MPLS Security Considerations

Monique J. Morrow, Cisco Systems
mmorrow@cisco.com
November 1 2004

MPLS JAPAN 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

1

Acknowledgments• Michael Behringer, Cisco Systems

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

2

Why is MPLS Security Important?
• Customer buys “Internet Service”:
Packets from SP are not trusted
Æ Perception: Need for firewalls, etc.

• Customer buys a “VPN Service”:
Packets from SP are trusted
Æ Perception: No further security required

SP Must Ensure Secure
MPLS Operations
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

3

Security Relies on Three Pillars

Operation

Implementation

Architecture/
Algorithm

Security

Break One, and All Security Is Gone!

MPLS Japan 2004

© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

4

Basic 2547 Security: Today’s Arguments• Can be misconfigured(operation)• Routers can have bugs
(implementation)

True, but Same on
ATM/FR• PEs can be accessedfrom Internet, thus
intrinsicly insecure

PEs Can Be
Secured, asInternet Routers• Floods over Internet
can impact VPN traffic

Engineering/QoS

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

5

Correct Security Analysis• Security has to be analyzed on three levels:
Architecture/algorithm
Implementation
Operation• Applied to MPLS/VPN:
1. The MPLS Architecture is secure(can be operated securely)
2. Implementation/operation issues may exist, like inany other technology
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

6

Protecting an MPLS/VPN Core—Overview
1. Don’t let packets into (!) the coreNo way to attack core, except throughrouting, thus:

2. Secure the routing protocol
Neighbor authentication, maximum
routes, dampening, …

Still “Open”:
Routing
ProtocolOnly Attack
Vector: Transit
Traffic

3. Design for transit traffic
QoS to give VPN priority over Internet
Choose correct router for bandwidth

Now Only
Insider Attacks
Possible

Separate PEs where necessary

4. Operate Securely
Avoid Insider
Attacks
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

7

Agenda• Analysis of MPLS/VPN Security• Security Recommendations• Secure MPLS VPN Design
Internet Access• Secure Operations• Attacking an MPLS Network• IPsec and MPLS
• Summary

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

8

General VPN Security Requirements• Address Space and Routing Separation• Hiding of the MPLS Core Structure• Resistance to Attacks• Impossibility of VPN Spoofing

Working assumption: The core (PE+P) is secure
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

9Hiding of the
MPLS Core Structure
MPLS core
Visible Address SpacePEP

IP(PE; l0)P

CE1IP(CE1)

IP(PE; fa0)

VRF CE1PP

CE2
IP(CE2)IP(PE; fa1)

VRF CE2• VRF contains MPLS IPv4 addresses• Only peering Interface (on PE) exposed (-> CE)!
-> 2004
ACL or unnumbered
MPLS Japan© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

10Resistance to Attacks:
Where and How?
• Where can you attack?
Address and Routing Separation, thus:
Only Attack point: peering PE• How?
- Intrusions(telnet, SNMP, …, routing protocol)

See ISP Essentials- DoS

Securewith ACLs

Securewith MD5MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

11

Label Spoofing• PE router expects IP packet from CE• Labelled packets will be dropped• Thus no spoofing possible

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

12

Comparison with ATM / FR
ATM/FR MPLS
Address space separation

yes

yes

Routing separation

yes

yes

Resistance to attacks

yes

yes

Resistance to Label
Spoofing
Direct CE-CE
Authentication (layer 3)

yes

yes

yes

with
IPsec

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

13

Agenda• Analysis of MPLS/VPN Security• Security Recommendations• Secure MPLS VPN Design
Internet Access• Secure Operations• Attacking an MPLS Network• IPsec and MPLS
• Summary

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

14

Security Recommendations for ISPs
• Secure devices (PE, P): They are trusted!
• Core (PE+P): Secure with ACLs on all interfaces
Ideal: deny ip any <core-networks>• Static PE-CE routing where possible• If routing: Use authentication (MD5)• Separation of CE-PE links where possible(Internet / VPN)
• LDP authentication (MD5)• VRF: Define maximum number of routes• Note: Overall security depends on weakest link!

