CISC-ND-001220 - The Cisco switch must be configured to protect against known types of denial-of-service (DoS) attacks by employing organization-defined security safeguards.

Information

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.

This requirement addresses the configuration of network devices to mitigate the impact of DoS attacks that have occurred or are ongoing on device availability. For each network device, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or restricting the number of sessions the device opens at one time). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.

The security safeguards cannot be defined at the DOD level because they vary according to the capabilities of the individual network devices and the security controls applied on the adjacent networks (e.g., firewalls performing packet filtering to block DoS attacks).

Solution

Configure the Cisco switch to protect against known types of DoS attacks on the route processor. Implementing a CoPP policy as shown in the example below is a best practice method.

Step 1: Configure ACLs' specific traffic types.

SW1(config)# ip access-list CoPP_CRITICAL
SW1(config-acl)# remark our control plane adjacencies are critical
SW1(config-acl)# permit ospf host 10.1.12.1 any
SW1(config-acl)# permit ospf host 10.1.22.1 any
SW1(config-acl)# permit pim host 10.1.12.1 any
SW1(config-acl)# permit pim host 10.1.22.1 any
SW1(config-acl)# permit pim host 10.1.33.4 any
SW1(config-acl)# permit igmp any 224.0.0.0 15.255.255.255
SW1(config-acl)# permit tcp host 10.2.33.3 eq bgp host 10.2.33.4
SW1(config-acl)# permit tcp host 10.2.33.3 host 10.2.33.4 eq bgp
SW1(config-acl)# deny ip any any
SW1(config-acl)# exit

SW1(config)# ip access-list CoPP_IMPORTANT
SW1(config-acl)# permit tcp host 10.1.33.5 eq tacacs any
SW1(config-acl)# permit tcp 10.1.33.0 0.0.0.255 any eq 22
SW1(config-acl)# permit udp host 10.1.33.7 any eq snmp
SW1(config-acl)# permit udp host 10.1.33.9 eq ntp any
SW1(config-acl)# deny ip any any
SW1(config-acl)# exit

SW1(config)# ip access-list CoPP_NORMAL
SW1(config-acl)# remark we will want to rate limit ICMP traffic
SW1(config-acl)# permit icmp any any echo
SW1(config-acl)# permit icmp any any echo-reply
SW1(config-acl)# permit icmp any any time-exceeded
SW1(config-acl)# permit icmp any any unreachable
SW1(config-acl)# deny ip any any
SW1(config-acl)# exit

SW1(config)# ip access-list CoPP_UNDESIRABLE
SW1(config-acl)# remark other management plane traffic that should not be received
SW1(config-acl)# permit udp any any eq ntp
SW1(config-acl)# permit udp any any eq snmp
SW1(config-acl)# permit tcp any any eq 22
SW1(config-acl)# permit tcp any any eq 23
SW1(config-acl)# remark other control plane traffic not configured on switch
SW1(config-acl)# permit eigrp any any
SW1(config-acl)# permit udp any any eq rip
SW1(config-acl)# deny ip any any
SW1(config-acl)# exit

SW1(config)# ip access-list CoPP_DEFAULT
SW1(config-acl)# permit ip any any
SW1(config-acl)# exit

Step 2: Configure class maps referencing each of the ACLs.

SW1(config)# class-map match-all CoPP_CRITICAL
SW1(config-cmap)# match access-group name CoPP_CRITICAL
SW1(config-cmap)# class-map match-any CoPP_IMPORTANT
SW1(config-cmap)# match access-group name CoPP_IMPORTANT
SW1(config-cmap)# match protocol arp
SW1(config-cmap)# class-map match-all CoPP_NORMAL
SW1(config-cmap)# match access-group name CoPP_NORMAL
SW1(config-cmap)# class-map match-any CoPP_UNDESIRABLE
SW1(config-cmap)# match access-group name CoPP_UNDESIRABLE
SW1(config-cmap)# class-map match-all CoPP_DEFAULT
SW1(config-cmap)# match access-group name CoPP_DEFAULT
SW1(config-cmap)# exit

Step 3: Configure a policy map referencing the configured class maps and apply appropriate bandwidth allowance and policing attributes.

SW1(config)# policy-map CONTROL_PLANE_POLICY
SW1(config-pmap)# class CoPP_CRITICAL
SW1(config-pmap-c)# police 512000 8000 conform-action transmit exceed-action transmit
SW1(config-pmap-c-police)# class CoPP_IMPORTANT
SW1(config-pmap-c)# police 256000 4000 conform-action transmit exceed-action drop
SW1(config-pmap-c-police)# class CoPP_NORMAL
SW1(config-pmap-c)# police 128000 2000 conform-action transmit exceed-action drop
SW1(config-pmap-c-police)# class CoPP_UNDESIRABLE
SW1(config-pmap-c)# police 8000 1000 conform-action drop exceed-action drop
SW1(config-pmap-c-police)# class CoPP_DEFAULT
SW1(config-pmap-c)# police 64000 1000 conform-action transmit exceed-action drop
SW1(config-pmap-c-police)# exit
SW1(config-pmap-c)# exit
SW1(config-pmap)# exit

Step 4: Apply the policy map to the control plane.

SW1(config)# control-plane
SW1(config-cp)# service-policy input CONTROL_PLANE_POLICY
SW1(config-cp)# end

Item Details

Audit Name: DISA STIG Cisco NX-OS Switch NDM v3r1

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Plugin: Cisco

Control ID: 8266f0b4911925e9ea9a658a595cde4ac1336b3d72ca8f3446c273a752e4a7e9

Detections

Analytics

CISC-ND-001220 - The Cisco switch must be configured to protect against known types of denial-of-service (DoS) attacks by employing organization-defined security safeguards.

Information

Solution

See Also

Item Details