Download Secured Network Design

Lecture3
Secured Network Design
W.Lilakiatsakun
Topics
 Spanning Tree Protocol (STP)
 Attack on Spanning Tree Protocol
Spanning Tree Protocol (STP)
Redundancy (1)
Redundancy (2)
Examine Redundancy (1)
Examine Redundancy (2)
Issues with Redundancy- layer2 loop (1)
LAYER 2 Loop
 Ethernet frames do not have a time to live (TTL) like
IP packets traversing routers.
 Broadcast frames are forwarded out all switch ports,
except the originating port.
 This ensures that all devices in the broadcast domain are
able to receive the frame.
 If there is more than one path for the frame to be
forwarded out, it can result in an endless loop.
Issues with Redundancy - layer2 loop (2)
Issues with Redundancy - layer2 loop (3)
Issues with Redundancy - layer2 loop (4)
Issues with Redundancy - layer2 loop (5)
Issues with Redundancy – broadcast
storm (1)
 Broadcast storm
 A broadcast storm occurs when there are so
many broadcast frames caught in a Layer 2
loop that all available bandwidth is consumed.
 Consequently, no bandwidth is available
bandwidth for legitimate traffic, and the
network becomes unavailable for data
communication.
Issues with Redundancy – broadcast
storm (2)
Issues with Redundancy – Duplicate
Unicast frame (1)
 Duplicate Unicast Frames
 Unicast frames sent onto a looped network can result
in duplicate frames arriving at the destination device.
Issues with Redundancy – Duplicate
Unicast frame (2)
Issues with Redundancy – Duplicate
Unicast frame (3)
Issues with Redundancy – Duplicate
Unicast frame (4)
STP Topology (1)
 STP ensures that there is only one logical path
between all destinations on the network by
intentionally blocking redundant paths that could
cause a loop.
 Blocking the redundant paths is critical to preventing loops
on the network.
 The physical paths still exist to provide redundancy, but
these paths are disabled to prevent the loops from
occurring.
 If the path is ever needed to compensate for a network
cable or switch failure, STP recalculates the paths and
unblocks the necessary ports to allow the redundant path
to become active.
STP Topology (2)
STP Topology (3)
STP Algorithm (1)
 STP uses the Spanning Tree Algorithm (STA) to
determine which switch ports on a network need to
be configured for blocking to prevent loops from
occurring.
 The STA designates a single switch as the root
bridge and uses it as the reference point for all path
calculations.
 All switches participating in STP exchange BPDU frames to
determine which switch has the lowest bridge ID (BID) on
the network.
 The switch with the lowest BID automatically becomes the
root bridge for the STA calculations.
STP Algorithm (2)
STP Algorithm (2)
 After the root bridge is selected, the STA calculates the
shortest path to the root bridge.
 Each switch uses the STA to determine which ports to block.
 The STA considers both path and port costs when
determining which path to leave unblocked.
 The path costs are calculated using port cost values
associated with port speeds for each switch port along a
given path.
 The sum of the port cost values determines the overall path
cost to the root bridge.
 If there is more than one path to choose from, STA chooses
the path with the lowest path cost.
STP - BPDU
BPDU Process (1)
 Each switch in the broadcast domain initially assumes
that it is the root bridge for the spanning-tree instance,
so the BPDU frames sent contain the BID of the local
switch as the root ID.
 By default, BPDU frames are sent every 2 seconds after
a switch is booted; that is, the default value of the
hello timer specified in the BPDU frame is 2 seconds.
 Each switch maintains local information about its own
BID, the root ID, and the path cost to the root.
BPDU Process (2)
BPDU Process (3)
 When adjacent switches receive a BPDU frame, they
compare the root ID from the BPDU frame with the
local root ID.
 If the root ID in the BPDU is lower than the local root ID, the
switch updates the local root ID and the ID in its BPDU
messages.
 Also, the path cost is updated to indicate how far away the
root bridge is.
 If the root ID in the BPDU is higher than the local root ID,
the switch discard the BPDU frame
BPDU Process (4)
BPDU Process (5)
BPDU Process (6)
 After a root ID has been updated to identify a new
root bridge, all subsequent BPDU frames sent from
that switch contain the new root ID and updated
path cost.