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

15

PE-CE Routing Security
In order of security preference:
1.

Static: If no dynamic routing required(no security implications)

2.

BGP: For redundancy and dynamic updates(many security features)

3.

IGPs: If BGP not supported(limited security features)

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

16

Securing the MPLS Core
MPLS coreCE

BGP Route Reflector
PE

P

VPN

PE
P

CE

Internet

VPN

P

VPN

CE

PE

PE

VPN

VPN

PE

BGP peering with
MD5 authentic.
LDP with MD5

MPLS Japan 2004

CE

CE

© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

CE

ACL andsecure routing
17

Address Planes: True Separation!
CE

CE

VPN1 address space
0.0.0.0 – 255.255.255.255

VPN2 address space
0.0.0.0 – 255.255.255.255

control planePCEmbehring

several data
planes
PE

CE

PE

PE-CE
interfaces
belong to VPN.
Only attack
point!!

core address space
0.0.0.0 – 255.255.255.255

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

18

Securing the Core:
Infrastructure ACLs
CE

Easy with MPLS!

PE
VPN

In MPLS: VRF
belongs tocustomer VPN!

• On PE: “deny ip any <PE VRF address space>”
Exception: Routing protocol from host to host• Idea: No traffic to PE/P Æ you can’t attack• Prevents intrusions 100%
• DoS: Very hard, but traffic over router theoreticallyenables DoS.

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

19

Securing the Core:
Infrastructure ACLs
CE.2

1.1.1.0/30

.1

CE
.2

1.1.1.4/30

.1

PE

PE

VPN

VPN

PE

PE

VPN

VPN

• Example:
deny ip any 1.1.1.0 0.0.0.255

CE.1

1.1.1.8/30

.2

CE
.1

1.1.1.12/30.2This is VPN address
space, not core!

permit ip any any• Caution: This also blocks packets to the CE’s!
Alternatives: List all PE i/f in ACL, or use secondary i/f on CE
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

20

Best Practice Security Overview• Secure devices (PE, P): They are trusted• PEs: Secure with ACLs on all interfaces• Static PE-CE routing where possible• If routing: Use authentication (MD5)• Maximum number of routes per peer (only BGP)
• Separation of CE-PE links where possible(Internet/VPN)• LDP authentication (MD5)• VRF: Define maximum number of routes
Note: Overall security depends on weakest link
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

21

Agenda• Analysis of MPLS/VPN Security• Security Recommendations• Secure MPLS VPN Design
Internet Access• Secure Operations• Attacking an MPLS Network• IPsec and MPLS
• Summary

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

22

MPLS Internet Architectures: Principles• Core supports VPNs and Internet• VPNs remain separated• Internet as an option for a VPN• Essential: Firewalling

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

23

MPLS VPNs Are Quite Secure• Perfect separation of VPNs
No intrusions possible• Perfect separation of the core from VPNs
Again, no intrusions possible

BUT THERE IS ONE REMAINING ISSUE…

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

24

The Key Issue: DoS through a Shared PE
Might Affect VPN Customer
MPLS Core
Customer VPN

PE

P
P

VPN Customer
VRF CE1Internet Customer

P

k
c
a
tt

Internet
VRF

P

A P
S
Do

• PE has shared CPU / memory / bandwidth:ÆTraffic could affect VPN customer(However, risk probably acceptable)
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

25

Today’s Best Practice:
MPLS VPN Security Recommendation:• PE routers should contain
only VRFs of the same
security level. Example:

To Internet
PE1

customer
networkCE1

VRF Internet

Level 1: VPN customers

PE2

CE2

Level 0: Internet

VRF VPN(Level 2: Mission criticalinfrastructure)

To VPN

Note: This is negotiable: Shared Internet/VPN PE may be acceptable
if price and conditions are right.
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

