Network Virtualization using Extreme Fabric Connect

Network Virtualization Using Extreme Fabric Connect
© 2019 Extreme Networks, Inc. All rights reserved. 165
Figure 95 L3 VSN Topology as Seen by IP Scanning Tools
Resistance to Attacks
By resistance to attacks we intend the ability of the core to withstand any denial of service (DoS) attacks
from the outside. It is essential that the core itself should not be accessible for such attacks and that if the
attack is launched from within a VSN, no other VSNs be attained by it. An attack originating on an L2 VSN
service that is not provisioned with any IP interfaces can only target other end-stations within the same
VSN service.
An attack originating on an L3 VSN service will be able to target the gateway IP interfaces on the VRF
where the VSN service is terminated. However, there are no open ports (sockets) on these interfaces with
the exception of DHCP (for the relay agent) and possibly of some routing protocol (e.g., OSPF, RIP, BGP),
but only if an instance of these protocols has been created on the VRF and enabled on the IP interface in
question. By default, the VRF IP interface will only respond to ARP and ICMP, as such any attack will be
limited to ARP poisoning and spoofing (covered in next section).
An attack originating on GRT IP Shortcuts routing domain does instead present some risks, as the network
IP interfaces within this domain are activated for device management and bound to many sockets used for
management protocols (e.g. SSH, SNMP, HTTPs). Extreme’s recommendation is therefore that the GRT IP
Shortcuts routing domain be reserved exclusively for management of the Fabric Connect infrastructure by
only extending it to a management subnet where the Network Management stations reside on one side and
to the SPB nodes on the other. By doing so, this routing domain need not be extended to any user VLAN on
the network access ports.