Vlan

Ethernet: Layer 2 Security
Eric Vyncke Cisco Systems Distinguished Engineer Evyncke@cisco.com

Vyncke ethernet security
2003, Cisco Systems, Inc. All rights reserved.
The Domino Effect

Unfortunately this means if one layer is hacked, communications are compromised without the other layers being aware of the problem Security is only as strong as your weakest link When it comes to networking, layer 2 can be a VERY weak link
Application Application Stream Application Presentation Session Protocols/Ports IP Addresses Initial Compromise MAC Addresses Physical Links Transport Network Data Link Physical
Session Transport Network Data Link Physical
Vyncke ethernet layer 2 security
Compromised
Presentation
MAC Attacks
CAM Overflow 1/2

MAC X A Y B C port 3 1 3 2 3
MAC B Port 2
X-
Port 1 MAC A X is on port 3 Y is on port 3

Port 3
>?
Y->?
MAC C
4
CAM Overflow 2/2

MAC X Y C A->B port 3 3 3
A
B ->
MAC B
Port 1 MAC A B unknown flood the frame Port 3
Port 2 I see traffic to B !

-> A B
MAC C
MAC Flooding Attack Mitigation

Port Security
Allows you to specify MAC addresses for each port, or to learn a certain number of MAC addresses per port Upon detection of an invalid MAC block only the offending MAC or just shut down the port
Smart CAM table

Never overwrite existing entries Only time-out inactive entries Active hosts will never be overwritten
Speak first
Deviation from learning bridge: never flood Requires a hosts to send traffic first before receiving
ARP Attacks
ARP Spoofing
C>A
IP a MAC A
,A
A=C >C , IP ,a ->b
RP ,b
C ->
, IP B
b a- > ,
IP b MAC B
C>A
,A
C is sending faked gratuitous ARP reply to A C sees traffic from IP a to IP b

A=C >C , IP C,a >B -> b , IP ,a -> b
RP ,b
IP c MAC C
Mitigating ARP Spoofing
ARP spoofing works only within one VLAN static ARP table on critical stations (but dynamic ARP override static ARP on most hosts!) ARP ACL: checking ARP packets within a VLAN ACL
Either by static definition Or by snooping DHCP for dynamic leases
No direct communication among a VLAN: private VLAN

Spoofed ARP packet cannot reach other hosts
ARP Spoof Mitigation: Private VLANs

Promiscuous Port Primary VLAN Promiscuous Port
Isolated VLAN
x x
Isolated Ports
10
VLAN Hopping Attacks
11
Trunk Port Refresher
Trunk Port
Trunk ports have access to all VLANs by default Used to route traffic for multiple VLANs across the same physical link (generally used between switches)
12
Basic VLAN Hopping Attack
Trunk Port
Trunk Port
A station can spoof as a switch with 802.1Q signaling The station is then member of all VLANs Requires a trunking favorable setting on the port (the SANS paper is three years old)
http://www.sans.org/newlook/resources/IDFAQ/vlan.htm
13
Double Encapsulated 802.1Q VLAN Hopping Attack

Strip off First, and Send Back out
1q
Attacker
80 2. 1q ,8 02 .
802.1q, Frame
Fram e
Note: Only Works if Trunk Has the Same Native VLAN as the Attacker
Victim
Send double encapsulated 802.1Q frames Switch performs only one level of decapsulation Unidirectional traffic only Works even if trunk ports are set to off
14
Mitigation
Use recent switches Disable auto-trunking Never put host in the trunk native VLAN Put unused ports in an unused VLAN
15
Spanning Tree Attacks
16
Spanning Tree Basics
Root
A Switch Is Elected as Root
A Tree-Like Loop-Free Topology Is Established F B
F B
Loop-Free Connectivity
17
Spanning Tree Attack Example 1/2

Send BPDU messages from attacker to force spanning tree recalculations
Impact likely to be DoS Access Switches Root F F F F
Send BPDU messages to become root bridge
P ST
Attacker
ST
18
Spanning Tree Attack Example 2/2

Access Switches Send BPDU messages from attacker to force spanning tree recalculations Root
Impact likely to be DoS
F F
Send BPDU messages to become root bridge

The hacker then sees frames he shouldnt MITM, DoS, etc. all possible Any attack is very sensitive to the original topology, trunking, PVST, etc. Requires attacker to be dual homed to two different switches
F B F
F B Root
Attacker
19
STP Attack Mitigation

Disable STP (It is not needed in loop free topologies) BPDU Guard
Disables ports upon detection of a BPDU message on the port
Root Guard
Disables ports who would become the root bridge due to their BPDU advertisement
20
Other Attacks
21
DHCP Rogue Server Attack

Simply the installation of an unknown DHCP Server in the local subnet Other attack: exhaustion of DHCP pools RFC 3118 Authentication for DHCP Messages will help, but has yet to be implemented Mitigation:
Consider using multiple DHCP servers for the different security zones of your network Use intra VLAN ACL to block DHCP traffic from unknown server
22
ProActive Defense
23
Wire-Speed Access Control Lists
Many current switches offer wire-speed ACLs to control traffic flows (with or without a router port) Allows implementation of edge filtering that might otherwise not be deployed due to performance concerns VLAN ACLs and Router ACLs are typically the two implementation methods
24
Network Intrusion Detection System
Network IDS are now able to Understand trunking protocols Fast enough to handle 1 Gbps
Including management of alerts !
Understand layer 2 attacks
25
802.1x
802.1x is an IEEE Standard for Port Based Network Access Control EAP based Improved user authentication: username and password Can work on plain 802.3 or 802.11
26
IEEE 802.1X Terminology

Semi-Public Network / Enterprise Edge Enterprise Network
I US AD R
R A D I U S
ted ry p Enc
L) APO ) (E PO W AN rL (EA O ve less ire EA P er W Ov EA P
Authentication Server Authenticator (e.g. Switch, Access Point)
Supplicant
27
What Does it Do?

