- And reviews what you can do to protect network devices
in the event of attacks involving traffic directed
to the network device itself.
The route processor, the CPU on a router,
can only do so much.
So whenever possible the router
is going to cache information about how to forward packets.
Transit packets going from one device on the network
to some other device.
By using cached information when a packet shows up
that needs to be forwarded,
the CPU has to expend little effort.
Forwarding of traffic is a function of the data plane
and that is what really benefits
from using cached information.
So what has that got to do with the control plane?
If a packet, such as an open shortest path first, OSPF
or enhanced interior gateway routing protocol, EIGRP,
routing advertisement packet is sent to an IP on the router,
it is no longer a transit packet
that can be simply forwarded by looking up information
in a route cache of some type.
Instead because the packet is addressed
to the router itself,
the router has to spend some CPU cycles
to interpret the packet,
look at the application layer information,
and then potentially respond.
If an attacker sends thousands of packets like these
to the router, or if there is a bot and then if hundreds
of thousands of devices, each configured to send these types
of packets to the router, the router could be so busy
just processing all these requests that it might not
have enough resources to do its normal work.
Control plane security is primarily guarding against attacks
that might otherwise negatively impact the CPU
including routing updates,
which are also processed by the CPU.
You can deploy COPP and CPPR to protect the control plane.
Control plane policing, or COPP, can be configured
as a filter for any traffic destined to an IP address
on the router itself.
For instance, you can specify that management traffic
such as SSH, HTPS, SSL, and so on can be rate limited
or policed down to a specific level or dropped completely.
This way if an attack occurs that involves
an excessive amount of this traffic,
the excessive traffic above the threshold set
could simply be ignored and not have to be processed
directly by the CPU.
Another way to think of this
is as applying quality of service
to the valid management traffic
and policing to the bogus management traffic.
COPP is applied to a logical control plane interface,
not directly to any layer three interface.
So that policy can be applied globally to the router.
Control plane protection or CPPR
allows for more detailed classification of traffic,
more than COPP.
That is going to use the CPU for handling.
The three specific sub-interfaces that can be classified
are host sub interface, which handles traffic
to one of the physical or logical interfaces of the router,
transit sub interface, which handles
certain data plane traffic that requires CPU intervention
before forwarding, such as IP options,
and Cisco Express Forwarding, CEF, exception traffic
related to network operations, such as people lives
or packets with time to live mechanisms
that are expiring.
The benefit of CPPR is that you can rate limit
and filter this type of traffic
with a more fine tooth comb than COPP.
CPPR is also applied to a logical control plane interface
so that regardless of the logical or physical interface
on which the packets arrive, the broader processor
can still be protected.
Using COPP or COPPR, you can specify which types
of management traffic are acceptable at which levels.
For example, you could decide and configure the router
to believe that SSH is acceptable at 100 packets per second.
Syslog is acceptable at 200 packets per second and so on.
Traffic that exceeds the thresholds can be safely dropped
if it is not from one of your specific management stations.
You can specify all those details in the policy.
Routing protocol authentication is another best practice
for securing the control plane.
If you use authentication, a rogue router on the network
will not be believed by the authorization network devices.
The attacker may have intended to route all the traffic
through his device, or perhaps, at least learned detailed
about the routed tables and networks.
Although not necessarily a security feature,
selective packet discard, or SPD, provides the ability
to prioritize certain types of packets.
For example, routing protocol packets
and layer two keep alive messages which are received
by the route processor, SPD provides priority
of critical control plane traffic over traffic
that is less important or worse yet,
is being sent maliciously to starve the CPU of resources
required for the RP.