Network Virtualization using Extreme Fabric Connect

Network Virtualization Using Extreme Fabric Connect
© 2019 Extreme Networks, Inc. All rights reserved. 166
Tip
As a matter of comparison, consider that there are two basic ways an MPLS core can be
attacked: by attacking the provider-edge router, or by attacking the signalling
mechanisms of MPLS. Both types of attacks require specific router configuration via ACLs
to be repelled.
In the Fabric Connect model the latter is simply not applicable nor possible. The former
(attacking the L3 VSN BEB) is equally applicable, though by default the VRF IPs have the
highest levels of protection enabled, without requiring additional configuration.
Impossibility of Spoofing Attacks
Packet spoofing and replay attacks are a form of impersonation attacks whereby an attacker uses a false
identity (or spoofs the identity of another legitimate device) to obtain unauthorized access to a VSN and its
associated services. This is equally possible at Layer 2 (in L2 VSNs) and Layer 3 (in L3 VSNs) where the
attacker will try to generate packets spoofing either an L2 MAC address or an L3 IP address. If the receiver
accepts the spoofed packets, this could allow the attack to either fool the network, or the receiver, into
forwarding to it traffic flows that the attacker can then scan for authentication sequences, which ultimately
could lead to unauthorized access.
In an L3 VSN service, spoofing VSN IP routes would require the attacker to be able to inject invalid IP routes
into the BEB’s VRF. For this to happen, the attacker would need to try to poison the VRF routing table
using a dynamic routing protocol.
Tip
In the Extreme Networks Fabric Connect implementation, by default, no IP routing
protocol instances exist on VRFs; these are not needed for SPB L3 VSNs to operate. Do
not activate any IP routing protocols on VRF local VLAN IP interfaces where users may
reside (subnet mask smaller than 30 bits).
If a dynamic IP routing protocol (such as OSPF, RIP, BGP) does need to be enabled on a
VRF terminating an L3 VSN (because an authorized traditional IP router needs to be
connected to the VSN), connect these routers using point-to-point 30-bit IP subnets and
always use protocol authentication options (e.g., HMAC-MD5).
Spoofing other IP users’ IP addresses within the same access user subnet can be easily done using ARP
spoofing techniques. The only way to repel these types of attacks is to ensure that standard edge security
features are deployed on access switches.
Tip
Use these Layer 3 security access features:
• IPv4
• DHCP Snooping
• Dynamic ARP Inspection
• IP Source Guard
• IPv6 - First Hop Security (FHS) - RIPE 554
• DHCPv6 guard
• Router Advertisement filtering (RA guard)
• Dynamic Neighbour solicitation or advertisement inspection
• Neighbour reachability detection inspection
• Duplicate Address Detection (DAD) inspection