26

Separate VPN and Internet Access
MPLS core

Customer LAN

To Internet

P

Firewall / NAT

CE1

PE1
VRF Internet

IDS

CE2

PE2
VRF VPN

To VPN• Separation:• DoS resistance:• MPLS
Cost:
Japan 2004++++++$$$ (Two lines and two PEs: Expensive!)© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

27

Separate Access Lines + CEs, one PE
MPLS core

Customer LAN

To Internet
Firewall / NAT

IDS

P
CE1

CE2

PE1

VRF Internet
VRF VPN

To VPN• Separation:+++• DoS resistance: ++ (DoS might impact VPN on PE)• Cost:$$ (Two lines, but only one PE)

MPLS Japan 2004

© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

28

Using a Single Access Line
Requirements to share a line:• PE requires separate sub-interfaces• CE requires separate sub-interfaces• CE side requires separate routing

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

29

Shared Access Line, Frame Relay
MPLS core

Customer LAN

P
Firewall / NAT Internet CEIDS
VPN CEFR switchingPE1

VRF Internet
VRF VPN

FR logical links• Separation:+++(DoS might affect VPN on PE, line, CE)• DoS resistance: +• Cost:$MPLS Japan 2004

© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

30

Hub-and-Spoke VPN with Internet Access
MPLS core

Hub Site

Firewall
NAT

Internet
CE

Internet
To Internet -->PE1
VRF Internet

IDS

PE2
VPN CEmbehring

VRF VPN

To VPN

PEs

VPN

VPN

VPN

CEs
MPLS Japan 2004

Spoke 1© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

Spoke 2

Spoke 331

Alternative Topologies• Full VPN mesh, one Internet Access• Internet access at several sites-> Several firewalls needed-> More complex• Internet Access from all sites-> Complex, one firewall per site

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

32

From RFC2547bis:
Data Plane Protection
1. a backbone router does not accept labeled packets
over a particular data link, unless it is known that thatdata link attaches only to trusted systems, or unless it is
known that such packets will leave the backbone before
the IP header or any labels lower in the stack will beinspected, and …
• Inter-AS should only be provisioned oversecure, private peerings• Specifically NOT: Internet Exchange Points(anyone could send labelled packets!! No
filtering possible!!)MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

33

From RFC2547bis:
Control Plane Protection
2. labeled VPN-IPv4 routes are not accepted from
untrusted or unreliable routing peers,• Accept routes with labels only from trusted
peers• Plus usual BGP filtering (see ISP
Essentials*)

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

34

Inter-AS: Case 10.a)
VRF-VRF back-to-back
Cust.
CE

AS 1

Cust.

AS 2

CE
PE

ASBR

PE

ASBR

mbehring

LSP

IP data

LSP• Control plane: No signalling, no labels• Data plane: IPv4 only, no labels accepted• Security: as in 2547
• Customer must trust both SPs

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

35

Security of Inter-AS 10.a)• Static mapping
SP1 does not “see” SP2’s network
And does not run routing with SP2, except within the VPNs.
Æ Quite secure• Potential issues:
SP 1 can connect VPN connection wrongly(like in ATM/FR)MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

36

Inter-AS: Case 10.b)
ASBR exchange labelled VPNv4 routes
Cust.
CE

AS 1

Cust.

AS 2

CE
PE

PE

ASBR MP-BGP+labels ASBR
mbehring

LSP

VPN label IP data

LSP

• Control plane: MP-BGP, labels• Data plane: Packets with one label• AS1 can insert traffic into any shared VPN of AS2• Customer must trust both SPs
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

37

Security of Inter-AS 10.b)• ASBR1 does signalling with ASBR2
MP-BGP: has to be secured, dampening etc
Otherwise no visibility of the other AS(ASBR1 – ASBR2 is the only interface between the SPs.)• Potential Issues:
SP1 can bring wrong CEs into any shared VPN
SP1 can send packets into any shared VPN (not into VPNs
that are not shared, since label is checked);Æ SP can make any shared VPN insecure

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

38

Inter-AS: Case 10.c)
ASBRs exchange PE loopbacks
Cust.
CE

AS 1

Cust.

