 4890: Border Firewall Transit Policy Internal Server A Internet ICMPv6 ICMPv6 Action Src Dst Name Type Code Permit Any A 128 0 Echo Reply Permit Any A 129 0 Echo Request Permit Any A 1 0 No Route to Dst. Permit Any A 2 0 Packet Too Big Time Exceeded— Permit Any A 3 0 TTL Exceeded Permit Any A 4 0 Parameter ProblemBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 40

For YourPotential Additional ICMPv6 Reference RFC 4890: Border Firewall Receive Policy Internal Server A Firewall B Internet ICMPv6 ICMPv6 Action Src Dst Name Type Code Permit Any B 2 0 Packet too Big For locally generated Permit Any B 4 0 Parameter Problem traffic Permit Any B 130–132 0 Multicast Listener Neighbor Solicitation Permit Any B 135/136 0 and Advertisement Deny Any AnyBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 41

IPv6 ACL Implicit Rules  Implicit entries exist at the end of each IPv6 ACL to allow neighbor discovery: any any nd-na permit icmp permit icmp any any nd-ns deny ipv6 any any  Nexus 7000 also allows RS & RA  Be careful when adding « deny ipv6 any any log » at the end permit icmp any any nd-na permit icmp any any nd-ns deny ipv6 any any logBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 42

For YourExample: RFC 4890 ICMP ACL Reference ipv6 access-list RFC4890 permit icmp any any echo-reply permit icmp any any echo-request permit icmp any any 1 3 permit icmp any any 1 4 permit icmp any any packet-too-big permit icmp any any time-exceeded permit icmp any any parameter-problem permit icmp any any mld-query permit icmp any any mld-reduction permit icmp any any mld-report permit icmp any any nd-na permit icmp any any nd-ns permit icmp any any router-solicitationBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 43

For YourExample: Generic ACL on PE-CE or ReferencePeering ipv6 access-list SIMPLE remark To be reviewed for potential customization (e.g. use of ULA) remark Drop evil routing header type 0 deny ipv6 any any routing-type 0 remark allow DAD permit IPv6 host :: 2000::/3 permit IPv6 host :: FE80::/10 remark Allow unicast global to other valid destinations permit ipv6 2000::/3 2000::/3 permit ipv6 2000::/3 FE80::/10 permit ipv6 2000::/3 FF00::/8 remark Allow link-local to other valid destinations permit ipv6 FE80::/64 FE80::/64 permit ipv6 FE80::/64 FF02::/10 permit ipv6 FE80::/63 2000::/3 remark Catch-upBRKSPG-2603 deny ipv6 any any Cisco and/or its affiliates. All rights reserved. © 2012 Cisco Public 44

Summary of Cisco IPv6 Security Products ASA Firewall ‒ Since version 7.0 (released 2005) ‒ SSL VPN for IPv6 (ASA 8.0), Stateful-Failover (ASA 8.2.2), Extension header filtering and inspection (ASA 8.4.2) ASA-SM ‒ Leverage ASA code base, same features ;-) 16 Gbps of IPv6 throughput FWSM ‒ IPv6 in software... 80 Mbps … Not an option (put an IPv6-only ASA in parallel or migrate to ASA-SM) IOS Firewall ‒ IOS 12.3(7)T (released 2005), Zone-based firewall on IOS-XE 3.6 (2012) IPS ‒ Since 6.2 (released 2008) Email Security Appliance (ESA) since 7.6.1 (May 2012) Web Security Appliance (WSA) with explicit proxy then transparent mode, work in progress ScanSafe expected to be available in 2012BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 45

Looping Attack Between 6to4 and ISATAP (RFC 6324)1. Spoofed packet 6to4 relay ISATAP routerS: 2001:db8::200:5efe:c000:201 192.0.2.1 Prefix 2001:db8::/64D: 2002:c000:202::1 2. IPv4 Packet containing 192.0.2.2 S: 2001:db8::200:5efe:c000:201 D: 2002:c000:202::1 3. IPv6 packet S: 2001:db8::200:5efe:c000:201 D: 2002:c000:202::1 Repeat until Hop Limit == 0  Root cause Mitigation: ‒ Same IPv4 encapsulation (protocol 41) • Easy on ISATAP routers: deny packets whose ‒ Different ways to embed IPv4 address in the IPv6 IPv6 is its 6to4 address • Less easy on 6to4 relay: block all ISATAP-like  ISATAP router: local address? ‒ accepts 6to4 IPv4 packets • Good news: not so many open ISATAP routers ‒ Can forward the inside IPv6 packet back to 6to4 on the Internet relay • Do not announce the 6to4 relay address outside  Symmetric looping attack exists of your AS and accepts protocol-41 packets only from your AS BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 46

