1) secure management plane:
2) access-list (IOS):
3) icmp techiques to reduce the risk of icmp -related attack (IOS):
more info: IP Application Services Configuration Guide, Cisco IOS Release 15M&T
4) L2 - Dynamic Trunking Protocol (DTP)
5) L2 - Switch Port Security
6) L2 - Storm Control
7) L2 - Protected Ports
They are not able to communicate:
8) L2 - Port Blocking
By default, the switch floods packets with unknown destination MAC addresses out of all ports. If unknown unicast and multicast traffic is forwarded to a protected port, there could be security issues. To prevent unknown unicast or multicast traffic from being forwarded from one port to another, you can block a port (protected or nonprotected) from flooding unknown unicast or multicast packets to other ports.
9) L2 - Private Vlan
VTP v3 supports Private VLANs.
10) L2 - MAC access list
block non-IP traffic except ARP:
The ethertype mask functions the same way as a wildcard mask from IP access-lists, where a bit of zero means match and a bit of one means don’t care.
11) L2 - VLAN ACL
The following protocols use 802.2 SNAP encapsulation with the SNAP Protocol ID values listed below:
All SNAP-encapsulated packets can be matched using an LSAP value of 0xAAAA.
12) L2 - STP BPDU Guard
BPDU Guard can be enabled at the interface level using the command spanning-tree bpduguard enable, in which case it’s applied unconditionally to the port. BPDU Guard can be enabled globally using the command spanning-tree portfast bpduguard default , in which case it’s applied only to portfast-enabled ports, also called Edge Ports. Note that if you enable portfast (access or trunk) on a port, if it receives a BPDU it gets out of the portfast-enabled state and starts negotiating its STP state, so this feature is conditional.
or per interface
or only globally:
13) L2 - STP BPDU Filter
BPDU Filter has different behavior, depending on how it’s enabled:
-When configured at the interface level, BPDU Filter unconditionally drops all inbound BPDUs and does not send BPDUs out the interface.
-When configured at global level, it sends out exactly 11 BPDUs on all portfast-enabled interfaces, and if no BPDU is received within this interval it stops sending BPDUs; however, if a BPDU is received inbound on the interface at any time after, it is accepted and STP port state negotiation starts, so BPDU Filter becomes inactive.
14) L2 - STP Guard Root
Preventing port to accept connected switch become the root switch:
15) L2 - STP Loop Guard
You can use loop guard to prevent alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link. This feature is most effective when it is enabled on the entire switched network. Loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports.
You can enable this feature by using the spanning-tree loopguard default global configuration command.
When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports.
When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports only if the interface is blocked by loop guard in all MST instances. On a boundary port, loop guard blocks the interface in all MST instances.
16) L2 - DHCP - snooping
DHCP Snooping is a security feature that inspects DHCP packets initiated/destined from/to hosts of an attached VLAN, thus is a switch functionality. With SNopping configured, the switch enforces DHCP packet flow integrity and protects the network from DHCP-based attacks, regardless of its role in the DHCP process: it can be the DHCP Server, DHCP Layer 3 Relay Agent, or have no role in the DHCP end-to-end flow (act like a Layer 2 switch for the VLAN).
to protect DHCP and limit the number of allocated IPs you can implement:
17) L2 - Dynamic ARP Inspection
Dynamic ARP Inspection (DAI) is a security feature that fixes some well-known weaknesses in the ARP protocol. Generally, ARP operation on an Ethernet segment allows any host to spoof a MAC address for any IP address on the segment. These attacks, commonly known as Man-in-the-Middle (MITM) attacks, cannot be prevented by using only port-security, access-lists, or other well-known security features. DAI is used to prevent ARP poisoning attacks.
For non DHCP environment:
example:
18) L2 - IP Source Guard
It works almost like DHCP Snooping together with ARP Inspection.
Example:
19) L3 - Preventing ICMP attack - ACL
You have to use named ACL to see all options:
20) L3 - Preventing ICMP attack - NBAR
Network-Based Application Recognition (NBAR) includes a feature called Protocol Discovery. Protocol Discovery provides an easy way to discover the application protocols that are operating on an interface. When you configure NBAR, the first task is to enable Protocol Discovery.
