Chapter 6-Securing the Local Area Network.pdf

CCNA Security Chapter 6

1. CCNA Security
1 © 2009 Cisco Learning Institute.
Chapter Six
Securing the Local Area Network

2. Major Concepts
•
Describe endpoint vulnerabilities and protection
methods
•
Describe basic Catalyst switch vulnerabilities
•
Configure and verify switch security features,
222 © 2009 Cisco Learning Institute.
•
Configure and verify switch security features, including port security and storm control
•
Describe the fundamental security
considerations of Wireless, VoIP, and SANs

3. Lesson Objectives
Upon completion of this lesson, the successful participant
will be able to:
1.
Describe endpoint security and the enabling technol ogies
2.
Describe how Cisco IronPort is used to ensure endpoint security
333 © 2009 Cisco Learning Institute.
3.
Describe how Cisco NAC products are used to ensure endpoint
security
4.
Describe how the Cisco Security Agent is used to en sure
endpoint security
5.
Describe the primary considerations for securing th e Layer 2
infrastructure
6.
Describe MAC address spoofing attacks and MAC address
spoofing attack mitigation

4. Lesson Objectives
7.
Describe MAC Address table overflow attacks and MAC Address
table overflow attack mitigation
8.
Describe STP manipulation attacks and STP manipulation attack
mitigation
9.
Describe LAN Storm attacks and LAN Storm attack mitigation
444 © 2009 Cisco Learning Institute.
10.
Describe VLAN attacks and VLAN attack mitigation
11.
Describe how to configure port security
12.
Describe how to verify port security
13.
Describe how to configure and verify BPDU Guard and Root Guard
14.
Describe how to configure and verify storm control
15.
Describe and configure Cisco SPAN
16.
Describe and configure Cisco RSPAN

5. Lesson Objectives
17.
Describe the best practices for Layer 2 security
18.
Describe the fundamental aspects of enterprise secu rity for
advanced technologies
19.
Describe the fundamental aspects of wireless securi ty and the
enabling technologies
555 © 2009 Cisco Learning Institute.
20.
Describe wireless security solutions
21.
Describe the fundamental aspects of VoIP security a nd the
enabling technologies Reference: CIAG course on VoIP security.
22.
Describe VoIP security solutions
23.
Describe the fundamental aspects of SAN security and the
enabling technologies
24.
Describe SAN security solutions

6. Securing the LAN
MARS
VPN
ACS
Firewall
Perimeter
Internet
Areas of concentration:
• Securing endpoints
•
Securing network infrastructure
666 © 2009 Cisco Learning Institute.
IPS
VPN
Iron Port
Web
Server
Email
ServerDNS
LAN
Hosts
infrastructure

7. Policy
Compliance
Infection
Containment
Secure
Addressing Endpoint Security
777 © 2009 Cisco Learning Institute.
Threat
Protection
Secure Host
Based on three elements: •
Cisco Network Admission Control (NAC)
•
Endpoint protection
•
Network infection containment

8. Operating Systems 
Basic Security Services
•
Trusted code and trusted path –ensures that the integrit y
of the operating system is not violated •
Privileged context of execution –provides identity
authentication and certain privileges based on the ident ity
888 © 2009 Cisco Learning Institute.
•
Process memory protection and isolation –provides
separation from other users and their data •
Access control to resources –ensures confidentiality and
integrity of data

9. Types of Application Attacks
I have gained direct
access to this
application’s privileges
I have gained access to
Direct
999 © 2009 Cisco Learning Institute.
I have gained access to
this system which is
trusted by the other
system, allowing me to
access it.
Indirect

10. Cisco Systems Endpoint 
Security Solutions
IronPort
Cisco Security Agent
101010 © 2009 Cisco Learning Institute.
Cisco NAC

11. Cisco IronPort Products
IronPortproducts include:
• E-mail security appliances for virus
and spam control
• Web security appliance for spyware
filtering, URL filtering, and anti-malware
• Security management appliance
111111 © 2009 Cisco Learning Institute.

12. IronPort C-Series
Internet
Internet
Before IronPort
Firewall
After IronPort
Firewall
Encryption Platform
MTA
DLP
Scanner
121212 © 2009 Cisco Learning Institute.
Antispam
Antivirus
Policy Enforcement
Mail Routing
IronPort E-mail Security Appliance
Groupware
Users
Users
Groupware
DLP Policy
Manager

13. IronPort S-Series
Web Proxy
FirewallFirewall
Before IronPort After IronPort
Internet
Internet
131313 © 2009 Cisco Learning Institute.
Antispyware
Antivirus
Antiphishing
URL Filtering
Policy Management
Users
Users
IronPort S-
Series

14. Cisco NAC
NAC Framework
The purpose of
NAC
:
C
Allow only authorized and compliant systems to
access the network C
To enforce network security policy
Cisco NAC Appliance
141414 © 2009 Cisco Learning Institute.
NAC Framework
•
Software module
embedded within NAC-
enabled products
•
Integrated framework
leveraging multiple Cisco
and NAC-aware vendor
products
•
In-band Cisco NAC
Appliance solution can
be used on any switch or
router platform
•
Self-contained, turnkey
solution
Cisco NAC Appliance

15. The NAC Framework
AAA
Server
Credentials
Credentials
Vendor
Servers
Hosts Attempting
Network Access
Network
Access
DevicesPolicy Server
Decision Points
and Remediation
Enforcement
151515 © 2009 Cisco Learning Institute.
Credentials
Credentials
EAP/UDP,
EAP/802.1x
RADIUS
Credentials
HTTPS
Access Rights
Notification
Cisco
Trust
Agent
Comply?

