SDN, networking security technologies,

software defined networking (SDN)

treats network functionality and implementation details separately, separates the control plane from the data plane

• makes the network programmable, made possible using encapsulation

  security benefits:

• allows granular network configuration

• facilitates faster response to security incidents

  security concerns:

• increases network complexity

control plane of network

responsible for making routing and switching decisions

data plane of network

responsible for carrying out the instructions of the control plane

VXLAN protocol

builds overlay networks that operate at layer 2 using layer 3 equipment

transmission media

allows digital information to be sent over a distance

-ex: cables

ethernet cables

transmit electricity over copper wires

fiber optic cables

transmit light over strands of glass

wifi communications

use radio waves instead of physical media

Li-Fi

replaces the radio waves of WiFi with light

private IP range

• Class A- 10.0.0.0 to 10.255.255.255

• Class B- 172.16.0.0 to 172.31.255.255

• Class C- 192.168.0.0 to 192.168.255.255

public IP range

• 1.0.0.0 – 9.255.255.255

• 11.0.0.0 – 126.255.255.255

• 129.0.0.0 – 169.253.255.255

• 169.255.0.0 – 172.15.255.255

• 172.32.0.0 – 191.0.1.255

• 192.0.3.0 – 192.88.98.255

• 192.88.100.0 – 192.167.255.255

• 192.169.0.0 – 198.17.255.255

• 198.20.0.0 – 223.255.255.255

role based access

• authentication server provides additional user information

• authenticator places user on a role appropriate network based upon that info

network access control (NAC)

intercepts network traffic coming from unknown devices and verifies that the system and user are authorized before allowing further communication

NAC posture checking

• Verifying

• antivirus software presence

• validating current signatures

• ensuring proper firewall configuration

• verifying presence of security patches

NAC implementations

• agent based

• agentless

• inline

• out of band

Remote Dial IN User Service (RADIUS)

• offers centralized approach to network and application authentication

• RADIUS client is usually an application server

• disadvantages include uses UDP, does not encrypt everythings

TACACS+

cisco proprietary

• similar to radius

• uses TCP and encrypts full session

shadowed firewall rules

occur when a rule base contains a rule that will never be executed because of its placement in the rule base

promiscuous firewall rules

allow more access than necessary

orphaned firewall rules

allow access to decomissioned systems and services

router access control list

restricts network traffic

standard router ACL

perform filtering based upon source IP address

extended router ACL

blocks traffic based upon more advanced criteria, such as source and destination IP addresses, source and destination ports, and the protocols used for communication

firewalls vs routers

• firewalls are purpose specific and efficient. They have advanced rule capabilities, and offer advanced security functionality

• placing ACLs on routers may reduce burden on firewalls

VLAN pruning

limit unnecessary exposure of VLANs by limiting the number of switches where they are trunked, especially for sensitive VLANs

VLAN trunk negotiation

deny the use of automatic VLAN trunk negotiation to limit the effectiveness of VLAN hopping attacks

port security

limit the devices that may connect to a network swithport by MAC address

2 modes:

• static- administrators manually configure valid MAC addresses for each port

• dynamic- switches memorize the first MAC address they see on each port and limit access to that address

DHCP snooping

blocks malicious DHCP traffic

SYN flood

fill connection state tables on firewalls with half open connection entries

MAC flood

fills switch’s MAC address table with many entries, causing it to flood traffic on all ports

flood guard technology

protects network devices against flood attacks

works by controlling the number of open connections

routing loops

allow broadcast storms. occurs when there are multiple physical paths between two network devices and they mistakenly begin routing broadcast traffic in a redundant fashion

spanning tree protocol (STP)

• prevents routing broadcast storms by implementing loop prevention

• BPDU guards block malicious traffic