21) L3 - Preventing ICMP attack - Policing
In my example:
Ensure that the burst size is large enough to accommodate normal and excess burst durations of 200 ms and 300 ms at a rate of 128 Kbps.
Bc = (128000*0,2)/8=3200 bytes Be = (128000*0,3)/8=4800 bytes
22) L3 - Preventing ICMP attack - MPF
23) L3 - Preventing TCP attack - ACL
24) L3 - Preventing TCP attack - Policing
Drop SYN flood attack when it exceeds 16 Kbps:
25) L3 - Preventing TCP attack - CBAC
26) L3 - Preventing TCP attack - CAR
27) L3 - Preventing application attack - MPF
28) L3 - IP Spoofing Attacks- uRPF
29) L3 - Fragments Attack - ACL
30) L3 - RFC 1918
31) L3 - RFC 2827
RFC 2827 defines a filtering mechanism based on your internally assigned IPv4 address space, to ensure a basic form of security.
32) L3 - RFC 3030
RFC 3030
RFC 5735
32) L3 - IOS - TCP Intercept
33) L3 - IOS - TCP Intercept - watched mode
34) L3 - ASA - TCP Intercept
35) L3 - IOS - NBAR traffic classification
36) L3 - IPv6 - RA Guard
Configure IPv6 DHCPv6 Guard on SW3 for all current and future hosts in VLAN 11. Allow R4’s FE80::4 link-local address to act as DHCP server but only for 2001::/64 prefix. R6 should not be affected by the above configurations. Activate DHCPv6 server on R4 for 2001::/64 subnet; assign the domain inelab.local and the DNS server 2001::4 with maximum lifetime. Configure R5 to receive an IPv6 address via DHCPv6.
DHCPv6 Guard achieves almost the same thing for IPv6 as DHCP snooping did for IPv4. It blocks DHCP reply and advertisement messages that originate from unauthorized DHCP servers and relay agents that forward DHCP packets from servers to clients. It lacks the advanced functionalities of deep DHCP packet inspection to prevent DHCP starvation attacks, but this problem is solved with IPv6 snooping, with which you can limit the number of IPv6 addresses that a neighbor can use; it also does not support rate-limiting the DHCPv6 clients for the number of requests
CISCO Doc - IOS 15s (only!!!!)
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/15-s/ip6f-15-s-book/ip6-dhcpv6-guard.html
control-plane host
management-interface fa0/0 allow https ssh R2#sh management-interface
Management interface FastEthernet0/0
Protocol Packets processed
ftp 0
http 0
https 0
ssh 0
tftp 0
snmp 0
beep 0
telnet 0
tl1 0
R2#2) access-list (IOS):
R3(config)#ip access-list extended TEST123
R3(config-ext-nacl)#den
R3(config-ext-nacl)#deny ip a
R3(config-ext-nacl)#deny ip any a
R3(config-ext-nacl)#deny ip any any ?
dscp Match packets with given dscp value
fragments Check non-initial fragments
log Log matches against this entry
log-input Log matches against this entry, including input interface
option Match packets with given IP Options value
precedence Match packets with given precedence value
time-range Specify a time-range
tos Match packets with given TOS value
ttl Match packets with given TTL value
<cr>
R3(config-ext-nacl)#deny ip any any fra
R3(config-ext-nacl)#deny ip any any fragments ?
dscp Match packets with given dscp value
log Log matches against this entry
log-input Log matches against this entry, including input interface
option Match packets with given IP Options value
precedence Match packets with given precedence value
time-range Specify a time-range
tos Match packets with given TOS value
ttl Match packets with given TTL value
<cr>
R3(config-ext-nacl)#deny ip any any tt
R3(config-ext-nacl)#deny ip any any ttl ?
eq Match only packets on a given TTL number
gt Match only packets with a greater TTL number
lt Match only packets with a lower TTL number
neq Match only packets not on a given TTL number
range Match only packets in the range of TTLs
R3(config-ext-nacl)#deny ip any any opt
R3(config-ext-nacl)#deny ip any any option ?