16. NAC Components
•
Cisco NAS
Serves as an in-band or out-of-
band device for network access
control
•
Cisco NAM
•
Cisco NAA
Optional lightweight client for
device-based registry scans in
unmanaged environments
•
Rule
-
set updates
161616 © 2009 Cisco Learning Institute.
•
Cisco NAM Centralizes management for
administrators, support
personnel, and operators
•
Rule
-
set updates
Scheduled automatic updates
for antivirus, critical hotfixes,
and other applications
M
G
R

17. Cisco NAC Appliance Process
THE GOAL
Cisco NAM
1.
Host attempts to access a web page or uses
an optional client.
Network access is blocked until wired or wireless
host provides login information.
Authentication
Server
M
G
R
171717 © 2009 Cisco Learning Institute.
Intranet/
Network
2.
Host is
redirected to a login page.
Cisco NAC Appliance validates
username and password, also
performs device and network scans
to assess vulnerabilities on device.
Device is noncompliant
or login is incorrect.
Host is denied access and assigned
to a quarantine role with access to online
remediation resources.
3a.
3b.
Device is “clean”.
Machine gets on “certified
devices list” and is granted
access to network.
Cisco NAS
Quarantine
Role
3.
The host is authenticated and optionally
scanned for posture compliance

18. Access Windows
Login
Screen
Scan is performed
(types of checks depend on user role)
Scan fails
Remediate
181818 © 2009 Cisco Learning Institute.
4.

19. CSA Architecture
Server Protected by
Cisco Security Agent
Administration
Workstation
Events
Alerts
191919 © 2009 Cisco Learning Institute.
Management Center for
Cisco Security Agent
with Internal or External
Database
Security
Policy
SSL

20. CSA Overview
File System
Interceptor
Network
Interceptor
Configuration
Interceptor
Execution
Space
Interceptor
Application
202020 © 2009 Cisco Learning Institute.
State
Rules and
Policies
Rules
Engine Correlation
Engine
Allowed
Request
Blocked
Request

21. CSA Functionality
Security Application
Network
Interceptor
File System
Interceptor
Configuration
Interceptor
Execution
Space
Interceptor
Distributed Firewall XC C C
Host Intrusion
X
C
C
X
212121 © 2009 Cisco Learning Institute.
Host Intrusion
Prevention
X
C
C
X
Application
Sandbox
CX X X
Network Worm
Prevention
XC CX
File Integrity MonitorCX XC

22. Attack Phases
Server
Protected by
Cisco Security
Agent
– Probe phase
• Ping scans
• Port scans
– Penetrate phase
• Transfer exploit
code to target
– Persist phase
222222 © 2009 Cisco Learning Institute.
–File system interceptor
–Network interceptor
–Configuration interceptor
–Execution space
interceptor
Agent
• Install new code
• Modify
configuration
– Propagate phase
• Attack other
targets
– Paralyze phase
• Erase files
• Crash system
• Steal data

23. CSA Log Messages
232323 © 2009 Cisco Learning Institute.

24. MARS
ACS
Firewall
Perimeter
Internet
Layer 2 Security
242424 © 2009 Cisco Learning Institute.
IPS
VPN
Iron Port
Web
Server
Email
ServerDNS
Hosts
Internet

25. OSI Model
When it comes to networking, Layer 2 is often a ver y weak link.
Application Stream
Application Presentation
Compromised
Application
Presentation
252525 © 2009 Cisco Learning Institute.
MAC Addresses
Physical Links
IP Addresses
Protocols and Ports
Session
Transport
Network
Data Link Physical
Compromised
Session
Transport
Network
Data Link
Physical
Initial Compromise

26. MAC Address Spoofing Attack
MAC
Address:
AABBcc
AABBcc
12AbDd Switch Port
1 2
The switch keeps track of the
endpoints by maintaining a
MAC address table. In MAC
spoofing, the attacker poses
as another host—in this case,
AABBcc
262626 © 2009 Cisco Learning Institute.
AABBcc
MAC Address:
AABBcc
Attacker
Port 1
Port 2
MAC
Address:
12AbDd
I have associated Ports 1 and 2 with
the MAC addresses of the devices
attached. Traffic destined for each
device will be forwarded directly.

27. MAC Address Spoofing Attack
AABBcc
Switch Port
1 2
Attacker
AABBcc
1
2
I have changed the MAC
address on my computer
to match the server.
272727 © 2009 Cisco Learning Institute.
MAC
Address:
AABBcc
MAC Address:
AABBcc
Port 1Port 2
The device with MAC
address AABBcc has
changed locations to Port2.
I must adjust my MAC
address table accordingly.

28. MAC Address Table Overflow Attack
282828 © 2009 Cisco Learning Institute.
The switch can forward frames between PC1 and PC2 without
flooding because the MAC address table contains port-to-MAC-
address mappings in the MAC address table for these PCs.