6to4/6rd Tunnels Bypass Centralized ACL IPv6 6to4/6rd relay Internet ACL tunnel IPv4 Direct tunneled 6to4/6rd 6to4/6rd router traffic ignores router hub ACL 6rd CPE router can be configured to always go through hub Direct CPE-CPE communication must then be forbidden by IPv4 networkBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 47

6rd Relay Security Issues 6rd is more constrained than 6to4, hence more secure IPv4 ACL (or IPv4 routing) can limit the 6rd packets to the 6rd domain within the ISP ‒ No more open relay ‒ No more looping attacksBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 48

Secure IPv6 over IPv4/6 Public Internet  No traffic sniffing  No traffic injection  No service theft Public Network Site 2 Site Remote Access 6in4/GRE Tunnels Protected  ISATAP Protected by IPv4 by IPsec RA IPsec DMVPN 12.4(20)T  SSL VPN Client AnyConnect •IPsec VTI 12.4(6)T Any Connect Q3 2012 IPv6 •DMVPN 15.2(1)TBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 49

TelemetryControl Plane

Available Tools Usually IPv4 telemetry is available SNMP MIB ‒ Not always available yet on Cisco gears Flexible Netflow for IPv6 ‒ Available in : 12.4(20)T, 12.2(33)SRE ‒ Public domain tools: nfsen, …BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 51

For YourCisco IOS IPv6 MIB Implementation Reference IP FWD IP ICMP TCP UDP IOS Status (ROUTES) Original IPv4 2096 2011 2012 2013 Shipping only IPv6 only 2465 2466 2452 2454 No Plan Cisco-ized PVI Shipping since (subset of early 12.2(15)T, Cisco-ized Cisco-ized subset of 12.0(22)S, PVI drafts subset of ID-00 ID-00 rfc2011-update 12.2(14)S and under Cisco rfc2096-update derivatives enterprise OID) Protocol rfc2096-update rfc2011-update Implemented. Version = = Shipping on Independent 12.2SR 4292 4293 (PVI) rfc2012- rfc2013- Planned on update update 12.2SRE/HD+ = = 4022 4113 IPv4/IPv6 stats can be monitored from CLI “show interface accounting” on most platforms RFC 4292 and 4293 – Interface Stats table are added, also required HW support Tunnel MIB (RFC 4087) on 12.2(33)SRBBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 52

For YourFlexible NetFlow Referencewith „Traditional Flow Record‟ flow exporter FLOW-EXPORTER destination 2001:db8::1 <<< IPv6 is supported now source FastEthernet0/1 transport udp 3000 template data timeout 60 flow monitor FLOW-MONITOR record netflow ipv6 original-output exporter FLOW-EXPORTER statistics packet protocol statistics packet size interface GigEthernet0/15 ipv6 flow monitor FLOW-MONITOR outputBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 53

For YourFlexible Flow Record: IPv6 Key Fields Reference IPv6 Routing Transport Destination AS Destination Port TCP Flag: ACK IP (Source or Payload Size Destination) Peer AS Source Port TCP Flag: CWR Prefix (Source or Packet Section Traffic Index ICMP Code TCP Flag: ECE Destination) (Header) Forwarding ICMP Type TCP Flag: FIN Status Mask (Source or Packet Section IGMP Type TCP Flag: PSH Destination) (Payload) Is-Multicast IGP Next Hop TCP ACK Number TCP Flag: RST Minimum-Mask (Source or DSCP BGP Next Hop TCP Header Length TCP Flag: SYN Destination) TCP Sequence Flow TCP Flag: URG Protocol Extension Number Sampler ID UDP Message Traffic Class Hop-Limit TCP Window-Size Direction Length Flow Label Length TCP Source Port UDP Source Port Option Header Next-header Interface TCP Destination Port UDP Destination Header Length Version Input Port Payload Length Output TCP Urgent PointerBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 54

Netflow Reverse Usage Scanning an IPv6 network is impossible (address space too large) How can we run a security audit? Easy ‒ Get all IPv6 addresses from Netflow ‒ Note: scanning link-local addresses requires layer-2 adjacencyBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 55