<0-255> IP Options value
add-ext Match packets with Address Extension Option (147)
any-options Match packets with ANY Option
com-security Match packets with Commercial Security Option (134)
dps Match packets with Dynamic Packet State Option (151)
encode Match packets with Encode Option (15)
eool Match packets with End of Options (0)
ext-ip Match packets with Extended IP Option (145)
ext-security Match packets with Extended Security Option (133)
finn Match packets with Experimental Flow Control Option (205)
imitd Match packets with IMI Traffic Desriptor Option (144)
lsr Match packets with Loose Source Route Option (131)
mtup Match packets with MTU Probe Option (11)
mtur Match packets with MTU Reply Option (12)
no-op Match packets with No Operation Option (1)
nsapa Match packets with NSAP Addresses Option (150)
record-route Match packets with Record Route Option (7)
router-alert Match packets with Router Alert Option (148)
sdb Match packets with Selective Directed Broadcast Option (149)
security Match packets with Basic Security Option (130)
ssr Match packets with Strict Source Routing Option (137)
stream-id Match packets with Stream ID Option (136)
timestamp Match packets with Time Stamp Option (68)
traceroute Match packets with Trace Route Option (82)
ump Match packets with Upstream Multicast Packet Option (152)
visa Match packets with Experimental Access Control Option (142)
zsu Match packets with Experimental Measurement Option (10)
R3(config-ext-nacl)#deny ip any any option3) icmp techiques to reduce the risk of icmp -related attack (IOS):
Device(config)# no ip source-route
Device(config)# interface GigabitEthernet 0/0/0
Device(config-if)# no ip unreachables
Device(config-if)# no ip redirects
Device(config-if)# no ip mask-replymore info: IP Application Services Configuration Guide, Cisco IOS Release 15M&T
4) L2 - Dynamic Trunking Protocol (DTP)
interface range FastEthernet1/0/1 - 2
switchport nonegotiate5) L2 - Switch Port Security
interface FastEthernet1/0/1
switchport voice vlan 100
switchport port-security
switchport port-security maximum 2
switchport port-security maximum 1 vlan voice
switchport port-security maximum 1 vlan access
switchport port-security violation protect
switchport port-security aging time 10
switchport port-security aging type inactivity
!
errdisable recovery cause psecure-violation
errdisable recovery interval 1806) L2 - Storm Control
interface FastEthernet1/0/2
storm-control broadcast level bps 10m
storm-control action trap
!
!
interface FastEthernet1/0/3
storm-control unicast level 1
storm-control action trap
!
!
snmp-server enable traps storm-control trap-rate 60
snmp-server host 136.1.13.33 traps version 2c cisco7) L2 - Protected Ports
They are not able to communicate:
interface range FastEthernet1/0/13 , FastEthernet1/0/15
switchport mode access
switchport access vlan 13
switchport protected
no shutdown
!8) L2 - Port Blocking
By default, the switch floods packets with unknown destination MAC addresses out of all ports. If unknown unicast and multicast traffic is forwarded to a protected port, there could be security issues. To prevent unknown unicast or multicast traffic from being forwarded from one port to another, you can block a port (protected or nonprotected) from flooding unknown unicast or multicast packets to other ports.
Switch# configure terminal
Switch(config)# interface gigabitethernet1/0/1
Switch(config-if)# switchport block multicast
Switch(config-if)# switchport block unicast
Switch(config-if)# end 9) L2 - Private Vlan
VTP v3 supports Private VLANs.
Switch# configure terminal
Switch(config)# vlan 20
Switch(config-vlan)# private-vlan primary
Switch(config-vlan)# exit
Switch(config)# vlan 501
Switch(config-vlan)# private-vlan isolated
Switch(config-vlan)# exit
Switch(config)# vlan 502
Switch(config-vlan)# private-vlan community
Switch(config-vlan)# exit
Switch(config)# vlan 503
Switch(config-vlan)# private-vlan community
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# private-vlan association 501-503
Switch(config-vlan)# end
Switch(config)# show vlan private vlan
Switch# configure terminal
Switch(config)# interface gigabitethernet1/0/22
Switch(config-if)# switchport mode private-vlan host
Switch(config-if)# switchport private-vlan host-association 20 501
Switch(config-if)# end
Switch# show interfaces gigabitethernet1/0/22 switchport
Switch# configure terminal
Switch(config)# interface gigabitethernet1/0/2
Switch(config-if)# switchport mode private-vlan promiscuous
Switch(config-if)# switchport private-vlan mapping 20 add 501-503
Switch(config-if)# end 10) L2 - MAC access list
block non-IP traffic except ARP:
SW1:
!
mac access-list extended PERMIT_ARP
permit any any 0x806 0x0
!
interface FastEthernet1/0/1
mac access-group PERMIT_ARP inThe ethertype mask functions the same way as a wildcard mask from IP access-lists, where a bit of zero means match and a bit of one means don’t care.