Transport authentication information in the form of Extensible Authentication Protocol (EAP) payloads. The authenticator (switch) becomes the middleman for relaying EAP received in 802.1x packets to an authentication server by using RADIUS to carry the EAP information. Three forms of EAP are specified in the standard
EAP-MD5 MD5 Hashed Username/Password EAP-OTP One-Time Passwords EAP-TLS Strong PKI Authenticated Transport Layer Security (SSL) Preferred Method Of Authentication
802.1x Header
EAP Payload
28
Example Solution AAccess Control and User Policy Enforcement

Switch Applies Policies and Enables Port Set port VLAN to 5
User Has Access to Network, with Applicable VLAN
Login Request Credential s Login Good! Apply Policies Check with Policy DB
This Is John Doe! He Goes into VLAN 5

29
Example Solution B Access For Guest Users

Set port VLAN to 100 - DMZ Set port QoS Tagging to 7 Set QoS rate limit for 2Mbps
Switch applies policies and enables port.
User has access to DMZ or Quarantine network.
Login Request Login Request Login Request
Authentication timeout. Retries expired. Client is not 802.1x capable. Put them in the quarantine zone!
30
Summary
31
Layer 2 Security Best Practices 1/2

Manage switches in as secure a manner as possible (SSH, OOB, permit lists, etc.) Always use a dedicated VLAN ID for all trunk ports Be paranoid: do not use VLAN 1 for anything Set all user ports to non trunking Deploy port-security where possible for user ports Selectively use SNMP and treat community strings like root passwords Have a plan for the ARP security issues in your network
32
Layer 2 Security Best Practices 2/2

Enable STP attack mitigation (BPDU Guard, Root Guard) Use private VLANs where appropriate to further divide L2 networks Disable all unused ports and put them in an unused VLAN Consider 802.1X for middle term
All of the Preceding Features Are Dependant on Your Own Security Policy
33
Final Word
Switches were not designed for security Now, switches are designed with security in mind In most cases, with good configuration, they can even enhance your network security
34

Vlan

Uploaded by

Copyright:

Available Formats

Vlan

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Vlan

Uploaded by

Copyright:

Available Formats

Ethernet: Layer 2 Security

Eric Vyncke Cisco Systems Distinguished Engineer Evyncke@cisco.com

The Domino Effect

Session Transport Network Data Link Physical

Vyncke ethernet layer 2 security

2003, Cisco Systems, Inc. All rights reserved.

Vyncke ethernet security

2003, Cisco Systems, Inc. All rights reserved.

CAM Overflow 1/2

Port 1 MAC A X is on port 3 Y is on port 3

CAM Overflow 2/2

Port 1 MAC A B unknown flood the frame Port 3

Port 2 I see traffic to B !

MAC Flooding Attack Mitigation

Smart CAM table

Vyncke ethernet security

2003, Cisco Systems, Inc. All rights reserved.

A=C >C , IP ,a ->b

C is sending faked gratuitous ARP reply to A C sees traffic from IP a to IP b

A=C >C , IP C,a >B -> b , IP ,a -> b

Mitigating ARP Spoofing

No direct communication among a VLAN: private VLAN

Vyncke ethernet layer 2 security

2003, Cisco Systems, Inc. All rights reserved.

ARP Spoof Mitigation: Private VLANs

Vyncke ethernet layer 2 security

2003, Cisco Systems, Inc. All rights reserved.

VLAN Hopping Attacks

Vyncke ethernet security

2003, Cisco Systems, Inc. All rights reserved.

Trunk Port Refresher

Basic VLAN Hopping Attack

Double Encapsulated 802.1Q VLAN Hopping Attack

Vyncke ethernet layer 2 security

2003, Cisco Systems, Inc. All rights reserved.

Spanning Tree Attacks

Vyncke ethernet security

2003, Cisco Systems, Inc. All rights reserved.

Spanning Tree Basics

A Switch Is Elected as Root

A Tree-Like Loop-Free Topology Is Established F B

Spanning Tree Attack Example 1/2

Send BPDU messages to become root bridge

Spanning Tree Attack Example 2/2

Send BPDU messages to become root bridge

STP Attack Mitigation

Vyncke ethernet layer 2 security

2003, Cisco Systems, Inc. All rights reserved.

Vyncke ethernet security

2003, Cisco Systems, Inc. All rights reserved.

DHCP Rogue Server Attack

Vyncke ethernet security

2003, Cisco Systems, Inc. All rights reserved.

Wire-Speed Access Control Lists

Vyncke ethernet layer 2 security

2003, Cisco Systems, Inc. All rights reserved.

Network Intrusion Detection System

Understand layer 2 attacks

Vyncke ethernet layer 2 security