Architecture · Topic 5 of 6

Control Plane Security

Protect the control plane with LPTS, CoPP, BGP TTL security, authentication, prefix suppression, LDP security, BGPsec and BGP flowspec on XR and XE.

  • 5 min
In a nutshell
  • CoPP polices traffic sent to the route processor, and it attaches to control-plane.
  • LPTS is the IOS XR protection and works automatically with per flow policers.
  • BGP TTL security expects TTL 255 from a directly connected peer.

What it is

Control plane security protects the routing protocols and the router processor from attack and from mistakes.

The control plane is the part of the router that runs BGP, IS-IS, OSPF and LDP. If an attacker floods it or injects false routing messages, the whole network can fail. The techniques here limit who can talk to the router, how fast, and what routes it accepts.

Outside trafficto router addressesfiltered byLPTS or CoPPrate limitaccepted byRoute processorBGP LDP ISISchecksAuthenticationTTL and keys

How it works

The defences work in layers, from the packet entering the router to the routes it accepts.

Control plane protection: LPTS and CoPP

CoPP (control plane policing) applies a QoS policy to traffic going to the route processor. On IOS XE, you attach a policy to the control-plane interface.

Router(config)# class-map match-all CM_BGP
Router(config-cmap)# match access-group name ACL_BGP
Router(config)# policy-map PM_COPP
Router(config-pmap)# class CM_BGP
Router(config-pmap-c)# police 256000 conform-action transmit exceed-action drop
Router(config)# control-plane
Router(config-cp)# service-policy input PM_COPP

LPTS (Local Packet Transport Services) is the IOS XR method. It builds a table of the flows the router expects, such as BGP sessions to known neighbours, and applies a hardware policer to each flow type. It works with no configuration, and you can adjust the rates.

RP/0/RP0/CPU0:PE1# show lpts bindings
RP/0/RP0/CPU0:PE1# show lpts pifib hardware police location 0/0/CPU0

BGP TTL security and authentication

BGP TTL security (the generalised TTL security mechanism) relies on the TTL of a directly connected peer. The sender sets the TTL to 255, and the receiver drops any packet with a TTL below 255 minus the configured hops. A remote attacker cannot reach that value.

Router(config-router)# neighbor 192.0.2.2 ttl-security hops 1
Router(config-router)# neighbor 192.0.2.2 password SECRET

These are IOS XE commands. The second adds MD5 authentication to the TCP session.

On IOS XR, the neighbour is configured under router bgp and uses ttl-security and password. On recent releases, TCP-AO can replace MD5 with stronger keyed authentication. TTL security cannot be combined with eBGP multihop.

The other protocols have their own authentication. IS-IS and OSPF can authenticate their packets with keys, and LDP can use an MD5 password.

BGP prefix suppression

Prefix suppression means keeping selected prefixes out of routing advertisements, so that infrastructure addresses are not exposed. The name is used loosely, so this page treats it as a group of techniques.

  • Aggregate with summary-only, so that only the summary is sent.
  • Leave link addresses out of BGP.
  • Cap what a neighbour may send you with maximum-prefix, so a leak cannot flood the table.

IGPs have a matching feature, called prefix suppression in OSPF, that hides transit link prefixes.

LDP security

LDP sessions can be authenticated, and labels can be limited.

Router(config)# mpls ldp neighbor 192.0.2.2 password SECRET

That is IOS XE, and the password protects the LDP session with an MD5 digest.

Label allocation filtering makes the router assign labels only to the prefixes you list, such as loopbacks. This keeps the label table small. The command that applies a prefix list or ACL for this differs by platform, so check the platform documentation.

BGPsec and origin validation

BGPsec signs the AS path as it passes between autonomous systems, so a receiver can check that the path is genuine. It uses RPKI keys. It is much less widely used than origin validation, which only checks that the origin AS is authorised for the prefix.

BGP flowspec

BGP flowspec distributes traffic filter rules through BGP. A rule matches on fields such as destination prefix, source prefix, protocol and ports, and it carries an action such as drop or rate limit.

A central point can send one rule to many routers quickly, which is useful for stopping a DDoS attack. Flowspec uses its own address family.

RP/0/RP0/CPU0:PE1(config)# router bgp 65000
RP/0/RP0/CPU0:PE1(config-bgp)# address-family ipv4 flowspec
RP/0/RP0/CPU0:PE1(config-bgp-af)# exit
RP/0/RP0/CPU0:PE1(config-bgp)# neighbor 192.0.2.2
RP/0/RP0/CPU0:PE1(config-bgp-nbr)# remote-as 65000
RP/0/RP0/CPU0:PE1(config-bgp-nbr)# address-family ipv4 flowspec

That is IOS XR. Applying received rules to interfaces needs further flowspec configuration that is not shown.

Controllerdetects attackflowspec ruleRoute reflectorBGP flowspecadvertisesEdge routersinstall filterdrop or limitAttack trafficstopped

What to remember for the exam

Eight facts cover most questions on this topic.

  • CoPP polices traffic sent to the route processor, and it attaches to control-plane.
  • LPTS is the IOS XR protection and works automatically with per flow policers.
  • BGP TTL security expects TTL 255 from a directly connected peer.
  • neighbor A.B.C.D ttl-security hops N is the IOS XE command.
  • BGP and LDP sessions can use a password for MD5 authentication.
  • Label allocation filtering limits which prefixes receive an LDP label.
  • BGPsec signs the AS path, and it is less common than origin validation.
  • Flowspec carries traffic filter rules in BGP and is used against DDoS.
Exam tip

LPTS belongs to IOS XR and CoPP belongs to IOS and IOS XE. Match the feature to the platform before answering.

Common mistakes

These four mistakes appear often.

Using TTL security with multihop peers. The feature needs a directly connected neighbour.

Applying CoPP to transit traffic. CoPP affects only traffic to the router.

Labelling every prefix with LDP. Without filtering, labels exist for routes that never need them.

Assuming BGPsec and origin validation are the same. BGPsec protects the whole path, and origin validation checks only the origin.

Watch out

A CoPP policy that is too tight can drop your own routing protocol packets. Test it with the protocols you use.

Check yourself

Work through these three questions.

  • What does BGP TTL security check?

    The receiver drops packets with a TTL below 255 minus the configured hops, so only a directly connected peer can send valid ones.

  • Which feature protects the route processor on IOS XR?

    LPTS does, with a hardware policer for each flow type.

  • What does BGP flowspec distribute?

    It distributes traffic filter rules, with actions such as drop or rate limit, and is used against DDoS.

Topic 5 of 6 in Architecture

Test yourself on Architecture

The full Cisco CCNP 350-501 SPCOR question bank has 738 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.