All Cisco-Network Study Notes

Protecting the Basement Using ACLs

In an accomplishment to assure switches and routers from assorted risks—both adventitious and

malicious—infrastructure-protection ACLs charge to be deployed at arrangement admission points.

These ACLs abjure admission from alien sources to all basement addresses, such as

router interfaces. At the aforementioned time, these ACLs admittance accepted alteration cartage to flow

uninterrupted through the infrastructure. A accepted set of ACLs consists of filtering

addresses that accept no business entering the network. Those are, for example, addresses

defined in RFC 1918 and RFC 3330.

Data accustomed by a router can be disconnected into two ample categories:

• Cartage that passes through the about-face or router

• Cartage destined to the about-face or router

In accustomed operations, the all-inclusive majority of cartage flows through the basement to reach

its ultimate destination. However, several cases abide area the router processor or switch

processor (RP/SP) charge anon handle data, best conspicuously acquisition protocols, alien router

access (such as Secure Shell [SSH]), and arrangement administration cartage (such as Simple

Network Administration Protocol [SNMP]). In addition, protocols such as ICMP and IP

options can crave absolute processing by the RP/SP. Best often, absolute admission to the

infrastructure should be acceptable alone back it’s accomplished from centralized sources. There are

a few notable exceptions, such as Border Gateway Protocol (BGP) peering; protocols that

terminate on the RP/SP, such as all-encompassing acquisition encapsulation [GRE]; and potentially

262 Chapter 16: Wire Speed Admission Ascendancy Lists

limited ICMP packets for connectivity testing, such as echo-request or ICMP unreachables

and Time to Live (TTL) asleep letters for able traceroute operation.

NOTE ICMP is generally acclimated for simple DoS attacks; it should alone be acceptable from external

sources, if necessary.

Although the abstracts even of best switches can handle millions and millions of packets per

second, the aforementioned does not authority accurate as far as the ascendancy even is concerned. The abstracts plane

is usually fabricated up of ASICs congenital to about-face packets from one anchorage to addition as fast as

possible. The ascendancy plane, on the added hand, is generally comprised of all-encompassing all-purpose

processors. Excessive cartage destined to the ascendancy even can calmly beat the switch,

which causes aerial CPU acceptance that ultimately after-effects in causeless and unpredictable

behavior. By clarification admission to basement accessories from alien sources, many

external risks associated with a absolute about-face or router advance are mitigated. Externally

sourced attacks can no best admission basement equipment. Archetype 16-1 shows a

common admission ambit clarification ACL.

Example 16-1 IPv4 Basement Aegis ACL

!--- Anti-spoofing entries first

!--- Abjure special-use abode sources.

!--- Refer to RFC 3330 for added appropriate use addresses.

access-list 100 abjure ip host 0.0.0.0 any

access-list 100 abjure ip 127.0.0.0 0.255.255.255 any

access-list 100 abjure ip 192.0.2.0 0.0.0.255 any

access-list 100 abjure ip 224.0.0.0 31.255.255.255 any

!--- Filter RFC 1918 space.

access-list 100 abjure ip 10.0.0.0 0.255.255.255 any

access-list 100 abjure ip 172.16.0.0 0.15.255.255 any

access-list 100 abjure ip 192.168.0.0 0.0.255.255 any

!--- Abjure your IP amplitude as antecedent from entering your network.

access-list 100 abjure ip YOUR_IP_RANGE any

!--- Admittance BGP.

access-list 100 admittance tcp host bgp_peer host router_ip eq bgp

access-list 100 admittance tcp host bgp_peer eq bgp host router_ip

!--- Abjure admission to centralized basement addresses.

access-list 100 abjure ip any INTERNAL_INFRASTRUCTURE_ADDRESSES

!--- Admittance alteration traffic.

access-list 100 admittance ip any any

RACL, VACL, and PACL: Many Types of ACLs 263

The ACL in Archetype 16-1 provides a acceptable starting arrangement for basement protection.

Naturally, adapt it to fit your arrangement environment. For added advice on applying

ingress ACLs, see RFC 2267.

State or No State?

State or No State?

Imagine your arrangement is beneath advance from a massive bulk of spoofed HTTP traffic. This

might, for example, be cartage aggravating to ability your capital Internet web server application random

source IP addresses, with baby packets advancing in at a aerial rate.

Another accepted advance book consists of sending a ample cardinal of Internet Control

Message Protocol (ICMP) packets. The aftermost affair you appetite in these advance cases is to fill

the affiliation table of the ambit firewall.

Both scenarios highlight a specificity accepted to around all firewalls: They maintain

state—state for connections. Maintaining a affiliation accompaniment isn’t a adorable affection in

these cases, because stateful accessories accept a absolute in agreement of circumstantial admission they

can handle. After the affiliation table is full, 18-carat accepted cartage is denied by

collateral damage. This action is accepted as abnegation of account (DoS). This is where

firewalls lose a point adjoin stateless devices, such as switches processing ACLs.

Therefore, ACLs accommodate themselves able-bodied to prefirewall ambit clarification or to assure the

infrastructure itself. At the end of the day, allotment amid a firewall and an admission list

isn’t consistently necessary; they both accompaniment anniversary other.

ACLs or Firewalls?

ACLs or Firewalls?

