Securing the network: ports, lists and the traps between them

Network security is not one product. It is a sequence of small assumptions removed: that anyone with a cable belongs here, that a device claiming to be the DHCP server is one, that a frame's source address is honest, that traffic between two subnets should flow just because a route exists. Each of the features in this article removes one of those assumptions, and each is a few lines of configuration on equipment you already own.

The map

Read this first when short on time. Every branch is a section below.

Where the attacks actually are

It is tempting to think of security as a firewall at the edge. That model assumes everything inside is trustworthy, and almost every serious incident begins with something inside that is not — a compromised laptop, a contractor's device, a camera with a default password.

Threats map onto layers, and so do the defences:

The pattern worth internalising: the weakest layer decides the outcome. A perfectly configured firewall protects nothing if an attacker is already inside the broadcast domain poisoning ARP, and the strongest layer 2 protections do not help if the management password is cisco.

Hardening the device itself

Before protecting traffic, protect the thing doing the protecting. Most of this appeared in the IOS article; here it is as a checklist with the reasoning attached.

! strong, hashed privileged-mode secret
Router(config)# enable secret 9 $9$longHashedValue

! individual accounts, not a shared line password
Router(config)# username sujith privilege 15 secret Str0ng-Pass

! SSH only, and only from the management network
Router(config)# ip domain-name example.local
Router(config)# crypto key generate rsa modulus 2048
Router(config)# ip ssh version 2
Router(config)# access-list 10 permit 10.99.0.0 0.0.0.255
Router(config)# line vty 0 15
Router(config-line)# login local
Router(config-line)# transport input ssh
Router(config-line)# access-class 10 in
Router(config-line)# exec-timeout 10 0
Router(config-line)# exit

! a legal banner, worded as a warning rather than a greeting
Router(config)# banner login # Authorised access only. Activity is monitored. #

access-class 10 in on the vty lines is the one people skip, and it is among the most valuable. It means SSH is only accepted from the management subnet, so an attacker who reaches the device from a user VLAN cannot even attempt a password.

The banner wording matters for a non-technical reason: in several jurisdictions a system that says "Welcome" has been argued to have invited access. Banners are worded as warnings for that reason, not out of unfriendliness.

Unused switch ports deserve the same discipline. A live port in the default VLAN is an open invitation:

Switch(config)# interface range GigabitEthernet1/0/21 - 24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 999
Switch(config-if-range)# shutdown

Shut, and in an unused VLAN, so that enabling one by accident still leads nowhere.

AAA: authentication, authorisation, accounting

Local accounts on each device do not scale. Ten devices and five staff is fifty accounts to keep synchronised, and removing someone who leaves means logging into all ten. AAA centralises it.

• Authentication — who are you? Verifying a credential.
• Authorisation — what may you do? Which commands, which privilege level.
• Accounting — what did you do? A record of commands and sessions.

The separation in TACACS+ is what makes per-command authorisation possible: the device can ask the server about each command as it is typed, so a junior engineer can be permitted show commands and clear counters and nothing else. RADIUS, which decides everything at login, cannot do that.

The practical split in most organisations is therefore both: RADIUS for users and devices joining the network, TACACS+ for administrators managing the equipment.

Router(config)# aaa new-model
Router(config)# tacacs server TAC1
Router(config-server-tacacs)# address ipv4 10.99.0.30
Router(config-server-tacacs)# key SharedTacacsSecret
Router(config-server-tacacs)# exit
Router(config)# aaa group server tacacs+ TACGROUP
Router(config-sg-tacacs+)# server name TAC1
Router(config-sg-tacacs+)# exit
Router(config)# aaa authentication login default group TACGROUP local
Router(config)# aaa authorization exec default group TACGROUP local
Router(config)# aaa accounting commands 15 default start-stop group TACGROUP

802.1X applies the same idea to the network edge: a switch port stays closed until the device on it authenticates to a RADIUS server, and the server can return the VLAN the device should be placed in. It is the strongest available answer to "somebody plugged into the socket in reception", and the reason it is not universal is that printers, cameras and other devices without a supplicant need exceptions.

Protecting the first hop

Four switch features work together, and each depends on the one before it. Together they take an access port from "trusts everything" to "trusts nothing it has not verified".

Port security: cap the MAC addresses

Limits how many MAC addresses a port may learn, and what to do when the limit is exceeded. It stops MAC flooding attacks — filling the table so the switch floods everything — and it stops somebody quietly plugging a small switch into a desk port.

Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation restrict
Switch(config-if)# switchport port-security aging time 60

protect is almost never right: it fails silently, so nobody learns anything happened. restrict is the usual choice on user ports, and shutdown where a violation should genuinely stop the world. Note that a maximum of 2 is normal on a port with an IP phone, since the phone and the PC behind it each have an address.

Sticky learning writes the learned addresses into the running configuration, so they survive a reload once saved. It is convenient and it is also how a port ends up permanently bound to a laptop that was replaced two years ago, so an ageing time is worth setting.

DHCP snooping: only the real server may answer

A rogue DHCP server — malicious, or just somebody's home router plugged in the wrong way round — hands out addresses with itself as the default gateway, and all traffic flows through it. DHCP snooping stops it by dividing ports into trusted and untrusted.

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10,20
Switch(config)# no ip dhcp snooping information option
Switch(config)# interface GigabitEthernet1/0/24
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# exit
Switch(config)# interface range GigabitEthernet1/0/1 - 20
Switch(config-if-range)# ip dhcp snooping limit rate 10

Only trusted ports — the uplink towards the real server — may send DHCP offers and acknowledgements. An untrusted port sending one has its frames dropped. The rate limit stops a client exhausting the pool by requesting thousands of addresses.