29. MAC Address Table Overflow Attack
Intruder runs macof
to begin sending
unknown bogus MAC
addresses.
3/25 MAC X
3/25 MAC Y
3/25 MAC Z
XYZ
MAC Port
X 3/25
Y 3/25
C 3/25
Bogus addresses are
added to the CAM
table. CAM table is full.
1
2
292929 © 2009 Cisco Learning Institute.
A B
C D
VLAN 10
VLAN 10
3/25
XYZ
flood
Host C
The switch floods
the frames.
Attacker sees traffic
to servers B and D.
VLAN 10
3
4

30. STP Manipulation Attack
•
Spanning tree protocol
operates by electing a
root bridge
•
STP builds a tree topology
F F
Root Bridge
Priority = 8192
MAC Address=
0000.00C0.1234
303030 © 2009 Cisco Learning Institute.
•
STP manipulation
changes the topology of a
network—the attacking
host appears to be the
root bridge
F
F
F B

31. STP Manipulation Attack
Root Bridge
Priority = 8192
F
F
F
F
F B
F
F
313131 © 2009 Cisco Learning Institute.
Root
Bridge
F B
F F
Attacker
The attacking host broadcasts out STP
configuration and topology change BPDUs.
This is an attempt to force spanning tree
recalculations.

32. LAN Storm Attack
Broadcast Broadcast Broadcast
Broadcast Broadcast Broadcast
323232 © 2009 Cisco Learning Institute.
•
Broadcast, multicast, or unicast packets are floode d on all ports in the
same VLAN.
•
These storms can increase the CPU utilization on a switch to 100%,
reducing the performance of the network.

33. Storm Control Total number of
333333 © 2009 Cisco Learning Institute.
number of broadcast
packets
or bytes

34. VLAN Attacks
C
Segmentation
C
Flexibility
343434 © 2009 Cisco Learning Institute.
VLAN = Broadcast Domain = Logical Network (Subnet)
C
Security

35. VLAN Attacks
802.1Q
Server
Trunk
VLAN
20
VLAN
10
353535 © 2009 Cisco Learning Institute.
Server Attacker sees traffic destined for servers
A VLAN hopping attack can be launched in two ways: •
Spoofing DTP Messages from the attacking host to
cause the switch to enter trunking mode •
Introducing a rogue switch and turning trunking on

36. The second switch
receives the packet, on
the native VLAN
Double-Tagging VLAN Attack
Attacker on
VLAN 10, but puts a 20
tag in the packet
The first switch strips off the first tag and
does not retag it (native traffic is not
retagged). It then forwards the packet to
switch 2.
20
802.1Q, Frame
1
2
3
363636 © 2009 Cisco Learning Institute.
the native VLAN
Victim
(VLAN 20)
Note: This attack works only if the
trunk has the same native
VLAN as the attacker.
20 Trunk
(Native VLAN = 10)
802.1Q, Frame
3
4
The second switch
examines the packet, sees
the VLAN 20 tag and
forwards it accordingly.

37. Port Security Overview
MAC A
MAC A
Port 0/1 allows MAC A
Port 0/2 allows MAC B
Port 0/3 allows MAC C
0/1
0/2
0/3
373737 © 2009 Cisco Learning Institute.
MAC A
Attacker 1
Attacker 2
MAC F
Allows an administrator to statically specify MAC
Addresses for a port or to permit the switch to
dynamically learn a limited number of MAC
addresses

38. CLI Commands
switchport mode access
Switch(config-if)#
•
Sets the interface mode as access
switchport port
-
security
Switch(config-if)#
383838 © 2009 Cisco Learning Institute.
switchport port
-
security
•
Enables port security on the interface
switchport port-security maximum value
Switch(config-if)#
•
Sets the maximum number of secure MAC addresses for
the interface (optional)

39. Switchport Port-Security Parameters
Parameter Description
mac-addressmac-address(Optional) Specify a secure MAC address for the por t by entering a 48-bit MAC  aaddress. You can add a dditional 
secure MAC addresses up to the maximum value config ured.
vlan vlan-id(Optional) On a trunk port only, specify the VLAN I D and the MAC address. If no VLAN ID is specified,  the native 
VLAN is used.
vlan access(Optional) On an access port only, specify the VLAN  as an access VLAN.
vlan voice(Optional) On an access port only, specify the VLAN  as a voice VLAN
mac-address sticky (Optional) Enable the interface for sticky learning  by entering only the  mac-address stickykeywords. When sticky 
learning is enabled, the interface adds all secure  MAC addresses that are dynamically learned to the r unning 
393939 © 2009 Cisco Learning Institute.
[mac-address]
learning is enabled, the interface adds all secure  MAC addresses that are dynamically learned to the r unning  configuration and converts these addresses to stick y secure MAC addresses.
Specify a sticky secure MAC address by entering the  mac-address sticky mac-address keywords..
maximumvalue(Optional) Set the maximum number of secure MAC add resses for the interface. The maximum number of sec ure 
MAC addresses that you can configure on a switch is  set by the maximum number of available MAC 
addresses allowed in the system. The active Switch  Database Management (SDM) template determines this 
number. This number represents the total of availab le MAC addresses, including those used for other La yer 2 
functions and any other secure MAC addresses config ured on interfaces.
The default setting is 1.
vlan [vlan-list](Optional) For trunk ports, you can set the maximum  number of secure MAC addresses on a VLAN. If the  vlan
keyword is not entered, the default value is used.
nvlan:set a per-VLAN maximum value.
nvlan vlan-list:set a per-VLAN maximum value on a range of VLANs se parated by a hyphen or a series of 
VLANs separated by commas. For nonspecified VLANs,  the per-VLAN maximum value is used.