AS 2

CE

VPNv4 routes + labels
PE

ASBR

PE loopb+labels

ASBR

PE

mbehring

PE label VPN IP data
LSP

• Control plane: ASBR: just PE loopback + labels;
PE/RR: VPNv4 routes + labels• Data plane: PE label + VPN label• AS1 can insert traffic into VPNs in AS2• Customer must trust both SPs
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

39

Security of Inter-AS 10.c)• ASBR-ASBR signalling (BGP)
RR-RR signalling (MP-BGP)
Much more “open” than 10.a) and 10.b)
LSPs between PEs, BGP between RR, ASBR

• Potential Issues:
SP1 can bring a CE into any VPN on “shared” PEs
SP1 can intrude into any VPN on “shared” PEs• Very open architecture
probably only applicable for ASes controlled by the same SP.
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

40

Inter-AS Summary and Recommendation• Three different models for Inter-AS
Different security properties
Most secure: Static VRF connections (10.a), but least
scalable• Basically the SPs have to trust each other
Hard / impossible to secure against other SP in this model• Okay if all ASes in control of one SP• Current Recommendation: Use 10.a)

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

41

Inter-AS Recommendation• Start with 10.a) (static VPN connections)
Not many Inter-AS customers yet anyway Æ Easy start• Maybe at some point (when many Inter-AS
customers), move to 10.b) (ease of provisioning)• 10.c) felt by most SPs as too open. Current
recommendation: Only when both ASes under one
common control

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

42

Carrier’s Carrier
Cust.
CE

Carrier’s
Carrier

Carrier

Cust.

Carrier

CE
PE

PE
PE

PE
PE

PE

IP data

IP datalabel IP datalabel IP datalabel label IP data

• Same principles as in normal MPLS
• Customer trusts carrier who trusts carrier

MPLS Japan 2004

© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

43

Carrier’s Carrier: The Interface
Carrier
PE2

Carrier’s
Carrier
PE1• Control Plane:
PE1 assigns label to PE2• Data Plane:PE1 only accepts packets with this label on this i/f
ÆPE1 controls data planeÆNo label spoofing possible

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

44

Carrier’s Carrier: Summary• Can be secured wellCarrier has VPN on Carrier’s Carrier MPLS cloud
Carrier cannot intrude into other VPNs.
Carrier can mess up his own VPN (VPNs he offers to his
customers)• End customer must trust both SPs.

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

45

Agenda• Analysis of MPLS/VPN Security• Security Recommendations• Secure MPLS VPN Design
Internet Access• Secure Operations• Attacking an MPLS Network• IPsec and MPLS
• Summary

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

46

Key: PE Security• What happens if a single PE in the core getscompromised?
Intruder has access to all VPNs; GRE tunnel to “his” CE in
the Internet, bring that CE into any VPN.
That VPN might not even notice…
Worst Case!

• Therefore: PE SECURITY IS PARAMOUNT!
• Therefore: No PE on customer premises!
(Think about console access, password recovery…)

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

47

Solution: Operational Security• Security depends on SP!
Employee can make mistake, or malicious misconfiguration• Potential Security hole:
If PE compromised, VPNs might be insecure• Cannot *prevent* all misconfigs
Æ Need to operationally control this

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

48

Operational Security• Logging config changes
Dual Control: Network operators must have no access to logging
facility
Otherwise they can hack the network, and delete the logs

• AAA for access• AAA for command authorization
Æ Keep logs in a secure place(Malicious employee might change logs too)

• Tight control• No service password-recovery where available

Secure Operations is Hard!!!
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

49

Agenda• Analysis of MPLS/VPN Security• Security Recommendations• Secure MPLS VPN Design
Internet Access• Secure Operations• Attacking an MPLS Network• IPsec and MPLS
• Summary

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

50

Ways to Attack• “Intrusion”: Get un-authorized access
Theory: Not possible (as shown before)
Practice: Depends on:

No Trust?

