Intrusion Prevention Systems (IPS)

Chapter 6: Securing the Local Area Network

• This chapter focuses on securing local area networks, covering endpoint security and Layer 2 security threats.
• Authored by Dr. Nadhir Ben Halima

6.0 Introduction

• The chapter introduces the concepts and methods for securing LANs.

6.1 Endpoint Security

• Endpoint security and its enabling technologies are a key focus.
• How Cisco AMP is used for endpoint security is examined.
• Cisco NAC's role in authenticating and enforcing network security policies is explained.

Securing LAN Elements

• A typical LAN setup includes elements like the internet, web server, VPN, email server, firewall, ESA/WSA, DNS, IPS, hosts, and ACS (Access Control System).

Traditional Endpoint Security

• Traditional endpoint security involves host-based protection, including antivirus/antimalware software, host-based IPS, and host-based firewalls.

Securing Endpoints in the Borderless Network

• Securing endpoints considers questions post-attack, such as origin, threat method, affected systems, impact, mitigation, recovery, and prevention.
• Host-based protection measures include antivirus/antimalware, SPAM filtering, URL filtering, and blacklisting.

Modern Endpoint Security Solutions

• Modern solutions incorporate AMP (Advanced Malware Protection), NAC (Network Admission Control), ESA (Email Security Appliance), and WSA (Web Security Appliance).

Antimalware Protection

• Advanced Malware Protection involves stages: before (discover, enforce, harden), during (detect, block, defend), and after (scope, contain, remediate).

AMP and Managed Threat Defense

• Talos teams gather real-time threat intelligence from 1.6 million deployed security devices, including firewalls, IPS, web, and email appliances, and 150 million endpoints.
• 100 TB of security intelligence is analyzed daily, along with 13 billion web requests per day, and 35% of global enterprise email traffic

Email and Web Security

• Focuses on securing email and web traffic in the LAN environment.

Cisco Email Security Appliance

• Features include spam blocking, advanced malware protection, and outbound message control.

Cisco Web Security Appliance

• Handles web requests, forwards them, and filters replies to protect the network.
• Client initiates a web request, the WSA forwards the request, and then the reply is sent to WSA and then to the client.

Controlling Network Access

• Managing and securing network access are critical components of LAN security.

Cisco NAC Functions

• NAC functions include authentication, authorization, and posture assessment for network access.

6.2 Layer 2 Security Threats

• The section focuses on Layer 2 vulnerabilities.
• CAM table overflow attacks are discussed.
• Mitigating attacks by configuring port security is covered.
• VLAN Trunk security minimizes VLAN hopping attacks.
• DHCP Snooping is implemented to mitigate DHCP attacks.
• Dynamic ARP Inspection is implemented to mitigate ARP attacks.
• IP Source Guard mitigates address spoofing attacks.

Layer 2 Vulnerabilities

• Layer 2 vulnerabilities exist at the Data Link layer, corresponding to Ethernet frames; initial compromise occurs at this level.

Switch Attack Categories

• Switch attacks fall into categories: CAM table attacks, STP attacks, VLAN attacks, address spoofing attacks, DHCP attacks, and ARP attacks.

CAM Table Attacks

• CAM table attacks exploit the switch's MAC address table.

Basic Switch Operation

• Switches maintain a MAC address table, mapping MAC addresses to ports.

CAM Table Operation Example

• Shows how a switch forwards traffic based on the CAM table.

CAM Table Attack Explained

• CAM table attack involves flooding the switch with bogus MAC addresses to fill the CAM table, causing the switch to flood all traffic.
• Intruder uses a tool to begin sending unknown bogus MAC addresses.
• Fill the CAM table to cause switch flooding.

CAM Table Attack Tools

• Tools are available to flood the network with MAC addresses for CAM table attacks.

Mitigating CAM Table Attacks

• Port security can limit MAC addresses allowed on a port.

Countermeasures for CAM Table Attacks

• Implementing port security allows only specific MAC addresses on a port, blocking unauthorized traffic.

Port Security

• Provides options to secure switch ports. Verification and implementation commands of switch-port security are featured.

Port Security Options

• Includes aging settings, MAC address control, maximum MAC addresses, and violation settings.

Enabling Port Security Options

• Setting the maximum number of MAC addresses that can be learned on the port.
• Configuring MAC addresses manually.
• Dynamically learning connected MAC addresses.

Port Security Violations

• Security violation modes include Protect, Restrict, and Shutdown.
• Protect forwards traffic, sends no syslog message, and does not increase the violation counter, whilst not shutting down the port.
• Restrict does not forward traffic, sends a syslog message, increases the violation counter but does not shut down the port.
• Shutdown does not forward traffic, sends a syslog message, increases the violation counter and also shuts down the port.

Port Security with IP Phones

• Securing ports used by IP phones is discussed.

Mitigating DHCP Attacks

• DHCP attacks, like spoofing and starvation, are considered.

DHCP Spoofing Attack

• A rogue DHCP server provides incorrect IP configuration information to clients.

DHCP Starvation Attack

• An attacker exhausts the DHCP address pool, preventing legitimate clients from obtaining IP addresses. -Attacker initiates discovery protocol request (size of scope), the DHCP server sends out offers(size of scope), attacker then requests all offers(size of scope) which are then acknowledged(size of scope).

Configuring DHCP Snooping

• Trusted and untrusted ports are specified and used to combat rogue DHCP servers.

Configuring DHCP Snooping Example

• DHCP snooping is configured on trusted interfaces to forward DHCP traffic and on untrusted interfaces to prevent rogue DHCP servers

• Includes configuring a maximum number of MAC addresses for DHCP snooping.

• Verifying DHCP snooping through the command line.

S1# show ip dhcp snooping binding
MacAddress    IpAddress        Lease(sec)  Type           VLAN  Interface
- -------------------- --------------- ---------- --------------- ---- --------------------
00:03:47:B5:9F:AD  192.168.10.10   193185     dhcp-snooping  5    FastEthernet0/5