# Presentation: 029645

## MPLS Security5th Annual MCWG Forum – October 16-20, 2006

**Tuesday, October 17, 2006**
**	**
- Harmen van der Linde	 **Contributions By:**
- Product Manager – MPLS	 Michael Behringer
- Cisco - NSSTG	 Monique Morrow
- havander@cisco.com

## Topics

**Multi-Protocol Label Switching (MPLS)**
**MPLS Security Overview**
**Framework**
**Risks and Deployment**
**Feature Set**
**Conclusions**

## Multi-Protocol Label Switching

Technology Overview
Network Architecture
MPLS Security

**Multi-Protocol Label Switching**
**Technology Overview**
**Network Architecture**
**MPLS Security**

## Packet Network Evolution

- IP + ATM Integration
- Cell Switching Routers
- IP/Tag Switching
- IETF Efforts

**IP over ATM****Challenge**

**MPLS Innovation ****and Deployment**

**Widespread****MPLS Deployments**

**1995 - 1996**

**1996 - 2002**

**2002 and Beyond**

- Traffic Engineering
- MPLS VPNs
- Fast Reroute
- Any Transport over MPLS (AToM)

- Multi-Service Edge
- MPLS High Availability with SSO/NSF/FRR
- MPLS + IPSec
- MPLS VPN and multicast

- Traditional ATM/FR
- Internet access
- Remote access VPNs

- MPLS VPN services with full mesh and Hub & Spoke connectivity
- QoS Offerings – 2 to 5 Classes

- Network Convergence – Many Services on converged MPLS core network
- Triple-play service converge

## Multi-Protocol Label Switching (MPLS)

**Established network infrastructure technology**
- Service provider networks and large enterprise networks
**Two functional layers in MPLS architecture**
- Control plane
- Forwarding plane
**MPLS control plane**
- Distributes labels and establishes label switched paths
- Multiple control protocols; LDP, BGP, and RSVP-TE** **
**MPLS forwarding plane**
- Used for MPLS labeled data packet forwarding
**MPLS Applications**
- Layer-3 VPNs, Layer-2 VPNs, Traffic Engineering (TE)

## MPLS Network Architecture

_**1. At Ingress Edge:**_
**Label imposition:****Classify & Label packets**

_**2. In the Core:**_
**Label swapping or switching:****Forward using labels (not IP addr); label indicates service class ****and**** destination**

**Label Switch Router (LSR) or P (Provider) router**
**Router OR ATM switch + label switch controller**

**Edge Label Switch Router OR**(ATM Switch/ Router)
**Provider Edge- PE**

_**3. At Egress Edge:**_
**Label disposition: ****Remove labels and forward packets**

**Customer A**

**Customer B**

**PE**

**P**

**P**

**PE**

## MPLS Security

| MPLS Area | High Availability | Management | Security |
| --- | --- | --- | --- |
| Core MPLS |  |  |  |
| MPLS forwarding (data plane) |  |  |  |
| MPLS signaling (control plane) |  |  |  |
| Layer-3 VPNs |  |  |  |
| Layer-2 VPNs |  |  |  |
| Traffic Engineering |  |  |  |

## MPLS Security Overview

Overview and Scope
Cisco IP NGN
Market Drivers and Positioning

**MPLS Security Overview**
**Overview and Scope**
**Cisco IP NGN**
**Market Drivers and Positioning**

## MPLS Security

**Protection mechanisms for MPLS-specific network resources**
- Protection of MPLS forwarding and signaling
**MPLS security protection areas**
- MPLS node access and resiliency
- Integrity and privacy of MPLS VPN service traffic
**Focus areas in MPLS network infrastructure**
- MPLS core (Label between PE pairs)
- MPLS service edge (PE-CE link)
- MPLS network interconnect (Inter-AS/SP)
**Incremental value-add and integral part of scalable and robust MPLS technology solution**