- Vendor implementation- Correct config and management

Use IPsec
between CEs!

• “Denial-of-Service”: Deny access of others
Much more interesting…

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

51

DoS Against MPLS
• DoS is about Resource Starvation, one of:Bandwidth
CPU
Memory (buffers, routing tables…)• In MPLS, we have to examine:
CE

PE• Rest is the same as in other networks
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

52

Attacking a CE from MPLS (other VPN)
• Is the CE reachable from the MPLS side?
-> only if this is an Internet CE, otherwise not!
(CE-PE addressing is part of VPN!)• For Internet CEs:
Same security rules apply as for any other access router.

MPLS hides VPN-CEs: Secure!
Internet CEs: Same as in other networks

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

53

Attacking a CE-PE Line• Also depends on reachability of CE or the VPN
behind it• Only an issue for Lines to Internet-CEs
Same considerations as in normal networks• If CE-PE line shared (VPN and Internet):
DoS on Internet may influence VPN! Use CAR!

MPLS hides VPN-CEs: Secure!
Internet CEs: Same as in other networks
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

54

Attacking a PE RouterPE
IP(PE; l0)

IP(P)

CE1
IP(CE1)

IP(PE; fa0)
VRF CE1

CE2
IP(CE2)IP(PE; fa1) VRF CE2

Attack points

VRF
Internet

Only visible: “your” interface
and interfaces of Internet CEs
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

55

DoS Attacks to PE Can Come from…
• Other VPN, connected to same PE• Internet, if PE carries Internet VRF
Possible Attacks:• Resource starvation on PE
Too many routing updates, too many SNMP requests,
small servers…

Has to Be Secured
and Can Be Secured!
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

56

Agenda• Analysis of MPLS/VPN Security• Security Recommendations• Secure MPLS VPN Design
Internet Access• Secure Operations• Attacking an MPLS Network• IPsec and MPLS
• Summary

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

57

Use IPsec if you need:• Encryption of traffic• Direct authentication of CEs• Integrity of traffic• Replay detection• Or: If you don’t want to trust your ISP for traffic
separation!

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

58

Where to Apply IPSec
CE

PE

PE

CE

IPSec CE-CE
Application:
VPN Security
IPSec PE-PE
Application:
Special Cases(see later)

IPSec CE-PE
MPLS Japan 2004

Application: Remote
Access into VPN© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

59

PE-PE IPSec Internet Draft• “Use of PE-PE IPSec in RFC2547 VPNs”(E. Rosen et al)
draft-ietf-l3vpn-ipsec-2547-02.txt• IPSec instead of LSP inside 2547bis core
• Does not define IPSec specific mechanism
Key exchange, SA scalability, …

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

60

Applications of PE-PE IPSec• If core is not pure MPLS, but IP basedStandard 2547bis requires MPLS core, PE-PE IPSec
does not
Alternative: MPLS in IP/GRE/L2TPv3, but with PE-PE
IPSec spoofing impossible• Protect against misbehaving transit nodes• Protection against sniffing on core lines

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

61

Non-Application: Customer Security

Hacker wants to …

IPSec
CE-CE

IPSec
PE-PE

… read VPN traffic

Protects Fully

Protects Partially… insert traffic into VPN

Protects Fully

Protects Partially… join a VPN

Protects Fully

Doesn’t Protect… DoS a VPN / the core

Doesn’t Protect

Doesn’t Protect

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

62

Non-Application: Customer Security“IPSec Security Associations that associate ingress
PE routes with egress PE routers do not ensure
privacy for VPN data. The data is exposed on the
PE-CE access links, and is exposed in the PE
routers themselves.”
draft-ietf-l3vpn-ipsec-2547-02.txt