 As the BPDU frames pass between other adjacent
switches, the path cost is continually updated to
indicate the total path cost to the root bridge.
 Each switch in the spanning tree uses its path costs
to identify the best possible path to the root bridge.
BPDU Process (7)
BPDU Process (8)
BPDU Process (9)
BPDU Process (10)
BPDU Process (11)
BPDU Process (12)
Bridge ID field (1)
 The bridge ID (BID) is used to determine the root bridge on a
network.
 The BID field of a BPDU frame contains three separate fields:
bridge priority, extended system ID, and MAC address.
 Each field is used during the root bridge election.
Bridge ID field (2)
Bridge ID field (3)
 Bridge Priority
 The bridge priority is a customizable value that you can
use to influence which switch becomes the root bridge.
 The switch with the lowest priority, which means
lowest BID, becomes the root bridge (the lower the
priority value, the higher the priority).
 The default value for the priority of all Cisco switches is
32768.
 The priority range is between 1 and 65536; therefore, 1
is the highest priority.
Bridge ID field (4)
 Extended System ID
 The early implementation of STP was designed for
networks that did not use VLANs.
 There was a single common spanning tree across all
switches.
 When VLANs started became common for network
infrastructure segmentation, STP was enhanced to
include support for VLANs.
 As a result, the extended system ID field contains the ID of
the VLAN with which the BPDU is associated.
Bridge ID field (5)
 When the extended system ID is used, it changes
the number of bits available for the bridge priority
value, so the increment for the bridge priority value
changes from 1 to 4096.
 Therefore, bridge priority values can only be
multiples of 4096.
 The extended system ID value is added to the
bridge priority value in the BID to identify the
priority and VLAN of the BPDU frame.
Bridge ID field (6)
 MAC Address
 When two switches are configured with the same
priority and have the same extended system ID, the
switch with the MAC address with the lowest
hexadecimal value has the lower BID.
 Initially, all switches are configured with the same
default priority value. The MAC address is then the
deciding factor on which switch is going to become
the root bridge. This results in an unpredictable choice
for the root bridge.
Bridge ID field (7)
 It is recommended to configure the desired root bridge
switch with a lower priority to ensure that it is elected root
bridge.
 This also ensures that the addition of new switches to the
network does not trigger a new spanning-tree election,
which could disrupt network communication while a new
root bridge is being selected.
Bridge ID field (8)
Priority Based Decision
Bridge ID field (9)
MAC Based Decision
Port Roles (1)
 Root Port
 The root port exists on non-root bridges and is the switch
port with the best path to the root bridge.
 Root ports forward traffic toward the root bridge.
 The source MAC address of frames received on the root port
are capable of populating the MAC table.
 Only one root port is allowed per bridge.
 In the example, switch S1 is the root bridge and switches S2
and S3 have root ports defined on the trunk links connecting
back to S1.
Port Roles (2)
Port Roles (3)
 Designated Port
 The designated port exists on root and non-root
bridges.
 For root bridges, all switch ports are designated ports.
 For non-root bridges, a designated port is the switch port
that receives and forwards frames toward the root bridge as
needed.
 Only one designated port is allowed per segment.
 If multiple switches exist on the same segment, an
election process determines the designated switch,
and the corresponding switch port begins forwarding
frames for the segment.
 Designated ports are capable of populating the MAC
table.
Port Roles (4)
 Non-designated Port
 The non-designated port is a switch port that is blocked, so it
is not forwarding data frames and not populating the MAC
address table with source addresses.
 A non-designated port is not a root port or a designated port.
 For some variants of STP, the non-designated port is called an
alternate port.
 In the example, switch S3 has the only non-designated ports
in the topology. The non-designated ports prevent the loop
from occurring.
Port Roles (5)
Port Roles (6)
 Disabled Port
 The disabled port is a switch port that is
administratively shut down.
 A disabled port does not function in the spanning-tree
process.
Port Roles (7)
 When determining the root port on a switch, the
switch compares the path costs on all switch
ports participating in the spanning tree.
 The switch port with the lowest overall path cost
to the root is automatically assigned the root port
role because it is closest to the root bridge.
 In a network topology, all switches that are using
spanning tree, except for the root bridge, have a
single root port defined.
