Network Security Infrastructure

All firewalls share three properties: they are resistant to network attacks, they are the only transit point (all traffic flows through them), and they enforce the access control policy.

In the private/public design, public is untrusted and private is trusted. Outbound traffic is permitted and inspected, and associated return traffic is allowed back in. Traffic originating outside is generally blocked. Other designs are the DMZ and zone-based policy firewalls.

A packet filtering firewall is stateless and works at Layers 3 and 4 with a simple policy table. It is usually part of a router firewall and filters on source/destination IP, protocol, ports and SYN receipt. For example, blocking port 25 from a workstation stops an email virus.

IDS and IPS are both deployed as sensors and both use signatures to detect misuse. A signature is a set of rules that detects severe breaches of security, common network attacks, and gathers information. Signatures match atomic patterns (a single packet) or composite patterns (multiple packets). A sensor can be a router with IOS IPS, a dedicated device or a module.

HIPS combines antivirus, antimalware and a firewall, but only for its own host. It knows the OS in detail and protects critical processes. It stops registry changes, system directory edits and buffer overflows, and stops the host joining a DoS or an illicit FTP session.

• —Disadvantage: it has a local view only, with no picture of the network.
• —Disadvantage: it is OS dependent and must be installed on every host.

Cisco AMP protects before, blocks during and keeps watching after:

AMP is backed by Cisco Talos.

An ACL forwards or drops packets based on the packet header. Its uses:

• —Limit traffic to improve performance.
• —Traffic flow control, for example routing updates from known sources.
• —Basic access security, for example restricting the HR network.
• —Filter by type: permit email, block Telnet.
• —Screen hosts for FTP or HTTP.
• —Classify traffic for priority processing.

A name conveys purpose and a number doesn't. ACL logging can send a message on every permit or deny. To restrict an ACL to established sessions, allow only TCP with the ACK or RST bit set: only traffic from an already-established session passes, and outside attempts to open a new session are denied.

SNMP has three parts, and three operations:

Manager

Runs management software in an NMS.

Agents

The managed nodes being monitored.

MIB

A database on the agent holding data and statistics.

get

Collects information from an agent.

set

Changes configuration.

trap

Sent by an agent to the manager.

NetFlow gives statistics on packets flowing through a router or multilayer switch. It is narrower than SNMP, covering packet statistics only. It is used for security monitoring, network planning and traffic analysis, finds bottlenecks, supports IP accounting for billing, and its data is pushed to an external NetFlow collector.

The seven original NetFlow fields are source and destination IP, source and destination port, protocol, ToS and input interface. Any one differing means a different flow. The first four identify the connection; the Layer 3 protocol type is usually TCP or UDP; ToS says how QoS rules should apply.

Port mirroring is needed because switches isolate traffic, so a sniffer can't see the segment. The switch makes duplicate copies of traffic passing through and sends them out a port with a network monitor attached. The original traffic is forwarded as usual.

Syslog is the standard way devices send system messages to a server. It is supported by routers, switches, servers, firewalls and appliances. You can gather logging information for monitoring and troubleshooting, select which type of information is captured and specify where the messages go.

NTP matters because without synchronised time you can't order events across the network. It is needed for managing, securing, troubleshooting and planning. Manual time doesn't survive a reboot, so sync to a private clock or a public internet NTP server.

A stratum is the number of hops from the authoritative source; smaller is closer.

Servers at the same stratum can peer for backup.

AAA answers three questions: who you are, what you may do, and what you did.

Authentication

Prove identity: passwords, challenges, token cards.

Authorization

Which resources, and which operations.

Accounting

What was accessed, for how long, and what changed.

A VPN is virtual because it uses virtual connections instead of a dedicated physical link: private traffic runs over a public network. It is private because access is controlled to a defined community of interest and the traffic is encrypted.

Early VPNs were plain IP tunnels with no authentication or encryption. The Layer 3 options are:

IPsec is used for both site-to-site and remote-access VPNs.