40. Port Security Violation Configuration
switchport port-security violation {protect |
restrict | shutdown}
Switch(config-if)#
•
Sets the violation mode (optional)
switchport port
-
security mac
-
address
Switch(config-if)#
404040 © 2009 Cisco Learning Institute.
switchport port-security mac-address sticky
Switch(config-if)#
•
Enables sticky learning on the interface (optional)
switchport port
-
security mac
-
address
mac-address
•
Enters a static secure MAC address for the interface
(optional)

41. Switchport Port-Security Violation
Parameters
Parameter Description
protect(Optional) Set the security violation protect mode. When the number of secure MAC
addresses reaches the limit allowed on the port, pa ckets with unknown source
addresses are dropped until you remove a sufficient number of secure MAC addresses
or increase the number of maximum allowable addresses. You are not notified that a
security violation has occurred.
restrict (Optional) Set the security violation restrict mode . When the number of secure MAC
addresses reaches the limit allowed on the port, pa ckets with unknown source
addresses are dropped until you remove a sufficient number of secure MAC addresses
414141 © 2009 Cisco Learning Institute.
addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. In this mode, you are notified
that a security violation has occurred.
shutdown (Optional) Set the security violation shutdown mode . In this mode, a port security
violation causes the interface to immediately becom e error-disabled and turns off the
port LED. It also sends an SNMP trap, logs a syslog message, and increments the
violation counter. When a secure port is in the err or-disabled state, you can bring it out
of this state by entering the errdisable recovery cause psecure-violationglobal
configuration command, or you can manually re-enable it by entering the shutdownand
no shut downinterface configuration commands.
shutdown
vlan
Set the security violation mode to per-VLAN shutdow n. In this mode, only the VLAN on
which the violation occurred is error-disabled.

42. Port Security Aging Configuration
switchport port-security aging {static | time time|
type {absolute | inactivity}}
Switch(config-if)#
•
Enables or disables static aging for the secure port or sets the aging time or type
424242 © 2009 Cisco Learning Institute.
sets the aging time or type
•
The aging command allows MAC-Addresses on the
Secure switchport to be deleted after the set aging tim e
•
This helps to avoid a situation where obsolete MAC-
Address occupy the table and saturates causing a
violation (when the max number exceeds)

43. Switchport Port
-
Security 
Aging Parameters
Parameter Description
staticEnable aging for statically configured secure
addresses on this port.
time timeSpecify the aging time for this port. The range is 0 t o
1440 minutes. If the time is 0, aging is disabled for
this port.
434343 © 2009 Cisco Learning Institute.
type absoluteSet absolute aging type. All the secure addresses
on this port age out exactly after the time (minutes)
specified and are removed from the secure address
list.
type inactivitySet the inactivity aging type. The secure addresses
on this port age out only if there is no data traffic
from the secure source address for the specified
time period.

44. Typical Configuration
S2
444444 © 2009 Cisco Learning Institute.
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security violation shutdown
switchport port-security mac-address sticky
switchport port-security aging time 120
Switch(config-if)#
PC B

45. CLI Commands
sw-class#
show port-security
Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action
(Count) (Count) (Count)
--------------------------------------------------- ------------------------
Fa0/12 2 0 0 Shutdown
--------------------------------------------------- ------------------------
Total Addresses in System (excluding one mac per port) : 0
Max Addresses limit in System (excluding one mac per port) : 1024
454545 © 2009 Cisco Learning Institute.
sw-class#
show port-security interface f0/12
Port Security : Enabled
Port status : Secure-down
Violation mode : Shutdown
Maximum MAC Addresses : 2
Total MAC Addresses : 1
Configured MAC Addresses : 0
Aging time : 120 mins
Aging type : Absolute
SecureStatic address aging : Disabled
Security Violation Count : 0

46. View Secure MAC Addresses
sw-class#
show port-security address
Secure Mac Address Table
-------------------------------------------------------------------
Vlan Mac Address Type Ports Remaining Age
464646 © 2009 Cisco Learning Institute.
Vlan Mac Address Type Ports Remaining Age
(mins)
---- ----------- ---- ----- -------------
1 0000.ffff.aaaa SecureConfigured Fa0/12 -
-------------------------------------------------------------------
Total Addresses in System (excluding one mac per port) : 0
Max Addresses limit in System (excluding one mac per port) : 1024

47. MAC Address Notification
NMS
MAC AMAC B
F1/1 = MAC A
Switch CAM Table
SNMP traps sent to
NMS when new MAC
addresses appear or
when old ones time out.
F1/2
F1/1
F2/1
474747 © 2009 Cisco Learning Institute.
MAC address notification
allows monitoring of the MAC
addresses, at the module and port level, added by t he switch
or removed from the CAM table for secure ports.
MAC A
F1/1 = MAC A F1/2 = MAC B
F2/1 = MAC D
(address ages out)
MAC D is away
from the network.