If switches are able to analysis millions of admission packets per additional adjoin ACLs, what

good are firewalls? Put addition way, the catechism is, “What is the aberration amid an

ACL and a firewall?,” or, “Where can I administer ACLs?” The acknowledgment depends on the protection

level you appetite to accommodate and the blazon of attacks you are acceptable to face. ACLs ascendancy which

protocols and/or ports a host can use to ability a target, and that is appealing abundant it. They are

often referred to as “Layer 3 or Layer 4 ACLs” for that reason. Unlike best firewalls, ACLs

behave in a stateless manner. Admission cartage is arrested adjoin the ACL on a packet-perpacket

basis and either alone or acceptable according to the activity that a user chooses. A

stateful firewall, on the added hand, checks admission cartage adjoin a action (which is

actually agnate in appearance and anatomy to an ACL) and creates a affiliation almanac if the traffic

is permitted. Subsequent packets that accord to this affiliation are automatically permitted

without rechecking the ACL. Although this allows for accomplished advertisement and logging (for

example, a firewall makes it accessible to accommodate admission and accounting logs on a per-connection

basis), it comes with assertive drawbacks.

Wire Acceleration Admission Ascendancy Lists

This book’s allotment focuses on how to use Ethernet switches to enhance a network’s overall

security. Admission ascendancy lists (ACL) accommodate a simple way to accomplish a aegis action at the

core of a arrangement area the bandwidth can calmly ability tens of gigabits per additional (Gbps).

This affiliate explains why administration ACLs in the network’s bulk are important and the

different flavors of ACL featured in switches (router ACL, VLAN ACL [VACL], and portbased

ACL). The affiliate additionally dives into accouterments architectures that accomplish wire speed

processing of ACLs possible.

Previous capacity abundant the assorted vulnerabilities (and the acknowledgment techniques) that

can abide in a arrangement based on Ethernet switches. This affiliate looks at the Ethernet

switches from a hardly altered perspective: Rather than alleviative them as abundant ground

for attacks, let’s attending at them as simple, yet powerful, action enforcers (that is, as security

control devices).

Access ascendancy in a arrangement is generally implemented through firewalls; they are usually

deployed at the network’s perimeter. For example, a ample cardinal of networks await on the

protection offered by a accumulated firewall placed amid the Internet and the internal

network resources. Abounding times, a additional band of firewalls complements the perimeter

layer to absorber abstracts centermost servers from attacks or to artlessly bind admission to certain

information. However, there is a aegis archetype accepted as aegis in depth. In a nutshell,

defense in abyss is based on the assumption that aegis does not await on a distinct mechanism,

but a apartment of mechanisms. Networks advised according to this archetype about contain

intrusion blockage systems (IPS) and host aegis solutions, and they accomplish access

control through ACLs in several credibility of the network. ACLs can accompaniment firewalls. In

its best basal form, an ACL permits or denies cartage to and/or from a host for a specific

protocol and anchorage combination. Contrary to a stateful firewall, ACLs accept no abstraction of

connection, flow, or stream. They action admission and approachable cartage on a packet-perpackets

basis. This acreage makes ACLs able beneath assertive advance scenarios where

maintaining accompaniment tables is undesirable. A claim of the defense-in-depth architecture is for

security accessories to act as clearly as accessible to accustomed traffic. This agency inducing

small arrangement cessation and the basic absence of packet accident (that is, alone absolutely denied

packet should be dropped). To accomplish this requirement, best of today’s switches accept the

capability to accomplish ACLs at wire speed. Wire acceleration and wire-rate ACL administration are

fairly common agreement in product-marketing literature, but what do these agreement mean?

260 Affiliate 16: Wire Acceleration Admission Ascendancy Lists

To acknowledgment what wire acceleration and wire-rate ACL administration mean, a simple algebraic exercise

is necessary. Let’s booty a Gb Ethernet link. The best raw data-transfer bulk it can

sustain is 1 billion $.25 per additional (bps) in anniversary administration (transmit and receive). This

translates to 125,000,000 bytes per second. The minimum anatomy admeasurement on Ethernet is 64

bytes. To access the cardinal of 64-byte frames per additional a Gb Ethernet articulation can transmit,

you ability be tempted to bisect 125,000,000 by 64. Although you’d get a number, it would

be incorrect. Indeed, Ethernet accessories charge acquiesce a minimum abandoned aeon amid frame

transmissions, which is accepted as the inter-frame gap (or inter-packet gap). Its purpose is to

give accessories time to adapt for the accession of the abutting frame. The minimum inter-frame

gap is 96 bit times, which amounts to 96 nanoseconds (ns) for Gb Ethernet. Add a 7-byte

preamble additional a distinct byte start-of-frame delimiter to anniversary frame, and you get a 20-byte

idle time amid the manual of two frames. Therefore, the best bulk of

64-byte frames that can be transmitted anniversary additional on a Gb Ethernet articulation is 125,000,000/

(64 + 20) = 1,488,095. That’s about 1.5 actor frames per second!

In the ambience of a distinct Gb Ethernet link, a accessory is said to accomplish ACLs at wire speed

when it is able of administration a permit/deny aegis action 1,488,095 times per second.

Multiply this amount by the anchorage body that the about-face offers, and you bound ability a mindboggling

figure. In reality, all switches appear with a beam in agreement of how abounding packets

they can action per second. The beam is generally acutely high—numbers in the 50 to 60

million packets per additional (pps) ambit are frequent. Using application-specific integrated

circuits (ASIC) best of the time, avant-garde LAN switches accept the adequacy to accomplish tens

of millions of ACL lookups every second—and again some! The final section, “Technology

Behind Fast ACL Lookups,” carefully looks at this technology.

Other Techniques That Ascertain Alive Worms

Internet account providers (ISP) use added techniques to ascertain an alive bastard that

propagates in their networks. Actually, ISP can ascertain arrangement scanning to accidental IP

addresses.

The ambush is to advanced all packets to nonexisting addresses, such as nonallocated IP

addresses, to a distinct host that can be monitored for cartage surge. If this host receives too

much traffic, this agency that abounding packets are beatific to nonexisting hosts. This is most

probably the aftereffect of a bastard about scanning the arrangement to bear itself.