Available:*
Library | Item Barcode | Call Number | Material Type | Item Category 1 | Status |
---|---|---|---|---|---|
Searching... | 30000010183965 | TK5105.543 S38 2007 | Open Access Book | Book | Searching... |
On Order
Summary
Summary
Router Security Strategies: Securing IP Network Traffic Planes provides a compre-hensive approach to understand and implement IP traffic plane separation and protection on IP routers. This book details the distinct traffic planes of IP networks and the advanced techniques necessary to operationally secure them. This includes the data, control, management, and services planes that provide the infrastructure for IP networking.nbsp;
nbsp; The first section provides a brief overview of the essential components of the Internet Protocol and IP networking. At the end of this section, you will understand the fundamental principles of defense in depth and breadth security as applied to IP traffic planes. Techniques to secure the IP data plane, IP control plane, IP management plane, and IP services plane are covered in detail in the second section. nbsp; The final section provides case studies from both the enterprise network and the service provider network perspectives. In this way, the individual IP traffic plane security techniques reviewed in the second section of the book are brought together to help you create an integrated, comprehensive defense in depth and breadth security architecture. nbsp; "Understanding and securing IP traffic planes are critical to the overall security posture of the IP infrastructure.nbsp; The techniques detailed in this book provide protection and instrumentation enabling operators to understand and defend against attacks. As the vulnerability economy continues to mature, it is critical for both vendors and network providers to collaboratively deliver these protections to the IP infrastructure." -Russell Smoak, Director, Technical Services, Security Intelligence Engineering, Cisco nbsp; Gregg Schudel, CCIE® No. 9591, joined Cisco in 2000 as a consulting system engineer supporting the U.S. service provider organization. Gregg focuses on IP core network security architectures and technology for interexchange carriers and web services providers. nbsp; David J. Smith, CCIE No. 1986, joined Cisco in 1995 and is a consulting system engineer supporting the service provider organization. David focuses on IP core and edge architectures including IP routing, MPLS technologies, QoS, infrastructure security, and network telemetry. nbsp; Understand the operation of IP networks and routers Learn about the many threat models facing IP networks, Layer 2 Ethernet switching environments, and IPsec and MPLS VPN services Learn how to segment and protect each IP traffic plane by applying defense in depth and breadth principles Use security techniques such as ACLs, rate limiting, IP Options filtering, uRPF, QoS, RTBH, QPPB, and many others to protect the data plane of IP and switched Ethernet networks Secure the IP control plane with rACL, CoPP, GTSM, MD5, BGP and ICMP techniques and Layer 2 switched Ethernet-specific techniques Protect the IP management plane with password management, SNMP, SSH, NTP, AAA, as well as other VPN management, out-of-band management, and remote access management techniques Secure the IP services plane using recoloring, IP fragmentation control, MPLS label control, and other traffic classification and process control techniques nbsp;This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks. nbsp; nbsp;Author Notes
Gregg Schudel ,CCIE No. 9591 (Security), joined Cisco in 2000 as a consulting system engineer supporting the U.S. Service Provider Organization. Gregg focuses on IP core network and services security architectures and technology for inter-exchange carriers, web services providers, and mobile providers. Gregg is also part of a team of Corporate and Field resources focused on driving Cisco Service Provider Security Strategy. Prior to joining Cisco, Gregg worked for many years with BBN Technologies, where he supported network security research and development, most notably in conjunction with DARPA and other federal agencies involved in security research. Gregg holds an MS in engineering from George Washington University, and a BS in engineering from Florida Institute of Technology. Gregg can be contacted through e-mail at gschudel@cisco.com .