48. Configure Portfast
ServerWorkstation
484848 © 2009 Cisco Learning Institute.
Command Description
Switch(config-if)# spanning-
tree portfast
Enables PortFast on a Layer 2 access port and force s it to
enter the forwarding stateimmediately.
Switch(config-if)# no
spanning-tree portfast
Disables PortFast on a Layer 2 access port. PortFas t is
disabled by default.
Switch(config)# spanning-tree
portfast default
Globally enables the PortFast feature on all nontru nking
ports.
Switch#show running-config
interface type slot/port
Indicates whether PortFast has been configured on a port.

49. BPDU Guard
F F
F
F
F
B
Root
Bridge
494949 © 2009 Cisco Learning Institute.
Switch(config)# spanning-tree portfast bpduguard default •
Globally enables BPDU guard on all ports with PortFast
enabled
F
B
BPDU
Guard
Enabled
Attacker
STP
BPDU

50. Display the State of Spanning Tree Switch# show spanning-tree summary totals
Root bridge for: none.
PortFast BPDU Guard is enabled
UplinkFast is disabled
BackboneFast is disabled
Spanning tree default pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
-------------------- -------- --------- -------- ---------- ----------
1 VLAN 0 0 0 1 1
505050 © 2009 Cisco Learning Institute.
1 VLAN 0 0 0 1 1
<output omitted>

51. Root Guard
Root Bridge
Priority = 0
MAC Address =
0000.0c45.1a5d
F F
F
F
F B
F
Root
Guard
Enabled
515151 © 2009 Cisco Learning Institute.
Switch(config-if)# spanning-tree guard root •
Enables root guard on a per-interface basis
F
STP BPDU
Priority = 0
MAC Address = 0000.0c45.1234
Attacker

52. Verify Root Guard
Switch# show spanning-tree inconsistentports
Name Interface Inconsistency
-------------------- ---------------------- ------------------
VLAN0001 FastEthernet3/1 Port Type Inconsistent
VLAN0001 FastEthernet3/2 Port Type Inconsistent
VLAN1002 FastEthernet3/1 Port Type Inconsistent
VLAN1002 FastEthernet3/2 Port Type Inconsistent
VLAN1003 FastEthernet3/1 Port Type Inconsistent
VLAN1003 FastEthernet3/2 Port Type Inconsistent
525252 © 2009 Cisco Learning Institute.
VLAN1003 FastEthernet3/2 Port Type Inconsistent VLAN1004 FastEthernet3/1 Port Type Inconsistent
VLAN1004 FastEthernet3/2 Port Type Inconsistent
VLAN1005 FastEthernet3/1 Port Type Inconsistent
VLAN1005 FastEthernet3/2 Port Type Inconsistent
Number of inconsistent ports (segments) in the system :10

53. Storm Control Methods
•
Bandwidth as a percentage of the total available
bandwidth of the port that can be used by the broadcast,
multicast, or unicast traffic
•
Traffic rate in packets per second at which broadcast, multicast, or unicast packets are received
535353 © 2009 Cisco Learning Institute.
multicast, or unicast packets are received
•
Traffic rate in bits per second at which broadcast,
multicast, or unicast packets are received •
Traffic rate in packets per second and for small frames.
This feature is enabled globally. The threshold for smal l
frames is configured for each interface.

54. Storm Control Configuration
•
Enables storm control
Switch(config-if)# storm-control broadcast level 75.5
Switch(config-if)# storm-control multicast level pps
2k 1k
Switch(config-if)# storm-control action shutdown
545454 © 2009 Cisco Learning Institute.
•
Enables storm control
•
Specifies the level at which it is enabled
•
Specifies the action that should take place when the
threshold (level) is reached, in addition to filtering traffic

55. Storm Control Parameters
Parameter Description
broadcastThis parameter enables broadcast storm control on the int erface.
multicastThis parameter enables multicast storm control on the int erface.
unicastThis parameter enables unicast storm control on the inter face.
level level [level-low]Rising and falling suppression levels as a percentage of t otal bandwidth of the port.
•
level: Rising suppression level. The range is 0.00 to 100.00. Block the flooding of
storm packets when the value specified for level is reache d.
•
level-low: (Optional) Falling suppression level, up to two decimal places. This
value must be less than or equal to the rising suppression value.
level bps
bps
[
bps
-
low
]
Specify the rising and falling suppression levels as a rat e in bits per second at which
555555 © 2009 Cisco Learning Institute.
level bps
bps
[
bps
-
low
]
Specify the rising and falling suppression levels as a rat e in bits per second at which
traffic is received on the port.
•
bps: Rising suppression level. The range is 0.0 to 10000000 000.0. Block the
flooding of storm packets when the value specified for b ps is reached.
•
bps-low: (Optional) Falling suppression level, up to one decim al place. This value
must be equal to or less than the rising suppression value .
level pps pps [pps-low]Specify the rising and falling suppression levels as a rat e in packets per second at
which traffic is received on the port.
•
pps:Rising suppression level. The range is 0.0 to 1000000000 0.0. Block the
flooding of storm packets when the value specified for p ps is reached.
•
pps-low: (Optional) Falling suppression level, up to one decim al place. This value
must be equal to or less than the rising suppression value .
action {shutdown|trap}The action taken when a storm occurs on a port. The defa ult action is to filter traffic
and to not send an SNMP trap.
The keywords have these meanings:
•
shutdown:Disables the port during a storm
•
trap:Sends an SNMP trap when a storm occurs