11) L2 - VLAN ACL
SW2:
mac access-list extended PERMIT_LAYER2
permit any any lsap 0x4242 0x0
permit any any 0x010B 0x0
permit any any 0x806 0x0
permit any any lsap 0xAAAA 0x0
!
ip access-list extended DENY_TELNET
permit tcp any any eq 23
!
ip access-list extended PERMIT_IP
permit ip any any
!
vlan access-map VLAN23 10
match mac address PERMIT_LAYER2
action forward
vlan access-map VLAN23 20
match ip address DENY_TELNET
action drop
vlan access-map VLAN23 30
match ip address PERMIT_IP
action forward
!
vlan filter VLAN23 vlan-list 23
The following protocols use 802.2 SNAP encapsulation with the SNAP Protocol ID values listed below:
VTP: 0x2003
CDP: 0x2000
DTP: 0x2004
UDLD: 0x0111All SNAP-encapsulated packets can be matched using an LSAP value of 0xAAAA.
12) L2 - STP BPDU Guard
MP-SW#sh spanning-tree summary
Switch is in pvst mode
Root bridge for: none
Extended system ID is enabled
Portfast Default is disabled
PortFast BPDU Guard Default is disabled
Portfast BPDU Filter Default is disabled
Loopguard Default is disabled
EtherChannel misconfig guard is enabled
UplinkFast is disabled
BackboneFast is disabled
Configured Pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001 0 0 0 16 16
---------------------- -------- --------- -------- ---------- ----------
1 vlan 0 0 0 16 16
MP-SW#BPDU Guard can be enabled at the interface level using the command spanning-tree bpduguard enable, in which case it’s applied unconditionally to the port. BPDU Guard can be enabled globally using the command spanning-tree portfast bpduguard default , in which case it’s applied only to portfast-enabled ports, also called Edge Ports. Note that if you enable portfast (access or trunk) on a port, if it receives a BPDU it gets out of the portfast-enabled state and starts negotiating its STP state, so this feature is conditional.
SW2:
interface FastEthernet1/0/3
spanning-tree bpduguard enable
!
!
spanning-tree portfast default
spanning-tree portfast bpduguard default
!
errdisable recovery cause bpduguard
errdisable recovery interval 300or per interface
interface FastEthernet1/0/3
spanning-tree portfast
!
spanning-tree portfast bpduguard default
!or only globally:
!
spanning-tree portfast default
spanning-tree portfast bpduguard default
!MP-SW#sh spanning-tree interface fa1/0/17 detail
Port 19 (FastEthernet1/0/17) of VLAN0001 is designated forwarding
Port path cost 19, Port priority 128, Port Identifier 128.19.
Designated root has priority 32768, address 000a.4138.4dc0
Designated bridge has priority 32769, address e8ba.7091.9d00
Designated port id is 128.19, designated path cost 38
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
The port is in the portfast mode
Link type is point-to-point by default
Bpdu guard is enabled
BPDU: sent 66617, received 0
MP-SW#13) L2 - STP BPDU Filter
BPDU Filter has different behavior, depending on how it’s enabled:
-When configured at the interface level, BPDU Filter unconditionally drops all inbound BPDUs and does not send BPDUs out the interface.
interface FastEthernet1/0/1
spanning-tree bpdufilter enable-When configured at global level, it sends out exactly 11 BPDUs on all portfast-enabled interfaces, and if no BPDU is received within this interval it stops sending BPDUs; however, if a BPDU is received inbound on the interface at any time after, it is accepted and STP port state negotiation starts, so BPDU Filter becomes inactive.
spanning-tree portfast bpdufilter default14) L2 - STP Guard Root
Preventing port to accept connected switch become the root switch:
SW2:
!
interface FastEthernet1/0/20
spanning-tree guard root15) L2 - STP Loop Guard
You can use loop guard to prevent alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link. This feature is most effective when it is enabled on the entire switched network. Loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports.