Cisco Network Analysis Modules (NAM)  Service Modules for C6K, C7600 and ISR  Release 3.x include IPv6 Network Management capabilities  IPv6 monitoring and decodes with NAM  Can set up alarms with IPv6 addresses  Can configure an ―easy‖ IPv6 capture filter and IPv6-historical reportsBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 56

ForensicControl Plane

Multiple Facets to IPv6 Addresses Every host can have multiple IPv6 addresses simultaneously ‒ Need to do correlation! ‒ Alas, no Security Information and Event Management (SIEM) supports IPv6 ‒ Usually, a customer is identified by its /48  Every IPv6 address can be written in multiple ways ‒ 2001:0DB8:0BAD::0DAD ‒ 2001:DB8:BAD:0:0:0:0:DAD ‒ 2001:db8:bad::dad (this is the canonical RFC 5952 format) ‒ => Grep cannot be used anymore to sieve log files…BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 58

For YourPerl to Canonical IPv6 Addresses Reference #!/usr/bin/perl –w use strict ; use Socket ; use Socket6 ; my (@words, $word, $binary_address) ; ## go through the file one line at a time while (my $line = <STDIN>) { @words = split /[ n]/, $line ; foreach $word (@words) { $binary_address = inet_pton AF_INET6, $word ; if ($binary_address) { print inet_ntop AF_INET6, $binary_address ; } else { print $word ; } print " " ; } print "n" ; }BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 59

For YourPerl Grep6 Reference #!/usr/bin/perl –w use strict ; use Socket ; use Socket6 ; my (@words, $word, $binary_address, $address) ; $address = inet_pton AF_INET6, $ARGV[0] ; if (! $address) { die "Wrong IPv6 address passed as argument" ; } ## go through the file one line at a time while (my $line = <STDIN>) { @words = split /[ n()[]]/, $line ; foreach $word (@words) { $binary_address = inet_pton AF_INET6, $word ; if ($binary_address and $binary_address eq $address) { print $line ; next ; } } }BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 60

How to Find the MAC Address of an IPv6Address? Easy if EUI-64 format as MAC is embedded ‒2001:db8::0226:bbff:fe4e:9434 ‒ (need to toggle bit 0x20 in the first MAC byte = U/L) ‒Is 00:26:bb:4e:94:34BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 61

How to Find the MAC Address of an IPv6Address?  DHCPv6 address or prefix… the client DHCP Unique ID (DUID) can be ‒ MAC address: trivial ‒ Time + MAC address: simply take the last 6 bytes ‒ Vendor number + any number: no luck… next slide can help ‒ No guarantee of course that DUID includes the real MAC address. # show ipv6 dhcp binding Client: FE80::225:9CFF:FEDC:7548 DUID: 000100010000000A00259CDC7548 Username : unassigned Interface : FastEthernet0/0 IA PD: IA ID 0x0000007B, T1 302400, T2 483840 Prefix: 2001:DB8:612::/48 preferred lifetime 3600, valid lifetime 3600 expires at Nov 26 2010 01:22 PM (369)BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 62

DHCPv6 in Real Live… Not so attractive  Only supported in Windows Vista, and Windows 7 ‒ Not in Mac OS, Linux (default installation), … Windows Vista does not place MAC address in DUID Actual MAC address: # show ipv6 dhcp binding 0022.5f43.6522 Client: FE80::FDFA:CB28:10A9:6DD0 DUID: 0001000110DB0EA6001E33814DEE Username : unassigned IA NA: IA ID 0x1000225F, T1 300, T2 480 Address: 2001:DB8::D09A:95CA:6918:967 preferred lifetime 600, valid lifetime 600 expires at Oct 27 2010 05:02 PM (554 seconds)BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 63

How to Find the MAC Address of an IPv6Address? Last resort… look in the live NDP cache (CLI or SNMP) #show ipv6 neighbors 2001:DB8::6DD0 IPv6 Address Age Link-layer Addr State Interface 2001:DB8::6DD0 8 0022.5f43.6522 STALE Fa0/1 If no more in cache, then you should have scanned and saved the cache… EEM can be your friend First-Hop Security phase II can generate a syslog event on each new bindingBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 64

Lawful InterceptControl Plane

Which Target? Target could be ‒ Host address /128: probably very rare ‒ Subscriber prefix /48 or /56 ‒ Layer-2 address (MAC address) ‒ Circuit ‒ PPP session Targets based not based on IPv6 addresses are ‗as usual‘ and can be done as usual from a SP perspective ‒ Of course mediation device & LEA must understand IPv6 BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 66