56. Verify Storm Control Settings
Switch# show storm-control
Interface Filter State Upper Lower Current
--------- ------------- ---------- --------- --------
-Gi0/1 Forwarding 20 pps 10 pps 5 pps
Gi0/2
Forwarding
50.00%
40.00%
0.00%
565656 © 2009 Cisco Learning Institute.
Gi0/2
Forwarding
50.00%
40.00%
0.00%
<output omitted>

57. Trunk
(Native VLAN = 10)
Mitigating VLAN Attacks
575757 © 2009 Cisco Learning Institute.
(Native VLAN = 10)
1. Disable trunking on all access
ports.
2. Disable auto trunking and manually
enable trunking
3. Be sure that the native VLAN is
used only for trunk lines and no
where else

58. switchport mode trunk
switchport nonegotiate
.
Switch(config-if)#
•
Specifies an interface as a trunk link
Switch(config-if)#
Controlling Trunking
585858 © 2009 Cisco Learning Institute.
switchport trunk native vlanvlan_number
switchport nonegotiate
•
Prevents the generation of DTP frames.
Switch(config-if)#
•
Set the native VLAN on the trunk to an unused VLAN

59. Traffic Analysis
C
A SPAN port mirrors traffic to
another port where a
monitoring device is
connected.
“Intruder
Alert!”
IDS
RMON Probe
Protocol Analyzer
595959 © 2009 Cisco Learning Institute.
connected.
C
Without this, it can be difficult
to track hackers after they
have entered the network.
Attacker

60. CLI Commands
monitor sessionsession_numbersource{interface
interface-id[,|-] [both|rx| tx]} | {vlanvlan-
id[, | -] [both| rx| tx]}| {remote vlanvlan-id}
Switch(config)#
606060 © 2009 Cisco Learning Institute.
monitor sessionsession_numberdestination
{interfaceinterface-id[,| -] [encapsulation
replicate] [ingress {dot1q vlanvlan-id| isl|
untagged vlanvlan-id| vlanvlan-id}]} | {remote
vlanvlan-id}
Switch(config)#

61. Verify SPAN Configuration
616161 © 2009 Cisco Learning Institute.

62. SPAN and IDS
IDS
Use SPAN to
mirror traffic in
and out of port
F0/1
F0/2
626262 © 2009 Cisco Learning Institute.
Attacker
and out of port F0/1 to port
F0/2.
F0/1

63. Overview of RSPAN
•
An RSPAN port mirrors traffic
to another port on another
switch where a probe or IDS
sensor is connected.
•
This allows more switches to be monitored with a single
“Intruder
Alert!”
IDS
RSPAN VLAN
Source VLAN
636363 © 2009 Cisco Learning Institute.
be monitored with a single probe or IDS.
Attacker
RSPAN VLAN
Source VLANSource VLAN

64. Configuring RSPAN
2960-1
2960-2
2960-1(config)# vlan 100
2960-1(config-vlan)# remote-span
2960-1(config-vlan)# exit
1. Configure the RPSAN VLAN 2. Configure the RSPAN source ports and VLANs
646464 © 2009 Cisco Learning Institute.
2960-1(config)# monitor session 1 source interface FastEthernet 0/1
2960-1(config)# monitor session 1 destination remote vlan 100
reflector-port FastEthernet 0/24
2960-1(config)# interface FastEthernet 0/2
2960-1(config-if)# switchport mode trunk
2960-2(config)# monitor session 2 source remote vlan 100
2960-2(config)# monitor session 2 destination interface FastEthernet 0/3
2960-2(config)# interface FastEthernet 0/2
2960-2(config-if)# switchport mode trunk
2. Configure the RSPAN source ports and VLANs 3. Configure the RSPAN traffic to be forwarded

65. Verifying RSPAN Configuration
2960-1
2960-2
656565 © 2009 Cisco Learning Institute.
show monitor[session{session_number| all| local
| range list | remote} [detail]] [ |{begin| exclude
| include}expression]

66. Layer 2 Guidelines
•
Manage switches in as secure a manner as possible
(SSH, out-of-band management, ACLs, etc.) •
Set all user ports to non-trunking mode (except if using
Cisco VoIP) •
Use port security where possible for access ports
•
Enable STP attack mitigation (BPDU guard, root guard)
666666 © 2009 Cisco Learning Institute.
•
Enable STP attack mitigation (BPDU guard, root guard)
•
Use Cisco Discovery Protocol only where necessary –
with phones it is useful •
Configure PortFast on all non-trunking ports
•
Configure root guard on STP root ports
•
Configure BPDU guard on all non-trunking ports

67. VLAN Practices
•
Always use a dedicated, unused native VLAN ID for
trunk ports •
Do not use VLAN 1 for anything
•
Disable all unused ports and put them in an unused VLAN
676767 © 2009 Cisco Learning Institute.
VLAN
•
Manually configure all trunk ports and disable DTP on
trunk ports •
Configure all non-trunking ports with switchport mode
access

68. Overview of Wireless, VoIP Security
686868 © 2009 Cisco Learning Institute.
Wireless
VoIP

69. Overview of SAN Security
696969 © 2009 Cisco Learning Institute.
SAN

70. Infrastructure-Integrated Approach
•
Proactive threat and intrusion
detection capabilities that do
not simply detect wireless
attacks but prevent them
•
Comprehensive protection to safeguard confidential data and
707070 © 2009 Cisco Learning Institute.
safeguard confidential data and communications
•
Simplified user management
with a single user identity and
policy
•
Collaboration with wired
security systems