You can enable this feature by using the spanning-tree loopguard default global configuration command.
When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports.
When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports only if the interface is blocked by loop guard in all MST instances. On a boundary port, loop guard blocks the interface in all MST instances.
SW1:
!
spanning-tree loopguard default16) L2 - DHCP - snooping
DHCP Snooping is a security feature that inspects DHCP packets initiated/destined from/to hosts of an attached VLAN, thus is a switch functionality. With SNopping configured, the switch enforces DHCP packet flow integrity and protects the network from DHCP-based attacks, regardless of its role in the DHCP process: it can be the DHCP Server, DHCP Layer 3 Relay Agent, or have no role in the DHCP end-to-end flow (act like a Layer 2 switch for the VLAN).
SW1:
ip dhcp snooping
ip dhcp snooping vlan 23
ip dhcp snooping database flash:/VLAN23_DHCP.txt
ip dhcp snooping database write-delay 30
!
interface FastEthernet1/0/12
ip dhcp snooping limit rate 15 <--- DHCP client
!
interface FastEthernet1/0/2
ip dhcp snooping trust <--- DHCP server
!
errdisable recovery cause dhcp-rate-limit
errdisable recovery interval 300
!
interface FastEthernet1/0/12
switchport mode access
switchport access vlan 23
spanning-tree portfast
no shutdown
R2:
!
ip dhcp relay information trust-all
!
ip dhcp pool VLAN23
network 136.1.23.0/24to protect DHCP and limit the number of allocated IPs you can implement:
SW1:
!
interface FastEthernet1/0/12
switchport port-security17) L2 - Dynamic ARP Inspection
Dynamic ARP Inspection (DAI) is a security feature that fixes some well-known weaknesses in the ARP protocol. Generally, ARP operation on an Ethernet segment allows any host to spoof a MAC address for any IP address on the segment. These attacks, commonly known as Man-in-the-Middle (MITM) attacks, cannot be prevented by using only port-security, access-lists, or other well-known security features. DAI is used to prevent ARP poisoning attacks.
For non DHCP environment:
SW1:
arp access-list DAI_VLAN23
permit ip host 136.1.23.2 mac host d867.d9e0.bbc0 log
permit ip host 136.1.23.3 mac host 001e.f779.4771 log
!
ip arp inspection filter DAI_VLAN23 vlan 23
!
ip arp inspection vlan 23
ip arp inspection vlan 23 logging acl-match matchlog
ip arp inspection vlan 23 logging dhcp-bindings all
ip arp inspection vlan 23 logging arp-probe
ip arp inspection log-buffer entries 10
ip arp inspection validate src-mac dst-mac ipexample:
*Mar 1 17:39:29.515: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Res) on Fa1/0/4, vlan 1.([04c5.a43f.d6d0/10.0.0.10/e8b7.4842.4c58/10.0.0.1/17:39:28 UTC Mon Mar 1 1993])18) L2 - IP Source Guard
It works almost like DHCP Snooping together with ARP Inspection.
SW1:
interface FastEthernet1/0/2
ip verify source port-security
switchport port-security
ip dhcp snooping trust
!
interface range FastEthernet1/0/9 - 10
switchport mode access
switchport access vlan 23
ip verify source port-security
switchport port-security
no shutdown
!
!
ip dhcp snooping
ip dhcp snooping vlan 23Example:
MP-SW#sh ip verify source
Interface Filter-type Filter-mode IP-address Mac-address Vlan Log
--------- ----------- ----------- --------------- ----------------- ---- ---
Fa1/0/4 ip-mac active deny-all deny-all 1
Fa1/0/13 ip-mac active 10.0.0.6 04:C5:A4:3F:D6:D0 1 disabled
MP-SW19) L3 - Preventing ICMP attack - ACL
You have to use named ACL to see all options:
SW2:
ip access-list extended ICMP_ATTACK
permit icmp 172.1.114.0 0.0.0.255 any echo
permit icmp 172.1.114.0 0.0.0.255 any echo-reply
permit icmp 172.1.114.0 0.0.0.255 any ttl-exceeded
permit icmp 172.1.114.0 0.0.0.255 any port-unreachable
permit icmp 172.1.114.0 0.0.0.255 any packet-too-big
permit icmp 172.1.114.0 0.0.0.255 any source-quench
deny icmp 172.1.114.0 0.0.0.255 any
permit ip any any
!