## Scope

**Focus on security capabilities for MPLS-specific network resources**
- Protection of MPLS forwarding and signaling
**Incremental security functionality to existing MPLS functions**
**Use of existing device and IP-level security capabilities assumed for basic level of security**
- CLI passwords, TACACS, ACLs, Firewalls, etc.
**Leverage existing security capabilities of lower layer protocols where possible**
- Instead of replication of functionality focus on integration of MPLS with existing security capabilities
**For example, LDP use of TCP MD5 authentication capabilities**

**Notes:**
Brief overview of the scope of the MPLS security work
What it is and what’s not
We’re no trying to reinvent the wheel
Not duplicate STG security efforts
Leverage STG capabilities, where possible
Justin Lei - SP security view, Network Foundation Protection
Infrastructure Security  - David Lewis 
Separate MPLS security from inter-domain security (IP + system level) and IP-level intra-domain
MPLS security focused on inter-domain MPLS and intra-domain IP/MPLS interconnect
Focus on security capabilities specific to MPLS technology
External focus; explicit features
Internal focus; MPLS software infrastructure enhancements

## Cisco IP NGN – Secure Network Layer

**Gaming**

**Data**
**Center**

**Presence-Based Telephony**

**Web Services**

**Mobile Apps**

**IP**
**Contact Center**

**Intelligent**
**Edge**

**Customer**
**Element**

**Multiservice**
**Core**

**Access**/** Aggregation**

**Application Layer**

**Service Layer**

**Network Layer**

**Transport**

**Service Exchange**

**Open Framework ****for Enabling ‘Triple Play on the Move’**
**(Data, Voice, ****Video, Mobility)**

**Mobility**

**Notes:**
High-level overview of where MPLS security fits into Cisco’s IP NGN architecture
Part of the Secure Network Layer

## MPLS Security Evolution

- Service Provider MPLS technology adoption
- Code features and stability

**Initial MPLS Deployments**

**Large &  Widespread MPLS Deployments**

**Next-Generation**** MPLS Deployments**

**1996 - 2002**

**2002 - 2005**

**2005 and Beyond**

- MPLS scale and enhanced features
- Enterprise MPLS technology adoption
- Manageability and operations

- Complexity of new enhanced services (Extranets, mcast)
- MPLS network convergence
- MPLS network inter-connects

- MPLS as a secure technology replacement for legacy Layer-2 technologies (FR/ATM)

- Inter-AS MPLS network connects
- New RFP compliance reqs
- Enterprise network security

- Increasing service configuration complexity
- New security reqs for support of converged triple play services

## MPLS Security Drivers

| MPLS Customers | MPLS Security Drivers | Examples |
| --- | --- | --- |
| Service Provider Segment |  |  |
| Tier-1 (Global) | Network convergence | Triple play and public/private services convergence |
| Tier-2 (National) | Network convergence and network interconnect | Inter-AS/SP network inter-connect |
| Enterprise Segment |  |  |
| Financials | Regulatory compliance
Extranet security | Sarbanes-Oxley Act
Financial application access |
| Education/Research | User traffic segmentation
Regulatory compliance | Secure campus connectivity |
| Other | Extranet security
MPLS technology value-add | Extranet partner connectivity |
| Government Segment |  |  |
| Government agencies and institutions | Regulations driving new network security requirements | US Homeland Security |

## Concerns and Goals 

- Unauthorized customer VPN access
- Public Internet traffic access/impact on private MPLS VPNs

- Unauthorized access to internal user VPNs
- Public Internet traffic access/impact on private LAN traffic

- Customer VPN traffic separation
- Public Internet and private VPN traffic separation

- User group VPN traffic separation
- WAN and extranet VPN traffic separation and privacy

- Unauthorized access to internal user VPNs
- WAN/public Internet traffic access/impact on private LAN traffic