SummaryControl Plane

Summary: Management, Control & Data Plane Protect management plane with access-class Authenticate IGP Consider the use of link-local on P-P links? Mitigate rogue-RA with RA-guard Configure control plane policing Beware of ping-pong on not /127 real P2P link Apply anti-spoofing, anti-bogons Disable source routing Use ACL where applicable ‒ ACL must permit NDPBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 68

Summary: Telemetry and Forensic SNMP MIB and Netflow v9 are your friends Netflow can be used for inventory Multiple addresses per node, multiple ways to write an IPV6 address Finding MAC address from IPv6: ‒ EUI-64, ‒ DHCPv6 (not so trivial) ‒ else periodic NDP cache dumps... LI for IPv6 implemented, missing mediation deviceBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 69

Conclusion As expected IPv6 secure operations are quite similar to IPv4 ‒ Main differences at layer 2 ‒ Tunnels complicate everything ‒ Lack of correlation toolsBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 70

Questions and Answers?

List of Acronyms 6rd: 6 Rapid Deployment  LLA: Link-Local Address AAA: Authentication, Authorization,  MD5: Message Digest 5 Accounting  NDP: Neighbor Discovery Protocol CGA: Cryptographically Generated  PIM: Protocol Independent Multicast Address  PMTUD: Path MTU Discovery DUID: DHCP Unique ID  RA: Router Advertisement EUI-64: Extended Unique ID  RIPng: Routing Information Protocol IPSec: IP Security Next Generation ISATAP: Intra-Site Automatic Tunnel  SEND: Secure Neighbor Discovery Addressing Protocol  SSH: Secure SHell LEA: Law Enforcement AgencyBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 72

Search Session Catalog: ―ipv6‖ IPv6 Related Sessions at Cisco LiveSession TitleBRKRST-2044 Enterprise Multi-Homed Internet Edge ArchitecturesBRKCRS-2301 Enterprise IPv6 DeploymentBRKCRT-9344 IPv6 for Cert NutsBRKRST-2311 IPv6 Planning, Deployment and Operation ConsiderationsBRKSEC-2003 IPv6 Security Threats and MitigationsBRKRST-2302 IPv6 TroubleshootingBRKSPG-2602 IPv4 Exhaustion: NAT and Transition to IPv6 for SPsBRKSPG-2603 How to Securely Operate an IPv6 NetworkBRKUCC-2061 IPv6 in UC NetworksLTRRST-1301, LTRSEC-3033 IPv6 Hands-on Lab, IPv6 Network Threat, Defense, Countermeasures and ControlsBRKEWN-2010 Design and Deployment of Ent. WLANBRKCCIE-9492 IPv6 for Route & Switching CCIE CandidatesBRKRST-3300 Service Provider IPv6 DeploymentBRKSPG-2604 Deploying Carrier Grade IPv6 using CGSECOCRST-3464 Cisco on Cisco: Making the Leap to IPv6 BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 74

Complete Your OnlineSession Evaluation Give us your feedback and you could win fabulous prizes. Winners announced daily. Receive 20 Passport points for each session evaluation you complete. Complete your session evaluation online now (open a browser through our wireless network to access our Don‘t forget to activate your portal) or visit one of the Internet Cisco Live Virtual account for access to stations throughout the Convention all session material, communities, and on-demand and live activities throughout Center. the year. Activate your account at the Cisco booth in the World of Solutions or visit www.ciscolive.com.BRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 75

Final Thoughts Get hands-on experience with the Walk-in Labs located in World of Solutions, booth 1042 Come see demos of many key solutions and products in the main Cisco booth 2924 and ask for IPv6 support Experiment with IPv6 on the dual-stack wireless (WLC 7.2) Experiment with IPv6-only hidden SSID ciscov6, password: ciscolive2012 (tweet results #CLUSIPV6) Visit www.ciscoLive365.com after the event for updated PDFs, on- demand session videos, networking, and more! Follow Cisco Live! using social media: ‒ Facebook: https://www.facebook.com/ciscoliveus ‒ Twitter: https://twitter.com/#!/CiscoLive ‒ LinkedIn Group: http://linkd.in/CiscoLIBRKSPG-2603 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 76

How to Securely Operate an IPv6 Network (2012 San Diego)

by Cisco Security, Working at Cisco Security on Jun 19, 2012

Statistics

Views

Actions

0 Embeds 0

Accessibility

Categories

Upload Details

Usage Rights

Report content

How to Securely Operate an IPv6 Network (2012 San Diego) Presentation Transcript