interface Vlan213
ip access-group ICMP_ATTACK in
ASA3:
icmp permit any echo-reply OUTSIDE 20) L3 - Preventing ICMP attack - NBAR
Network-Based Application Recognition (NBAR) includes a feature called Protocol Discovery. Protocol Discovery provides an easy way to discover the application protocols that are operating on an interface. When you configure NBAR, the first task is to enable Protocol Discovery.
R3:
class-map match-all ICMP
match protocol icmp
!
policy-map ICMP
class ICMP
drop
!
!Note that NBAR classification engine needs to be enabled at the interface level for NBAR traffic policies to be matched.
!
interface FastEthernet0/1.23
ip nbar protocol-discovery
service-policy output ICMP21) L3 - Preventing ICMP attack - Policing
In my example:
Ensure that the burst size is large enough to accommodate normal and excess burst durations of 200 ms and 300 ms at a rate of 128 Kbps.
Bc = (128000*0,2)/8=3200 bytes Be = (128000*0,3)/8=4800 bytes
R3:
ip access-list extended ICMP_ATTACK
permit icmp any any echo-reply
!
class-map ICMP_ATTACK
match access-group name ICMP_ATTACK
!
policy-map POLICE_VLAN13
class ICMP_ATTACK
police 128000 3200 4800 conform-action set-prec-transmit 1 exceed-action set-prec-transmit 0 violate-action drop
!
interface FastEthernet0/1.13
service-policy input POLICE_VLAN1322) L3 - Preventing ICMP attack - MPF
ASA4:
access-list ICMP_VLAN143 extended permit icmp any 172.1.143.0 255.255.255.0 echo
!
class-map ICMP_VLAN143
match access-list ICMP_VLAN143
!
policy-map ICMP_VLAN143
class ICMP_VLAN143
police output 128000
!
service-policy ICMP_VLAN143 interface OUTSIDE23) L3 - Preventing TCP attack - ACL
R3:
ip access-list extended TCP_ESTABLISHED
permit tcp any any established
deny tcp any any
permit ip any any
!
interface FastEthernet0/1.13
ip access-group TCP_ESTABLISHED in24) L3 - Preventing TCP attack - Policing
Drop SYN flood attack when it exceeds 16 Kbps:
R3:
ip access-list extended SYN_VLAN13
permit tcp any 136.1.13.0 0.0.0.255 syn
!
class-map SYN_VLAN13
match access-group name SYN_VLAN13
!
policy-map SYN_VLAN13
class SYN_VLAN13
police 16000 conform-action transmit exceed-action drop violate-action drop
!
interface FastEthernet0/0.133
service-policy input SYN_VLAN1325) L3 - Preventing TCP attack - CBAC
R3:
ip inspect tcp block-non-session
ip inspect tcp synwait-time 10
ip inspect tcp max-incomplete host 50 block-time 5
ip inspect log drop-pkt
!
ip inspect name CBAC_VLAN13 tcp
ip inspect name CBAC_VLAN13 udp
!
interface FastEthernet0/1.13
ip inspect CBAC_VLAN13 in26) L3 - Preventing TCP attack - CAR
R2:
ip access-list extended 100
deny tcp any any established
permit tcp any any
!
interface GigabitEthernet0/0
rate-limit input access-group 100 64000 8000 16000 conform-action transmit exceed-action drop27) L3 - Preventing application attack - MPF
ASA3:
regex REG_cisco "^cisco.*"
regex REG_c100 "^c100.*"
regex REG_c200 "^c200.*"
!
class-map type regex match-any FTP_REGEX
match regex REG_cisco
match regex REG_c100
match regex REG_c200
!
class-map type inspect ftp match-all FTP_COMMAND
match request-command dele
!
policy-map type inspect ftp FTP_INSPECT
parameters
mask-banner
mask-syst-reply
match filename regex class FTP_REGEX
reset
class FTP_COMMAND
reset
!
!
