Management plane is the plane that receives and send the traffic that is used to access, configure and manage a device as well as monitor its operation and network on which it is deployed .The management plane is made up of protocols that support operational need of the network .The management plane includes interactive access to network devices using secure shell(SSH) or Telnet statistics collection using SNMP.
Control plane functions consist of protocols and processes Control Plane consist of Protocols.
Introduction<br /><ul><li>Cisco IOS Software</li></ul>Internetwork Operating system<br />Used on Cisco Routers and switches<br />Package integrated with multitasking OS<br />Characteristics CLI(Command Line Interface)<br /><ul><li>Hardening</li></ul>Process of securing a system by reducing vulnerabilities<br />
Three Planes of a Network<br /><ul><li>Management Plane
Monitor the memory and CPU load of network devices.
Disable unneeded services </li></li></ul><li>Contd..<br /><ul><li>Secure interactive management sessions.</li></ul>Limit which IP addresses may establish <br /> management sessions to the network devices.<br />- Access classes<br /> - Management Plane protection.<br /> - Control plane policing.<br />Use warning banners for malicious users.<br />Use secure protocols.<br />
Contd..<br /><ul><li>Limit access to network with infrastructure access control List iACLs.</li></ul>Permit connections that are required for routing protocols and network management.<br />Explicitly deny all other IP traffic to any network device.<br />Permit all transit traffic that crosses the network and is not destined for infrastructure devices.<br />
Control Plane Fortification<br /><ul><li>Implement general control plane hardening.</li></ul> - Disable ICMP Redirect processing.<br /> - Disable ICMP unreachable generation.<br /> - Disable proxy ARP.<br /> - If you use NTP ,explicitly configure a trusted time <br /> source and use proper authentication.<br /><ul><li>Limit CPU impact of control plane traffic</li></ul> - Implement iACLs<br /> - Implement receive ACLs(rACLs)<br /> - Use CoPP.<br />
Contd..<br /><ul><li>Secure BGP</li></ul>- Implement TTL Based security protection generalized TTL based security mechanism(GTSM),also known as BGP TTL security hack (BTCH).<br /> - Implement BGP peer authentication with message <br /> digest five (MD 5)<br /><ul><li>Configure a maximum number of BGP prefixes that can be stored by a router in memory.
Filter BGP prefixes with BGP autonomous system (AS) path access list and prefix list.</li></li></ul><li>Contd..<br /><ul><li>Secure IGPs
Use routing protocol authentication with MD5 , the </li></ul> passive interface command and routing filtering<br /> - Configure routing protocol to limit resource consumption.<br /><ul><li>Secure first hop Redundancy protocols(FHRPs)</li></ul> - Gateway load balancing protocol<br /> - Hot standby router protocol(HSRB)<br /> - Virtual router redundancy protocol.<br />
Access control lists.</li></li></ul><li>Contd..<br /><ul><li> Prevent spoofed addresses from entering the N/W .
Prevent the origination of packets containing spoofed source addrerss.
Filter transit traffic specifically ICPM packets , IP fragments and packets containing IP options with transit ACLs (tACLs).</li></li></ul><li>Contd..<br /><ul><li> Filter packets containing IP options where they are not needed.
Minimize CPU intensive features such as ACL logging and IP fragmentation.
Limit the generation of ICMP unreachable and Time exceeded messages.</li></li></ul><li>Contd..<br /><ul><li>Identify and trace attacks