Cisco Configuring Switch Integrated Security Features User Manual PDF (EN)

Overview

Configuring Switch Integrated Security Features Information About SISF, on page 1 How to Configure SISF, on page 20 Configuration Examples for SISF, on page 30 Feature History for SISF, on page 38 Information About SISF Overview Switch Integrated Security Features (SISF) is a framework developed to optimize security in Layer 2 domains. It merges the IP Device Tracking (IPDT) and certain IPv6 first-hop security (FHS) functionality 1 , to simplify the migration from IPv4 to IPv6 stack or a dual-stack. The SISF infrastructure provides a unified database that is used by: • IPv6 FHS features:

IPv6 Router Advertisement (RA) Guard, IPv6 DHCP Guard, Layer 2 DHCP Relay, IPv6 Duplicate Address Detection (DAD) Proxy, Flooding Suppression, IPv6 Source Guard, IPv6 Destination Guard, RA Throttler, and IPv6 Prefix Guard. • Features like Cisco TrustSec, IEEE 802.1X, Locator ID Separation Protocol (LISP), Ethernet VPN (EVPN), and Web Authentication, which act as clients for SISF. The following figure illustrates this: 1 IPv6 Snooping Policy, IPv6 FHS Binding Table Content, and IPv6 Neighbor Discovery Inspection Configuring Switch Integrated Security Features 1

Стр. 1

The Binding Table

Figure 1: SISF Framework Note The terms “SISF” “device-tracking” and “SISF-based device-tracking” are used interchangeably in this document and refer to the same feature. Neither term is used to mean or should be confused with the legacy IPDT or IPv6 Snooping features. Understanding the SISF Infrastructure This section explains the various elements of the SISF infrastructure as shown in the SISF Framework above. The Binding Table The SISF infrastructure is built around the binding table. The binding table contains information about the hosts that are connected to the ports of a switch and the IP and MAC address of these hosts.

This helps to create a physical map of all the hosts that are connected to a switch. Each entry in a binding table provides the following information about a connected host: • IPv4 or IPv6 address of the host. • MAC address of the host. The same MAC address may be linked to an IPv4 and IPv6 address. • The interface or port on the switch that the host is connected to, and the associated VLAN. • The state of the entry, which indicates the reachability of the entry. Configuring Switch Integrated Security Features Understanding the SISF Infrastructure Configuring Switch Integrated Security Features 2

Стр. 2

States and Lifetime of a Binding Table Entry

The following figure shows a simple network topology and a representative binding table for each access switch in the network. SW A and SW B are the two access switches in the network. The two access switches are connected to the same distribution switch. H1, H2, H3, H4 are the hosts. This is an example of a distributed binding table, that is, each access switch in the network has its own table. An alternative set-up could be one centralised binding table on the distribution switch with the entries of SW A and SW B .

Having a distributed or a centralised binding table is a key design choice in the process of implementing SISF in your network and is covered in greater detail in the Understanding Policy Parameters, on page 8 section in this chapter. Figure 2: Binding Table (Click on the image to see the details more clearly.) States and Lifetime of a Binding Table Entry The state of an entry indicates if the host is reachable or not. The stable states of a binding table entry are: REACHABLE, DOWN, and STALE. When changing from one state to another, an entry may have other temporary or transitional states such as: VERIFY, INCOMPLETE, and TENTATIVE.

The duration an entry remains in a given state is determined by its lifetime and whether the entry is successfully validated. The lifetime of an entry can be policy-driven or configured globally, and in case of DHCP-originated entries it is determined based on the DHCP lease time. To configure the REACHABLE, DOWN, and STALE lifetimes, enter the following command in global configuration mode:

device-tracking binding { reachable-lifetime { seconds | infinite } | stale-lifetime { seconds | infinite } | down-lifetime { seconds | infinite } } For DHCP-originated entries, the above configuration does not apply as the DHCP lease time overrides the SISF stale-lifetime and down-lifetime configuration that are globally defined or specified by the policy. Note State: Reachable If an entry has this state, it means the host (IP and MAC address) from which a control packet was received, is a verified and valid host. A reachable entry has a default lifetime of 5 minutes. You can also configure a duration.

By configuring a reachable-lifetime, you specify how long a host can remain in a REACHABLE state, after the last incoming control packet from that host. Configuring Switch Integrated Security Features States and Lifetime of a Binding Table Entry Configuring Switch Integrated Security Features 3

Стр. 3

States and Lifetime of a Binding Table Entry

If an event is detected before the entry’s reachable lifetime expires, then the reachable lifetime is reset. To qualify for the REACHABLE state, a new entry goes through the process illustrated in the figure below. The switch detects an event (E), such as an incoming control packet from a connected host and creates an entry. Various events cause the creation of an entry, and these are described in the Binding Table Sources section. The creation of an entry is followed by different transient states, such as TENTATIVE or INCOMPLETE. While in a transitional state, the switch validates and confirms the integrity of the binding entry.

If the entry is found to be valid, then the state changes to REACHABLE. But if an address theft or similar event is detected, then the entry is regarded as invalid and is deleted. For example, if an attacker sends unsolicited neighbor advertisement messages with the same IP as the target IP and its (attacker's) own MAC address to redirect traffic. Figure 3: Creation of a Reachable Entry State: Stale If an entry is in this state it means that the entry’s reachable lifetime has expired and the corresponding host is still silent (no incoming packets from the host). A stale entry has a default lifetime of 24 hours. You can also configure a duration.

An entry that remains in the STALE state beyond the stale lifetime, is deleted. This is illustrated in the figure below which depicts the lifecycle of an entry. Figure 4: Lifecycle of an Entry State: Down If an entry is in this state, it means that the host’s connecting interface is down. A down entry has a default lifetime of 24 hours. You can also configure a duration. An entry that remains in the DOWN state beyond the down lifetime, is deleted. Polling a Host and Updating the Binding Table Entry Polling is a periodic and conditional checking of the host to see the state it is in, whether it is still connected, and whether it is communicating.

In addition to determining an entry’s state, you can use polling to reconfirm an entry's state. Configuring Switch Integrated Security Features States and Lifetime of a Binding Table Entry Configuring Switch Integrated Security Features 4

Стр. 4