71. Cisco IP Telephony Solutions 
•
Single-site deployment
•
Centralized call
processing with remote
branches
717171 © 2009 Cisco Learning Institute.
•
Distributed call-
processing deployment •
Clustering over the
IPWAN

72. Storage Network Solutions
•
Investment
protection
•
Virtualization
•
Security
727272 © 2009 Cisco Learning Institute.
•
Security
•
Consolidation
•
Availability

73. Cisco Wireless LAN Controllers
737373 © 2009 Cisco Learning Institute.
•
Responsible for system-wide wireless LAN
functions •
Work in conjunction with Aps and the Cisco
Wireless Control System (WCS) to support
wireless applications
•
Smoothly integrate into existing enterprise
networks

74. Wireless Hacking
•
War driving
•
A neighbor hacks into
another neighbor’s
wireless network to get
free Internet access or
747474 © 2009 Cisco Learning Institute.
free Internet access or access information
•
Free Wi-Fi provides an
opportunity to
compromise the data of
users

75. Hacking Tools
•
Network
Stumbler
757575 © 2009 Cisco Learning Institute.
•
Network
Stumbler
•
Kismet
•
AirSnort
•
CoWPAtty
•
ASLEAP
•
Wireshark

76. Safety Considerations
•
Wireless networks using WEP or WPA/TKIP are
not very secure and vulnerable to hacking
attacks.
•
Wireless networks using WPA2/AES should
767676 © 2009 Cisco Learning Institute.
•
Wireless networks using WPA2/AES should have a passphrase of at least 21 characters
long.
•
If an IPsec VPN is available, use it on any public
wireless LAN.
•
If wireless access is not needed, disable the
wireless radio or wireless NIC.

77. VoIP Business Advantages
•
Little or no training costs
•
Mo major set
-
up fees
PSTNVoIP
Gateway
777777 © 2009 Cisco Learning Institute.
•
Lower telecom call costs
•
Productivity increases
•
Lower costs to move, add,
or change •
Lower ongoing service
and maintenance costs
•
Mo major set
-
up fees
•
Enables unified
messaging •
Encryption of voice calls is
supported •
Fewer administrative
personnel required

78. VoIP Components
Cisco Unified
Communications
Manager
(Call Agent)
MCU
IP
Backbone
PSTN
787878 © 2009 Cisco Learning Institute.
Cisco
Unity
IP
Phone
IP
Phone
Videoconference
Station
Router/
Gateway
Router/
Gateway
Router/
Gateway

79. VoIP Protocols
VoIP Protocol Description
H.323
ITU standard protocol for interactive conferencing; evolved from H.320
ISDN standard; flexible, complex
MGCP
Emerging IETF standard for PSTN gateway control; thin device control
Megaco/H.248
Joint IETF and ITU standard for gateway control wit h support for multiple
gateway types; evolved from MGCP standard
797979 © 2009 Cisco Learning Institute.
SIP
IETF protocol for interactive and noninteractive con ferencing; simpler but
less mature than H.323
RTP
ETF standard media-streaming protocol
RTCP
IETF protocol that provides out-of-band control inf ormation for an RTP flow
SRTP
IETF protocol that encrypts RTP traffic as it leave s the
voice device
SCCP
Cisco proprietary protocol used between Cisco Unifi ed Communications
Manager and Cisco IP phones

80. Threats
808080 © 2009 Cisco Learning Institute.
•
Reconnaissance
•
Directed attacks such as spam over IP telephony
(SPIT) and spoofing
•
DoS attacks such as DHCP starvation, flooding, and
fuzzing
•
Eavesdropping and man-in-the-middle attacks

81. VoIP SPIT
•
If SPIT grows like spam, it could result in
regular DoS problems for network
administrators.
•
Antispam methods do not block SPIT.
•
Authenticated TLS stops most SPIT attacks
because TLS endpoints accept packets
only from trusted devices.
818181 © 2009 Cisco Learning Institute.
only from trusted devices.
You’ve just
won an all
expenses
paid vacation
to the U.S.
Virgin Islands
!!!

82. Fraud
•
Fraud takes several forms:
828282 © 2009 Cisco Learning Institute.
–
Vishing—A voice version of phishing that is used to compromise
confidentiality. –
Theft and toll fraud—The stealing of telephone services.
•
Use features of Cisco Unified Communications Manager to protect
against fraud.
–
Partitions limit what parts of the dial plan certain p hones have access to.
–
Dial plans filter control access to exploitive phone numbe rs.
–
FACs prevent unauthorized calls and provide a mechanism for tracking.

