Cisco Network

Foundation Protection

Securing the Control Plane

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-1

 Router Control Plane

 Collection of processes
 Run at the process level
Control Plane

Central Switch
Engine
All IP packets that are destined for the control
plane should pass through the central switch
engine before they are forwarded to the process Route
level. Processor

Distributed Distributed
Switch Switch
Engine Engine

Legacy Distributed Distributed

Line Cards

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-2

 Tools for Securing the Control Plane

 Control Plane Protection feature

 Control Plane Policing
 Cisco AutoSecure
 CPU and Memory Threshold Notifications

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-3

 Control Plane Protection

 A framework
 Provides for all policing and protection
 Extends the CoPP functionality
 Finer granularity
 Traffic classifier
 Port filtering
 Queue threshold

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-4

 Control Plane Architecture with CPPr
Port Filter Policy

Queue Shareholding

Control Plane
Control  BGP PF QT CoPP Host Subinterface
Feature  HTTP Control Plane
Path CoPP
 SNMP Transit Subinterface
 OSPF
CoPP Control Plane Cisco Express
Forwarding Subinterface
Aggregate CoPP Cisco Express Forwarding
Input Feature
Classify

Packet
Buffer

Cisco Express Cisco Express

Output
Packet Forwarding/ Forwarding Input
Buffer FIB Lookup
Incoming Packets

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-5

 Configuring CPPr

 Configure CoPP.
 (Optional) Configure port-filter policy.
 (Optional) Configure queue-threshold policy.

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-6

 Example of CoPP
router(config)# ip access-list extended CP-acl
router(config-ext-nacl)# deny tcp host 10.10.10.2 any eq telnet
router(config-ext-nacl)# deny tcp host 10.10.10.2 any eq www
router(config-ext-nacl)# permit tcp any any eq telnet
router(config-ext-nacl)# permit tcp any any eq www
router(config-ext-nacl)# exit
router(config)# class-map match-any CP-class
router(config-cmap)# match access-group name CP-acl
router(config-cmap)# exit
router(config)# policy-map CP-policy
router(config-pmap)# class CP-class
router(config-pmap-c)# police rate 50000 pps conform-action transmit exceed-action drop
router(config-pmap-c-police)# exit
router(config-pmap-c)# exit
router(config-pmap)# exit
router(config)# control-plane host
router(config-cp-host))# service-policy input CP-policy
router(config-cp-host)# end

Administrator
10.10.10.2
© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-7
 Configuring Port Filter Policies

 Define port-filter packet classification criteria.

 Define a port-filter service policy.
 Apply the port-filter service policy to the host subinterface.

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-8

 Example of Port Filtering

router(config)# class-map type port-filter match-all PF-class

router(config-cmap)# match closed-ports
router(config-cmap)# exit
router(config)# policy-map type port-filter PF-policy
router(config-pmap)# class PF-class
router(config-pmap-c)# drop
router(config-pmap-c)# exit
router(config-pmap)# exit
router(config)# control-plane host
router(config-cp-host)# service-policy type port-filter input PF-policy

Administrator
10.10.10.2

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-9

 Configuring a Queue-Threshold Policy

 Define queue-threshold packet classification criteria.

 Define a queue-threshold service policy.
 Apply the queue-threshold policy to the host subinterface.

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-10

 Example of Queue Thresholding

class-map type queue-threshold match-all QT-class

match protocol bgp
policy-map type queue-threshold QT-policy
class QT-class
queue-limit 100
control-plane host
service-policy type queue-threshold input QT-policy

Administrator
10.10.10.2

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-11

 Verifying CPPr (Cont.)
router# show policy-map control-plane all

Control Plane Host

Service-policy input: CP-policy

Class-map: CP-class (match-any)

0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name CP-acl
0 packets, 0 bytes
5 minute rate 0 bps
police:
rate 50000 pps, burst 12207 packets
conformed 0 packets; actions:
transmit
exceeded 0 packets; actions:
drop
conformed 0 pps, exceed 0 pps

Class-map: class-default (match-any)

904 packets, 54312 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-13

 Verifying CPPr (Cont.)

router# show policy-map type port-filter control-plane all

drop
Control Plane Host

Service-policy port-filter input: PF-policy

Class-map: PF-class (match-all)

0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: closed-ports

Class-map: class-default (match-any)

1754 packets, 105357 bytes
5 minute offered rate 1000 bps, drop rate 0 bps
Match: any

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-14

 Verifying CPPr (Cont.)

router# show policy-map type queue-threshold control-plane all

queue-limit 100
queue-count 0 packets allowed/dropped 0/0
Control Plane Host

Service-policy queue-threshold input: QT-policy

Class-map: QT-class (match-all)

0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: protocol bgp

Class-map: class-default (match-any)

378 packets, 22734 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-15

 Summary

 A control plane is a collection of processes.

 There are several tools available for securing the control plane.
 CPPr is a framework.
 The control plane architecture consists of the control plane and its
subinterfaces.
 CoPP configuration is a component of CPPr configuration.
 Port filtering is another component of CPPr.
 Queue thresholding is another component of CPPr.
 The show policy-map command is used to verify CPPr.

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-16

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—3-17