Scribd Logo
Upload

Welcome to Scribd!

  • 226 views

    Chapter 4 Network Foundation Protection

    Uploaded by

    dhananjayagamage
    The document discusses the Cisco Network Foundation Protection (NFP) framework which provides strategies for protecting the infrastructure of a network. The NFP framework divides network devices into three functional areas - the control plane, management plane, and data plane. It identifies threats to each plane and outlines features like control plane policing, role-based access control, and access control lists that can be used to secure each respective plane in order to ensure network availability and continuous service delivery.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Chapter 4 Network Foundation Protection

    Uploaded by

    dhananjayagamage
    226 views6 pages
    The document discusses the Cisco Network Foundation Protection (NFP) framework which provides strategies for protecting the infrastructure of a network. The NFP framework divides network devices into three functional areas - the control plane, management plane, and data plane. It identifies threats to each plane and outlines features like control plane policing, role-based access control, and access control lists that can be used to secure each respective plane in order to ensure network availability and continuous service delivery.

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses the Cisco Network Foundation Protection (NFP) framework which provides strategies for protecting the infrastructure of a network. The NFP framework divides network devices into three functional areas - the control plane, management plane, and data plane. It identifies threats to each plane and outlines features like control plane policing, role-based access control, and access control lists that can be used to secure each respective plane in order to ensure network availability and continuous service delivery.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    226 views6 pages

    Chapter 4 Network Foundation Protection

    Uploaded by

    dhananjayagamage
    The document discusses the Cisco Network Foundation Protection (NFP) framework which provides strategies for protecting the infrastructure of a network. The NFP framework divides network devices into three functional areas - the control plane, management plane, and data plane. It identifies threats to each plane and outlines features like control plane policing, role-based access control, and access control lists that can be used to secure each respective plane in order to ensure network availability and continuous service delivery.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 6
    At a glance
    Powered by AI
    The passage discusses the Cisco Network Foundation Protection (NFP) framework which divides network devices into three functional areas or planes that must be secured: the control plane, management plane, and data plane. It also discusses various security features that can be implemented on each plane like control plane policing (CoPP) and role-based access control (RBAC).

    The three planes that must be protected according to the Cisco NFP framework are the control plane, management plane, and data plane.

    A security feature that can be used to implement control plane security is control plane policing (CoPP).

    Chapter 4 Network Foundation Protection

    Threats Against the Network Infrastructure


    Common vulnerabilities and threats against a network infrastructure include the following:


    The impact of those threats and vulnerabilities includes the following:



    Cisco Network Foundation Protection Framework
    The Cisco Network Foundation Protection (NFP) framework provides an umbrella strategy
    for infrastructure protection forming the foundation for continuous service delivery.
    NFP logically divides a router and Catalyst switches into three functional areas:



    Figure 4-1 provides a conceptual view of the NFP framework.


    Each of these planes must be protected to provide network availability and ensure continuous
    service delivery. The Cisco NFP framework provides the tools and techniques to
    secure each of these planes.

    Control Plane Security
    Control plane security can be implemented using the following features:


    Control Plane Policing
    CoPP is designed to prevent unnecessary traffic from overwhelming the route processor.
    The CoPP feature treats the control plane as a separate entity with its own ingress (input)
    and egress (output) ports. Because the CoPP feature treats the control plane as a separate
    entity, a set of rules can be established and associated with the ingress and egress ports
    of the control plane.
    CoPP consists of the following features:


    Management Plane Security
    Management plane security can be implemented using the following features:


    Role-Based Access Control
    RBAC restricts user access based on the role of the user. Roles are created for job or
    task functions and assigned access permissions to specific assets. Users are then assigned
    to roles and acquire the permissions that are defined for the role.
    In Cisco IOS, the role-based CLI access feature implements RBAC for router management
    access. The feature creates different views that define which commands are
    accepted and what configuration information is visible. For scalability, users, permissions,
    and roles are usually created and maintained in a central repository server. This
    makes the access control policy available to multiple devices using it.
    The central repository server can be a AAA server such as the Cisco Secure Access
    Control System (ACS) to provide AAA services to a network for management purposes.

    Secure Management and Reporting
    The management network is a very attractive target to hackers. For this reason, the
    management
    module has been built with several technologies designed to mitigate such risks.
    The information flow between management hosts and the managed devices can be
    out-of-band (OOB) (information flows within a network on which no production traffic
    resides) or in-band (information flows across the enterprise production network, the
    Internet, or both).

    Data Plane Security
    Data plane security can be implemented using the following features:


    ACLs
    ACLs are used to secure the data plane in a variety of ways, including the following:



    Antispoofing
    Implementing the IETF best current practice 38 (BCP38) and RFC 2827 ingress traffic
    filtering renders the use of invalid source IP addresses ineffective, forcing attacks to be
    initiated from valid, reachable IP addresses which could be traced to the originator of an
    attack.
    Features such as Unicast Reverse Path Forwarding (uRPF) can be used to complement
    the antispoofing strategy.

    Layer 2 Data Plane Protection
    The following are Layer 2 security tools integrated into the Cisco Catalyst switches:

    You might also like