!
class-map FTP_PORT
match port tcp eq 21
!
policy-map VLAN133
class FTP_PORT
inspect ftp strict FTP_INSPECT
!
service-policy VLAN133 interface OUTSIDE28) L3 - IP Spoofing Attacks- uRPF
R3:
access-list 101 deny ip any any log
!
interface FastEthernet0/1.13
ip verify unicast source reachable-via rx 10129) L3 - Fragments Attack - ACL
R2:
ip access-list extended ICMP_FRAGMENTS
deny icmp any any fragments
permit ip any any
!
interface GigabitEthernet0/0
ip access-group ICMP_FRAGMENTS in30) L3 - RFC 1918
R3:
ip access-list extended RFC1918
deny ip 10.0.0.0 0.255.255.255 any log
deny ip 172.16.0.0 0.15.255.255 any log
deny ip 192.168.0.0 0.0.255.255 any log
permit ip any any
!
ip access-list log-update threshold 1
ip access-list logging hash-generation
!
interface FastEthernet0/1.23
ip access-group RFC1918 in31) L3 - RFC 2827
RFC 2827 defines a filtering mechanism based on your internally assigned IPv4 address space, to ensure a basic form of security.
R3:
ip access-list extended RFC2827_IN
deny ip 136.1.0.0 0.255.255.255 any log RFC2827_IN_LINE1
permit ip any any
!
ip access-list extended RFC2827_OUT
permit ip 136.1.0.0 0.255.255.255 any
deny ip any any log RFC2827_OUT_LINE2
!
interface FastEthernet0/0.143
ip access-group RFC2827_IN in
ip access-group RFC2827_OUT out
!
ip access-list log-update threshold 132) L3 - RFC 3030
RFC 3030
0.0.0.0/8
10.0.0.0/8
14.0.0.0/8
24.0.0.0/8
39.0.0.0/8
127.0.0.0/8
128.0.0.0/16
169.254.0.0/16
172.16.0.0/12
191.255.0.0/16
192.0.0.0/24
192.0.2.0/24
192.88.99.0/24
192.168.0.0/16
198.18.0.0/15
223.255.255.0/24
224.0.0.0/4
240.0.0.0/4 RFC 5735
0.0.0.0/8
10.0.0.0/8
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.88.99.0/24
192.168.0.0/16
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4
255.255.255.255/3232) L3 - IOS - TCP Intercept
R3:
ip access-list extended TCP_INTERCEPT
permit ip any 136.1.13.0 0.0.0.255
!
ip tcp intercept list TCP_INTERCEPT
!
ip tcp intercept drop-mode random
ip tcp intercept connection-timeout 30
ip tcp intercept one-minute low 30 high 60
ip tcp intercept max-incomplete low 80 high 10033) L3 - IOS - TCP Intercept - watched mode
R3:
ip access-list extended TCP_INTERCEPT
permit ip any 136.1.13.0 0.0.0.255
!
!
ip tcp intercept list TCP_INTERCEPT
ip tcp intercept mode watch
ip tcp intercept watch-timeout 20
34) L3 - ASA - TCP Intercept
ASA3:
class-map type management TELNET
match port tcp eq telnet
!
policy-map TELNET
class TELNET
set connection embryonic-conn-max 10
!
service-policy TELNET interface INSIDE
!
class-map TCP_INTERCEPT
match any
!
policy-map global_policy
class TCP_INTERCEPT
set connection embryonic-conn-max 15 per-client-embryonic-max 1 35) L3 - IOS - NBAR traffic classification
R3:
class-map match-all EXTENSION
match protocol http url *.bin|*.exe|*.com
!
policy-map DROP
class EXTENSION
drop
!
!Note that NBAR protocol classification engine needs to be enabled at the interface level separately.
!
interface FastEthernet0/0.143
ip nbar protocol-discovery
service-policy output DROP 36) L3 - IPv6 - RA Guard
Configure IPv6 RA Guard on SW3 for all current and future hosts in VLAN 11. Allow R4’s FE80::4 link-local address
to send RA messages but only for 2001::/64 prefix. R6 should not be affected by the above configurations.
Configure R5 for SLAAC.