- User group VPN traffic separation
- WAN and VPN traffic separation and privacy

## MPLS Security Framework

Service Provider View
Enterprise View
Threat Model

**MPLS Security Framework**
**Service Provider View**
**Enterprise View**
**Threat Model**

## Threat Model

| Security Threats | Security Vulnerability | Description |
| --- | --- | --- |
| Malicious user behavior | Denial of Service (DoS) attacks | MPLS network resources become unavailable to authorized users |
|  | Intrusion attacks | MPLS network resources become available to un-authorized users |
| Unintended human error and mis-configuration | MPLS device misconfiguration | MPLS network resources become available to unauthorized users |

## MPLS Security Framework

_**MPLS core signaling**_
- LDP, RSVP, and BGP

**MPLS packet ****forwarding**

_**MPLS edge signaling**_
- BGP, LDP, RIP, OSPF

**IP or MPLS packet ****forwarding**

**Control****Plane**

**Forwarding****Plane**

**Trusted Zone**

## MPLS Security – Service Provider View

**Trusted Zone**

_**MPLS Core Security**_
- Security for end-to-end (PE-PE) MPLS traffic integrity
- Focus on MPLS packet forwarding

_**MPLS Edge Security**_
- Security for VPN service interface
- Focus on control plane access and resources on PE router

_**MPLS Inter-AS Security**_
- Security for network interconnect interface
- Focus on data/control plane access on ASBR

## MPLS Security – Enterprise View

**MPLS****Network**

**SP MPLS****Network**

**Extranet****Customer****Network**

**Trusted Zone**

_**MPLS Core Security**_
- Security for end-to-end (PE-PE) MPLS traffic integrity
- Focus on MPLS traffic segmentation

_**Extranet Edge Security**_
- Security of extranetVPN interface
- Focus on data/control plane access acrossinterface with partner

_**WAN Edge Security**_
- Security of WAN interface with SP
- Focus on data/control plane access acrossPE-CE link with SP

## Security Threats

|  |  |  |  |
| --- | --- | --- | --- |
|  | MPLS Service Edge(PE Router) | MPLS Core(P routers) | MPLS Inter-AS Edge (ASBR) |
| Malicious user behavior | Control plane DoS attacks
Unauthorized control plane access (e.g., SNMP, CDP) | Control plane DoS attacks (e.g., LDP) | Unauthorized VPN/IGP access via label spoofing
Control plane DoS attack |
| Unintended human error and mis-configuration | Unintended VPN Route leakage due to VRF mis-configuration
PE router access due to incorrect/missing access configuration | Unintended P router access due to incorrect ACL configuration | Unintended VPN Route leakage due to incorrect VPN route distribution
ASBR router access due to incorrect/missing access configuration |

## MPLS Security – Risks and Deployment

Security Risk
MPLS Deployment Scenarios
Network Complexity versus Capital Costs

**MPLS Security – Risks and Deployment**
**Security Risk**
**MPLS Deployment Scenarios**
**Network Complexity versus Capital Costs**

## MPLS Security and Risks

**MPLS security associated with MPLS deployment and risk**
- Risk of MPLS design or configuration error
**MPLS deployment components**
- Network design, implementation, and operation
**Basic risk components**
- Security vulnerability event
- Probability of event
- Impact of event
**MPLS security focused on mitigating potential security vulnerability events**
- Minimizing probability and associated impacts of potential events

## MPLS Deployment Framework

## MPLS Deployment Risk

**MPLS network deployment complexity level determines perceived security risks**
- More complexity requires more detailed design, and associated network implementation and operation
- More complexity increases the possibility of design and configuration errors
**Influencing factors of MPLS deployment complexity**
- Network architecture (e.g., physical v.s. logical separation)
- Networking services run on top of MPLS network
**Types of networking services**
- Public IP services (Internet)
- Private (VPN) connectivity services

## Public and Private Connectivity Services

- at&t: Managed Internet Service (MIS)
- Sprint Nextel: Internet Access
- Verizon Business: Dedicated Internet Access

- at&t: IPeFR, eVPN
- Masergy: Private IP
- Sprint Nextel: MPLS VPN
- Verizon Business: Private IP