Port Roles (8)
 When there are two switch ports that have the same
path cost to the root bridge and both are the lowest
path costs on the switch, the switch needs to
determine which switch port is the root port.
 The switch uses the customizable port priority value,
or the lowest port ID if both port priority values are
the same.
Port Roles (9)
Path cost to the root bridge (1)
 The path information is determined by summing up
the individual port costs along the path from the
destination to the root bridge.
 The default port costs are defined by the speed at
which the port operates.




10-Gb/s Ethernet ports have a port cost of 2,
1-Gb/s Ethernet ports have a port cost of 4,
100-Mb/s Fast Ethernet ports have a port cost of 19,
10-Mb/s Ethernet ports have a port cost of 100.
Path cost to the root bridge(2)
 Default port cost
Path cost to the root bridge (4)
Path cost to the root bridge (5)
Port Role Decision (1)
Port Role Decision (2)
Port Role Decision (3)
Port Role Decision (4)
Port Role Decision (5)
Port Role Decision (6)
Port Role Decision (7)
Port States (1)
 STP introduces five port states
 Blocking
 The port is a non-designated port and does not
participate in frame forwarding.
 The port receives BPDU frames to determine the
location and root ID of the root bridge switch and what
port roles each switch port should assume in the final
active STP topology.
Port States (2)
 Listening
 STP has determined that the port can participate in frame
forwarding according to the BPDU frames that the switch has
received thus far.
 At this point, the switch port is not only receiving BPDU frames, it
is also transmitting its own BPDU frames and informing adjacent
switches that the switch port is preparing to participate in the
active topology.
Port States (3)
 Learning
 The port prepares to participate in frame forwarding and
begins to populate the MAC address table.
 Forwarding
 The port is considered part of the active topology and
forwards frames and also sends and receives BPDU frames.
 Disabled
 The Layer 2 port does not participate in spanning tree and
does not forward frames.
 The disabled state is set when the switch port is
administratively disabled
Port States (4)
Spanning Tree Timer




Hello time: 2 seconds
Forward-delay time: 15 seconds
Maximum-aging time: 20 seconds
Transmit hold count: 6 BPDUs
During a topology change, a port temporarily implements the
listening and learning states for a specified period called the
forward delay interval.(15seconds)
These values allow adequate time for convergence in a network
with a switch diameter of seven.
Spanning Tree Timer
PortFast (1)
 PortFast is a Cisco technology.
 When a switch port configured with PortFast is configured
as an access port, that port transitions from blocking to
forwarding state immediately, bypassing the typical STP
listening and learning states.
PortFast (2)
PortFast (3)
PortFast Configuration
PortFast (4)
Verify PortFast
STP Topology Change (1)
 When a change is detected, the switch notifies the
root bridge of the spanning tree with Topology
Change Notification (TCN)
 Then, the root bridge replies back with Topology
Change Acknowledgement (TCA)
 Then, the root bridge then broadcasts the
information into the whole network with Topology
Change (TC).
STP Topology Change (2)
STP Topology Change (3)
 It starts to send out its configuration BPDUs with the
topology change (TC) bit set.
 As a result, all switches become aware of the
topology change and can reduce their aging time to
forward delay. Switches receive topology change
BPDUs on both forwarding and blocking ports.
 The TC bit is set by the root for a period of max age +
forward delay seconds, which is 20+15=35 seconds by
default.
STP Topology Change (4)
Cisco and STP Variants
Attacking on STP (1)
 Send BPDU messages from
attacker to force spanning
tree recalculations
 Impact as DoS
 Send BPDU messages to
become root bridge
 The hacker then sees
frames
 Impact as MITM, DoS, etc
Attacking on STP (2)
 Attacker sends BPDU advertising itself with a bridge
priority of zero
 Attacker becomes root bridge
 Spanning Tree recalculates
 GE (Gigabit Ethernet) backbone becomes FE (Fast
Ethernet)
Example on BPDU Attack (1)
What happen if an attacker (in this instance a laptop) spoof a BPDU with a lower priority?
CR: www.ciscozine.com
Example on BPDU Attack (2)
 The attacker (red laptop) will
be the new root bridge and the
spanning-tree topology
change.