SW3:
ipv6 prefix-list RA_PREFIX permit 2001::/64
!
ipv6 access-list RA_SOURCE
permit ipv6 host FE80::4 any
!
ipv6 nd raguard policy HOST_INSPECT
device-role host
!
ipv6 nd raguard policy HOST_NON_INSPECT
trusted-port
!
ipv6 nd raguard policy ROUTER
device-role router
match ra prefix-list RA_PREFIX
match ipv6 access-list RA_SOURCE
!
vlan configuration 11
ipv6 nd raguard attach-policy HOST_INSPECT
!
interface GigabitEthernet1/0/1
ipv6 nd raguard attach-policy ROUTER
!
interface GigabitEthernet1/0/3
ipv6 nd raguard attach-policy HOST_NON_INSPECT
R5:
interface FastEthernet0/0
ipv6 address autoconfig default
To protect the infrastructure from spoofed RA messages, a feature named IPv6 RA Guard can be configured on the
layer2/layer3 switch where hosts and routers are attached. Basically you would want to restrict/drop receiving router
type NDP messages (like router advertisement and redirects) on ports where hosts are connected. You can configure
three types of RA Guard policies:
a)host, where all inbound NDP messages are inspected and router type messages are dropped; this is the
default state of a policy.
b)router, where all inbound NDP messages are inspected but router type messages are allowed; optionally, you
can restrict for which prefixes are RA messages allowed (achieved via prefix-list filtering) and which sources are allowed
o send ICMPv6 Type 133,134, and 137 (achieved via access-lists matching on link-local addresses).
c)trust, where all inbound NDP messages are allowed and not inspected.
The RA Guard policies can be applied at the VLAN level or port level; if both are enabled, the port-level policy
will take precedence over the VLAN-wide-level policy. In most real-life cases, it is faster to deploy a host policy at VLAN
level and router/trust policy at port level, because there will be few router/trusted ports. To enable a Cisco router for SLAAC,
the interface-level command ipv6 address autoconfig is used. The interface-level command ipv6 enable is used when you
want the router to autoconfigure itself with just a link-local address on the interface (which does not require SLAAC).
Configure IPv6 DHCPv6 Guard on SW3 for all current and future hosts in VLAN 11. Allow R4’s FE80::4 link-local address to act as DHCP server but only for 2001::/64 prefix. R6 should not be affected by the above configurations. Activate DHCPv6 server on R4 for 2001::/64 subnet; assign the domain inelab.local and the DNS server 2001::4 with maximum lifetime. Configure R5 to receive an IPv6 address via DHCPv6.
DHCPv6 Guard achieves almost the same thing for IPv6 as DHCP snooping did for IPv4. It blocks DHCP reply and advertisement messages that originate from unauthorized DHCP servers and relay agents that forward DHCP packets from servers to clients. It lacks the advanced functionalities of deep DHCP packet inspection to prevent DHCP starvation attacks, but this problem is solved with IPv6 snooping, with which you can limit the number of IPv6 addresses that a neighbor can use; it also does not support rate-limiting the DHCPv6 clients for the number of requests
CISCO Doc - IOS 15s (only!!!!)
SW3: ipv6 prefix-list DHCP_SCOPE permit 2001::/64 le 128
!ipv6 access-list DHCP_SOURCE
permit ipv6 host FE80::4 any !!ipv6 dhcp guard policy DHCP_SERVER device-role server match server access-list DHCP_SOURCE match reply prefix-list DHCP_SCOPE !ipv6 dhcp guard policy DHCP_CLIENT_INSPECT device-role client !ipv6 dhcp guard policy DHCP_CLIENT_NON_INSPECT trusted-port ! vlan configuration 11 ipv6 dhcp guard attach-policy DHCP_CLIENT_INSPECT ! interface GigabitEthernet1/0/1 ipv6 dhcp guard attach-policy DHCP_SERVER
! interface GigabitEthernet1/0/3 ipv6 dhcp guard attach-policy DHCP_CLIENT_NON_INSPECT R4: ipv6 dhcp pool VLAN11 address prefix 2001::/64 lifetime infinite infinite link-address 2001::4/64 dns-server 2001::4 domain-name inelab.local ! interface FastEthernet0/0 ipv6 dhcp server VLAN11 R5: interface FastEthernet0/0 ipv6 address dhcp
ipv6 enable
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/15-s/ip6f-15-s-book/ip6-dhcpv6-guard.html
Comments
Post a Comment