CE

PE

PE

CE

IPSec
Unsecured

Unsecured

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

63

PE-PE IPSec: Encapsulation(draft-ietf-l3vpn-ipsec-2547-02.txt)
1. Pre-pend the VPN label,
as in normal MPLS
VPN Label IP Header Data
2. Encapsulate: MPLS in GRE or
IP (tunnel between PEs)
IP Header GRE VPN Label IP Header Data
3. Apply IPsec transport mode
IP Header ESP/AH GRE VPN Label IP Header Data
IPSec Transport Header

MPLS Japan 2004

Protected(Normal MPLS: PE Label VPN Label IP Header Data )© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

64

PE-PE IPSec: How It Works
1. Egress PE Signals IPSec
Policy Per VPN Prefix
BGP + Ext. Community
PE

VPN

PE
IPSec

VPN

2. Inress PEs Establish
IPSec Tunnel for Prefix• Not defined in draft:
How to establish IPSec tunnel
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

65

Agenda• Analysis of MPLS/VPN Security• Security Recommendations• Secure MPLS VPN Design
Internet Access• Secure Operations• Attacking an MPLS Network• IPsec and MPLS
• Summary

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

66

MPLS Doesn’t Provide…
• Protection against misconfigurations in the core
• Protection against attacks from within the core
• Confidentiality, authentication, integrity, anti-replay
Use IPSec if required• Customer network security

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

67

MPLS Security Overview
1. Don’t let packets into (!) the coreNo way to attack core, except throughrouting, thus:

2. Secure the routing protocol
Neighbor authentication, maximum
routes, dampening, …

3. Design for transit traffic
QoS to give VPN priority over Internet
Choose correct router for bandwidth

Still “Open”:
Routing
ProtocolOnly Attack
Vector: Transit
Traffic
Now Only
Insider Attacks
Possible

Separate PEs where necessary

4. Operate Securely

Avoid Insider
Attacks

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

68Summary• MPLS VPNs can be secured as well as ATM/FR
VPNs• Security depends on correct operation andimplementation• MPLS backbones can be more secure than“normal” IP backbones
Core not accessible from outside
Separate control and data plane• Key: PE security
Advantage: Only PE-CE interfaces accessible from outside
Makes security easier than in “normal” networks
MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

69

References• RFC2082 – RIP-2 MD5 Authentication• RFC2154 – OSPF with Digital Signatures• RFC2385 – Protection of BGP Sessions via the TCP MD5 Signature Option• RFC3013 – Recommended Internet Service Provider Security Services andProcedures• RFC2196 – Site Security Handbook• MPLS and VPN Architectures – ISBN 1-58705-002-1• Cisco ISP Essentials – ISBN 1-58705-041-2 (http://www.ispbook.com/)• http://www.cisco.com/public/cons/isp/documents/IOSEssentialsPDF.zip• General Information on Securing Cisco Routers• http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0
080120f48.shtml• Cisco Secure Virtual Private Networks - ISBN 1-58705-033-1

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

70

Q and A

Presentation_ID© 2003 Cisco Systems, Inc. All rights reserved.

71

Presentation_ID© 2001, Cisco Systems, Inc. All rights reserved.

72

Backup Material

MPLS JAPAN 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

73Non-IP networks: Not 100% secure!!
Example: Telephone Network“I had access to most, if not all, of theswitches in Las Vegas,” testified
Mitnick, at a hearing of Nevada's
Public Utilities Commission (PUC). “I
had the same privileges as a Northern
Telecom technician.”
Source:http://online.securityfocus.com/news/497

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

74Non-IP networks: Not 100% secure!!
Example: ATM Switch“a single 'land' packet sent to the telnet
port (23) of either the inband or out-ofband interface will cause the device tostop responding to ip traffic. Over thecourse of 6-1/2 minutes, all CPU will
be consumed and device reboots.”
Source: Bugtraq, 15 June 2002: “Fore/Marconi ATM
Switch 'land' vulnerability”, byseeker_sojourn@hotmail.com;

MPLS Japan 2004
© 2001, Cisco Systems,© 2003Inc.
Cisco
AllSystems,rights reserved.
Inc. All rights reserved.

75