nbsp; David J. Smith , CCIE No. 1986 (Routing and Switching), joined Cisco in 1995 and is a consulting system engineer supporting the Service Provider Organization. Since 1999 David has focused on service provider IP core and edge architectures, including IP routing, MPLS technologies, QoS, infrastructure security, and network telemetry. Between 1995 and 1999, David supported enterprise customers designing campus and global WANs. Prior to joining Cisco, David worked at Bellcore developing systems software and experimental ATM switches. David holds an MS in information networking from Carnegie Mellon University, and a BS in computer engineering from Lehigh University. David can be contacted through e-mail at dasmith@cisco.com.Table of Contents
Foreword | p. xix |
Introduction | p. xx |
Part I IP Network and Traffic Plane Security Fundamentals | p. 3 |
Chapter 1 Internet Protocol Operations Fundamentals | p. 5 |
IP Network Concepts | p. 5 |
Enterprise Networks | p. 7 |
Service Provider Networks | p. 9 |
IP Protocol Operations | p. 11 |
IP Traffic Concepts | p. 19 |
Transit IP Packets | p. 20 |
Receive-Adjacency IP Packets | p. 21 |
Exception IP and Non-IP Packets | p. 22 |
Exception IP Packets | p. 22 |
Non-IP Packets | p. 23 |
IP Traffic Planes | p. 24 |
Data Plane | p. 25 |
Control Plane | p. 27 |
Management Plane | p. 29 |
Services Plane | p. 30 |
IP Router Packet Processing Concepts | p. 32 |
Process Switching | p. 36 |
Fast Switching | p. 39 |
Cisco Express Forwarding | p. 44 |
Forwarding Information Base | p. 44 |
Adjacency Table | p. 45 |
CEF Operation | p. 46 |
General IP Router Architecture Types | p. 50 |
Centralized CPU-Based Architectures | p. 50 |
Centralized ASIC-Based Architectures | p. 52 |
Distributed CPU-Based Architectures | p. 54 |
Distributed ASIC-Based Architectures | p. 56 |
Summary | p. 62 |
Review Questions | p. 62 |
Further Reading | p. 63 |
Chapter 2 Threat Models for IP Networks | p. 65 |
Threats Against IP Network Infrastructures | p. 65 |
Resource Exhaustion Attacks | p. 66 |
Direct Attacks | p. 67 |
Transit Attacks | p. 70 |
Reflection Attacks | p. 74 |
Spoofing Attacks | p. 75 |
Transport Protocol Attacks | p. 76 |
UDP Protocol Attacks | p. 78 |
TCP Protocol Attacks | p. 78 |
Routing Protocol Threats | p. 81 |
Other IP Control Plane Threats | p. 83 |
Unauthorized Access Attacks | p. 85 |
Software Vulnerabilities | p. 87 |
Malicious Network Reconnaissance | p. 88 |
Threats Against Layer 2 Network Infrastructures | p. 89 |
CAM Table Overflow Attacks | p. 89 |
MAC Spoofing Attacks | p. 90 |
VLAN Hopping Attacks | p. 92 |
Private VLAN Attacks | p. 93 |
STP Attacks | p. 94 |
VTP Attacks | p. 95 |
Threats Against IP VPN Network Infrastructures | p. 96 |
MPLS VPN Threat Models | p. 96 |
Threats Against the Customer Edge | p. 98 |
Threats Against the Provider Edge | p. 99 |
Threats Against the Provider Core | p. 101 |
Threats Against the Inter-Provider Edge | p. 103 |
Carrier Supporting Carrier Threats | p. 103 |
Inter-AS VPN Threats | p. 105 |
IPsec VPN Threat Models | p. 108 |
Summary | p. 111 |
Review Questions | p. 112 |
Further Reading | p. 113 |
Chapter 3 IP Network Traffic Plane Security Concepts | p. 117 |
Principles of Defense in Depth and Breadth | p. 117 |
Understanding Defense in Depth and Breadth Concepts | p. 118 |
What Needs to Be Protected? | p. 119 |
What Are Defensive Layers? | p. 119 |
What Is the Operational Envelope of the Network? | p. 122 |
What Is Your Organization s Operational Model? | p. 123 |
IP Network Traffic Planes: Defense in Depth and Breadth | p. 123 |
Data Plane | p. 124 |
Control Plane | p. 124 |
Management Plane | p. 125 |
Services Plane | p. 126 |
Network Interface Types | p. 127 |
Physical Interfaces | p. 128 |
Logical Interfaces | p. 131 |
Network Edge Security Concepts | p. 133 |
Internet Edge | p. 133 |
MPLS VPN Edge | p. 136 |
Network Core Security Concepts | p. 138 |
IP Core | p. 139 |
MPLS VPN Core | p. 140 |
Summary | p. 141 |