## MPLS Deployment Scenarios

**Shared MPLS ****Core & Edge**

**Shared MPLS Core ****& Separate Edge**

**Separate MPLS ****Core & Edge**

## Current MPLS Deployments

**Internal survey of key SP customers on deployment of public and private MPLS services**
- Separate MPLS core & edge
- Shared MPLS core & separate edge
- Shared MPLS core & edge
**No common MPLS deployment preference**
- Balanced distribution of various MPLS deployment scenarios

**Source: Internal 2006 MPLS Security Survey by Michael Behringer.**

## Future MPLS Deployment Plans

**Future MPLS deployment plans indicate increasing network consolidation **
- Increasing number of shared MPLS core deployments
**Common MPLS core for public and private services**
**Migration of both public and private services onto single MPLS edge**

**Source: Internal 2006 MPLS Security Survey by Michael Behringer.**

## Network Complexity versus Capital Costs

**Goal**

**Lower cost MPLS deployments with reduced complexity and increased resiliency**

## MPLS Security Features

Core Network Security
Service Edge Security
Network Inter-Connect Security

**MPLS Security Features**
**Core Network Security**
**Service Edge Security**
**Network Inter-Connect Security**

## Feature Portfolio

- MPLS VPN traffic separation
- Network Topology hiding
- MPLS control plane protection

- VPN address space separation and route control
- PE-CE link control plane access

- MPLS traffic forwarding
- MPLS packet TTL hiding
- Control plane session authentication

- Control plane policing
- VPN route control
- BGP session prefix filtering and control
- Control plane session authentication

- MPLS VPN traffic separation
- ASBR link control plane protection

- Control plane policing
- VPN route control
- Control plane session authentication

## MPLS Security – Core Network

| Requirement | Available Feature Capabilities | Comments |
| --- | --- | --- |
| VPN traffic separation | MPLS labeled packet forwarding using different FECs, LSPs, and label imposition/dispositioning | Native MPLS capability |
| MPLS control plane protection (access control) | Selective enablement of BGP/LDP on core I/Fs
Selective IGP route assignment/distribution | ACL route filtering in edge network assumed |
| MPLS control plane authentication | MD5 authentication of LDP sessions
MD5 authentication of iBGP sessions | - |

**MPLS Core Network**

**BGP****Route Reflector**

**MPLS Core Network Security**

## Infrastructure Access-Lists (ACLs)

**Infrastructure Access-Lists (ACLs)**

**Example: **
- deny ip any **1.1.1.0   0.0.0.255**
- permit ip any any
**Caution: This also blocks packets to the CE’s!**
- Alternatives: List all PE interfaces in ACL or use secondary interface on CE

**CE**

**PE**

**VPN**

**CE**

**PE**

**VPN**

**PE**

**VPN**

**PE**

**VPN**

**CE**

**CE**

**1.1.1.0/30**

**1.1.1.4/30**

**1.1.1.8/30**

**1.1.1.12/30**

**.1**

**.1**

**.1**

**.1**

**.2**

**.2**

**.2**

**.2**

**This Is VPN Address Space, Not Core!**

## Best Practices – MPLS Core Security

**Dedicated management access to P and PE routers**
- Out-of-band or in-band
**Use AAA for device access**
**Logging device configuration changes**
- Limited access to logging facility
**Use command authorization where possible**
- Keep logs in a secure place
- Malicious employee might change logs too
**Use access-control list on PE routers for blocking any potential external traffic**
**Option of use MD5 authentication for LDP**
- May be required as part of security conformance policies

## MPLS Security – Service Edge

| Requirement | Available Feature Capabilities | Comments |
| --- | --- | --- |
| PE-CE link control plane protection (access control) | Selective control plane prefix filtering
Control Plane Policing (CoPP) | ACL protocol port filtering on PE router assumed |
| VPN route access control and address space separation | VPN address space separation via VRFs
BGP max-prefix limit (per eBGP session)
VRF max route (per VRF) | VRF ~ customer RIB
Filtering control of BGP RIB and VPN route updates |
| PE-CE link control plane authentication | MD5 authentication of eBGP sessions | - |