The second thing snooping does is quietly more important: it builds a binding table recording which IP address was issued to which MAC address on which port in which VLAN. That table is the foundation of the next two features.

Dynamic ARP inspection: check the ARP replies

ARP has no authentication whatsoever. Any host can announce that it owns any address, and every listener believes it. ARP poisoning exploits this to become a man in the middle: tell the victim you are the gateway, tell the gateway you are the victim, and read everything in between.

DAI intercepts ARP packets on untrusted ports and checks them against the DHCP snooping binding table. An ARP reply claiming an address that the table says belongs to a different port is dropped and logged.

Switch(config)# ip arp inspection vlan 10,20
Switch(config)# interface GigabitEthernet1/0/24
Switch(config-if)# ip arp inspection trust

Because it depends on the binding table, DAI without DHCP snooping drops all ARP on untrusted ports — statically addressed hosts need an ARP access list to be permitted explicitly.

IP source guard: check the source address

The last of the four. It filters ordinary IP traffic against the same binding table, so a host cannot send packets claiming a source address it was not given. This defeats source-address spoofing from inside the network, which is otherwise trivial.

flowchart TD
  A["DHCP snooping<br/>only trusted ports answer DHCP"] --> B["Binding table<br/>IP, MAC, port, VLAN"]
  B --> C["Dynamic ARP inspection<br/>drops forged ARP replies"]
  B --> D["IP source guard<br/>drops spoofed source addresses"]
  E["Port security<br/>caps MAC addresses per port"] --> F["An access port that<br/>cannot be impersonated"]
  C --> F
  D --> F

Access lists

An ACL is an ordered list of permit and deny statements evaluated against each packet. They are used for filtering, and — as NAT and OSPF showed — reused as a general matching language throughout IOS.

The placement rule follows from what each can see. A standard ACL knows only the source, so placing it near the source would block that source's traffic to everything, not just the destination you meant. An extended ACL knows both ends, so it can be placed early and drop unwanted traffic before it consumes bandwidth.

Three rules that decide behaviour

1. Top to bottom, first match wins. Once a packet matches a line, no later line is considered. A permit any near the top makes everything below it decoration.
2. There is an implicit deny any at the end. It is invisible in the configuration and it is always there. An ACL that permits one thing denies everything else — which is the most common cause of an ACL working in a way its author did not intend.
3. Order from specific to general. Deny the one host, then permit the subnet, not the reverse.

! named extended ACL: let the guest VLAN reach the internet and nothing internal
Switch(config)# ip access-list extended GUEST-OUT
Switch(config-ext-nacl)# remark block access to all internal networks
Switch(config-ext-nacl)# deny   ip 10.20.0.0 0.0.255.255 10.0.0.0 0.255.255.255
Switch(config-ext-nacl)# permit udp 10.20.0.0 0.0.255.255 host 10.99.0.10 eq 53
Switch(config-ext-nacl)# permit tcp 10.20.0.0 0.0.255.255 any eq 443
Switch(config-ext-nacl)# permit tcp 10.20.0.0 0.0.255.255 any eq 80
Switch(config-ext-nacl)# exit
Switch(config)# interface vlan 20
Switch(config-if)# ip access-group GUEST-OUT in

Named ACLs are worth using over numbered ones: the name says what it is for, and individual lines can be edited by sequence number instead of deleting and retyping the whole list.

Note the wildcard masks. 0.0.255.255 matches a /16; 0.0.0.0 matches one host and can be written host 10.99.0.10; 255.255.255.255 matches everything and is written any. Writing a subnet mask where a wildcard belongs is the most common ACL error there is, and it usually fails in a way that is not obvious until traffic tests it.

Switch# show access-lists            ! includes a match counter per line
Switch# show ip interface vlan 20    ! which ACL is applied, in which direction

The per-line match counters in show access-lists are the fastest debugging tool available: if the line you expected to match has a count of zero, the traffic is not reaching it and something earlier caught it first.

VPNs, in one page

A VPN carries private traffic across a network you do not trust — usually the internet — by encrypting it. Two shapes cover almost everything.

Site to site. Two routers build a permanent tunnel, and hosts at either end are unaware of it. Traffic between the two offices is encrypted in transit and neither host does anything special. Built with IPsec, which provides four things:

• Confidentiality — encryption, so the payload cannot be read.
• Integrity — hashing, so it cannot be altered undetected.
• Authentication — each end proves who it is, with a pre-shared key or a certificate.
• Anti-replay — a captured packet cannot be resent later to repeat its effect.

Plain IPsec carries only unicast IP, which means no routing protocols and no multicast across the tunnel. GRE over IPsec is the usual answer: GRE builds a tunnel interface that behaves like an ordinary link and can carry anything, and IPsec encrypts it. That is why routers can run OSPF across a site-to-site VPN.

Remote access. An individual connects from a laptop. Either IPsec with a client, or — far more commonly now — a TLS VPN, which uses the same protocol as HTTPS and therefore passes through hotel and airport networks that block everything else. It also needs no special client for basic access, which removes an entire category of support work.

AAA

Authentication, authorisation and accounting — who you are, what you may do, and a record of what you did.

Binding table

The DHCP snooping record of IP address, MAC address, port and VLAN, used by dynamic ARP inspection and IP source guard.

Implicit deny

The invisible deny any at the end of every access list.

Wildcard mask

An inverted subnet mask used for matching: 0 means the bit must match, 1 means ignore it.

IPsec

The protocol suite providing confidentiality, integrity, authentication and anti-replay for IP traffic.

Recap