 With this new topology,
Ciscozine3 and Ciscozine4 use
only Ciscozine1 to switch
packets, while Ciscozine2 is not
used by the access switches
(Ciscozine3 and Ciscozine4)!
 Moreover the election of the
attacker as root causes the
Gigabit Ethernet link that
connects the two core
switches (Ciscozine1 and
Ciscozine2) to block, causing
suboptimal network.
Mitigating BPDU Attack (1)
 The administrator can set the root bridge priority to zero in
an effort to secure the root bridge position, but there is no
guarantee against a bridge with a priority of 0 and a lower
MAC address.
Note: The temporary introduction and subsequent removal
of STP devices with low (0) bridge priority cause
a permanent STP recalculation.
 Cisco has implemented three different solutions: BPDU
Guard, BPDU Filtering and Root Guard.
Mitigating BPDU Attack (2)
 BPDU Guard
 The STP PortFast BPDU guard enhancement allows
network designers to enforce the STP domain borders
and keep the active topology predictable.
 The devices behind the ports that have STP PortFast
enabled are not able to influence the STP topology.
 At the reception of BPDUs, the BPDU guard
operation disables the port that has PortFast configured.
 The BPDU guard transitions the port into errdisable
state, and a message appears on the console.
Mitigating BPDU Attack (3)
 BPDU Guard
 To enable BPDU guard globally on the switch, use this
command:
Ciscozine3(config)#spanning-tree portfast bpduguard default
 To enable PortFast BPDU guard on a specific switch port,
use this command:
Ciscozine3(config)#spanning-tree bpduguard enable
 Use the following command to verify the BPDU
configuration:
Ciscozine3#show spanning-tree summary totals
*The STP PortFast BPDU guard was introduced in Cisco IOS Software
Release 12.1
Mitigating BPDU Attack (4)
 BPDU Filtering
When configured globally, PortFast BPDU filtering
applies to all operational PortFast ports.
 Ports in an operational PortFast state are supposed to
be connected to hosts, that typically drop BPDUs.
 If an operational PortFast port receives a BPDU, it
immediately loses its operational PortFast status.
 In that case, PortFast BPDU filtering is disabled on this port
and STP resumes sending BPDUs on this port.
Mitigating BPDU Attack (5)
 BPDU Filtering
 PortFast BPDU filtering can also be configured on a perport basis.
 When PortFast BPDU filtering is explicitly configured on
a port, it does not send any BPDUs and drops all BPDUs
it receives.
Mitigating BPDU Attack (6)
 BPDU Filtering
 To enable PortFast BPDU filtering globally on the switch,
use this command:
Ciscozine3(config)#spanning-tree portfast bpdufilter default
 To enable PortFast BPDU filtering on a specific switch port,
use this command:
Ciscozine3(config-if)#spanning-tree bpdufilter enable
 To verify the configuration on the switch, use this
command:
Ciscozine3#show spanning-tree summary
Mitigating BPDU Attack (7)
 BPDU Root guard
 The root guard ensures that the port on which root guard is
enabled is the designated port.
 Normally, root bridge ports are all designated ports, unless two
or more ports of the root bridge are connected together.
 If the bridge receives superior STP Bridge Protocol Data Units
(BPDUs) on a root guard-enabled port, root guard moves this
port to a root-inconsistent STP state.
 This root-inconsistent state is effectively equal to a listening
state.
 No traffic is forwarded across this port. In this way, the root
guard enforces the position of the root bridge.
Mitigating BPDU Attack (8)
 BPDU Root guard
 To enable Root Guard on a specific switch port, use
this command:
Ciscozine3(config-if)#spanning-tree rootguard
 Root guard is available in Cisco IOS Software Release
12.0(5)XU and later.
BPDU Guard VS STP Root Guard (1)
 BPDU guard and root guard are similar, but their
impact is different.
 BPDU guard disables the port upon BPDU reception if
PortFast is enabled on the port.
 The disablement effectively denies devices behind
such ports from participation in STP.
 You must manually reenable the port that is put into
errdisable state or configure errdisable-timeout.
BPDU Guard VS STP Root Guard (2)
 Root guard allows the device to participate in STP as
long as the device does not try to become the root.
 If root guard blocks the port, subsequent recovery is
automatic.
 Recovery occurs as soon as the offending device
ceases to send superior BPDUs.