**MPLS Edge ****Network**

**BGP****Route Reflector**

**Customer Edge ****Network**

**MPLS Core Network**

**MPLS Service ****Edge Security**

## Controlling VPN Route Maximum

_**Potential Security Vulnerability:**_
**Injection of too many routes into VPN table (VRF) **
- Potential memory overflow
- Potential (control plane) DoS attack
_**Protection Mechanism:**_
**Specify maximum number of VPN routes for****VPN route table (VRF)**
**ip vrf vpn01**
** ****maximum routes 500 80**

## Controlling BGP Prefix Maximum

_**Potential Security Vulnerability:**_
**Injection of too many BGP prefix updates **
- Potential memory overflow
- Potential (control plane) DoS attack
_**Protection Mechanism:**_
**Specify maximum number of BGP prefix for****a specific BGP neighbor session**
**router bgp 10**
**neighbor 140.0.250.2 maximum-prefix 500 80 restart 2**

## MPLS VPN Configuration

**Reduce potential MPLS VPN configuration errors via automation of service configuration and validation on PE routers **

## MPLS Network Monitoring

## Best Practices – MPLS Edge Security

**Access-list configuration of PE routers**
- Disable external traffic destined to MPLS core or edge nodes
**Control plane traffic filtering on PE routers**
- Control Plane Policing (CoPP)
**Disable selective control plane protocols on VRF-enabled interfaces**
- E.g., disable SNMP, CDP access for CE routers
**Configuration of max allowable VRF routes**
**Configuration of max number of BGP prefix updates per eBPG peer **
**In case dynamic routing is configured across PE-CE link option to use MD5-based BGP session authentication **
- May be required as part of security conformance policies

## MPLS Security – Network Inter-Connect

| Requirement | Available Feature Capabilities | Comments |
| --- | --- | --- |
| PE-CE link control plane protection (access control) | VPNv4 route filtering
Control Plane Policing (CoPP) | ACL protocol port filtering on PE router assumed |
| VPN route access control and address space separation | VPN address space separation via VRFs
BGP max-prefix limit (per eBGP session)
VRF max route (per VRF) | VRF ~ VPN-specific RIB
Filtering control of BGP RIB and VPN route updates |
| ASBR link control plane authentication | MD5 authentication of eBGP sessions | - |

**MPLS Edge ****Network**

**BGP****Route Reflector**

**MPLS Network ****Connect Security**

**External MPLS ****Network**

**MPLS Core Network**

## Wrap-up

IETF References
Conclusions

**Wrap-up**
**IETF References**
**Conclusions**

## IETF

**IETF L3VPN Working Group:**
- Working on Layer 3 VPN architectures, such as MPLS IP VPNs, IP VPNs using virtual routers, and IPsec VPNs
- _[http://www.ietf.org/html.charters/l3vpn-charter.html](http://www.ietf.org/html.charters/l3vpn-charter.html)_
**IETF L2VPN Working Group: **
- Working on Layer 2 VPN architectures, such as VPLS and VPWS
- _[http://www.ietf.org/html.charters/l2vpn-charter.html](http://www.ietf.org/html.charters/l2vpn-charter.html)_
**RFC4381**
- Analysis of MPLS VPN Security
**RFC2196**
- Site Security Handbook
**RFC2385**
- Protection of BGP Sessions via the TCP MD5 Signature Option
**RFC3013**
- Recommended Internet Service Provider Security Services and Procedures

## Conclusions

**MPLS security covers protection mechanisms for MPLS forwarding and signaling**
**MPLS security requires holistic approach including network design, implementation, ****and operation**
**Level of MPLS network deployment complexity determines perceived network security risks**
**Growing importance of MPLS security as a result of network and service convergence**

## Slide 45