83. SIP Vulnerabilities
•
Registration hijacking:
Allows a hacker to
intercept incoming calls
and reroute them.
•
Message tampering: Allows a hacker to
RegistrarRegistrar
Location
Database
SIP Servers/Services
838383 © 2009 Cisco Learning Institute.
Allows a hacker to modify data packets
traveling between SIP
addresses.
•
Session tear-down:
Allows a hacker to
terminate calls or carry
out VoIP-targeted DoS
attacks.
SIP Proxy
SIP User Agents
SIP User Agents

84. Using VLANs
Voice VLAN = 110
Data VLAN = 10
IP phone
10.1.110.3
Desktop PC
5/1
848484 © 2009 Cisco Learning Institute.
•
Creates a separate broadcast domain for voice traff ic
•
Protects against eavesdropping and tampering
•
Renders packet-sniffing tools less effective
•
Makes it easier to implement VACLs that are specifi c to voice
traffic
802.1Q Trunk
10.1.110.3
Desktop PC
171.1.1.1

85. Using Cisco ASA Adaptive
Security Appliances
•
Ensure SIP, SCCP, H.323, and
MGCP requests conform to
standards
•
Prevent inappropriate SIP
methods from being sent to Cisco
Unified Communications Manager
•
Rate limit SIP requests
858585 © 2009 Cisco Learning Institute.
•
Rate limit SIP requests
•
Enforce policy of calls (whitelist,
blacklist, caller/called party, SIP
URI)
•
Dynamically open ports for Cisco
applications •
Enable only “registered phones” to
make calls •
Enable inspection of encrypted
phone calls
Internet
WAN
Cisco Adaptive
Security Appliance
Cisco Adaptive
Security Appliance

86. Using VPNs
•
Use IPsec for authentication
•
Use IPsec to protect
all traffic, not just voice •
Consider SLA with service provider
•
Terminate on a VPN concentrator
Telephony
Servers
868686 © 2009 Cisco Learning Institute.
•
Terminate on a VPN concentrator or large router inside of firewall to
gain these benefits: •
Performance
•
Reduced configuration complexity
•
Managed organizational
boundaries
IP WAN
SRST
Router

87. Using Cisco Unified Communications 
Manager
•
Signed firmware
•
Signed
configuration files
•
Disable:
878787 © 2009 Cisco Learning Institute.
•
Disable: –
PC port
–
Setting button
–
Speakerphone
–
Web access

88. SAN Security Considerations
SAN
IP
Network
888888 © 2009 Cisco Learning Institute.
Specialized network that
enables fast, reliable access
among servers and external
storage resources

89. SAN Transport Technologies
•
Fibre Channel –the
primary SAN transport for
host-to-SAN connectivity
•
iSCSI –maps SCSI over TCP/IP and is another
LAN
898989 © 2009 Cisco Learning Institute.
TCP/IP and is another host-to-SAN connectivity
model •
FCIP –a popular SAN-to-
SAN connectivity model

90. World Wide Name
•
A 64-bit address that Fibre Channel networks
use to uniquely identify each element in a Fibre
Channel network
•
Zoning can utilize WWNs to assign security
909090 © 2009 Cisco Learning Institute.
•
Zoning can utilize WWNs to assign security permissions
•
The WWN of a device is a user-configurable
parameter.
Cisco MDS 9020 Fabric Switch

91. Zoning Operation
•
Zone members see only other
members of the zone. •
Zones can be configured
dynamically based on WWN. •
Devices can be members of
SAN
Disk1
Host1
Disk2
Disk3
ZoneA
ZoneC
919191 © 2009 Cisco Learning Institute.
•
Devices can be members of more than one zone.
•
Switched fabric zoning can take
place at the port or device level:
based on physical switch port
or based on device WWN or
based on LUN ID.
Host2 Disk4
ZoneB
An example of Zoning. Note that
devices can be members of more
than 1 zone.

92. Virtual Storage Area Network (VSAN)
Physical SAN islands
are v
irtualized
onto
Cisco MDS 9000
Family with VSAN Service
929292 © 2009 Cisco Learning Institute.
are v
irtualized
onto
common SAN
infrastructure

93. Security Focus
SAN
Target Access SAN Protocol
SAN Management
Access
939393 © 2009 Cisco Learning Institute.
SAN Secure
SAN
IP Storage
access
Data Integrity and
Secrecy
Access
Fabric Access

94. SAN Management
Three main areas of vulnerability:
1.
Disruption of switch processing
2.
Compromised fabric stability
3.
Compromised data integrity and confidentiality
949494 © 2009 Cisco Learning Institute.
3.
Compromised data integrity and confidentiality

95. Fabric and Target Access
Three main areas of focus:
•
Application data integrity
•
LUN integrity
959595 © 2009 Cisco Learning Institute.
•
Application performance

96. VSANs
Two VSANs each with
multiple zones. Disks and
hosts are dedicated to
VSANs although both hosts
Physical Topology
VSAN 2
Disk1
Host1
Disk2Disk3
ZoneA
ZoneC
Relationship of VSANs to Zones
969696 © 2009 Cisco Learning Institute.
VSANs although both hosts and disks can belong to
multiple zones within a
single VSAN. They cannot,
however, span VSANs.
VSAN 3
Host2 Disk4
Disk6
Disk5
Host4
Host3
ZoneB
ZoneA
ZoneD

97. iSCSI and FCIP
•
iSCSI leverages many of the security features inherent in
Ethernet and IP
–
ACLs are like Fibre Channel zones
–
VLANs are like Fibre Channel VSANs
979797 © 2009 Cisco Learning Institute.
–
802.1X port security is like Fibre Channel port sec urity
•
FCIP security leverages many IP security features in
Cisco IOS-based routers:
–
IPsec VPN connections through public carriers
–
High-speed encryption services in specialized hardw are
–
Can be run through a firewall

98. 989898 © 2009 Cisco Learning Institute.