Architecture · Topic 6 of 6

Management Plane and Data Plane Security

Secure the management plane with AAA, TACACS and REST API controls, and the data plane with uRPF, ACLs, RTBH and MACsec, plus traceback and DDoS response.

  • 6 min
In a nutshell
  • TACACS+ uses TCP and encrypts the whole body. RADIUS encrypts only the password.
  • TACACS+ can authorise each command.
  • A REST API needs HTTPS, authentication and role based authorisation.

What it is

The management plane is how people and tools reach the router, and the data plane is the traffic the router forwards.

Both need protection. Management access must be limited to the right people and recorded. The data plane must stop spoofed, unwanted or attack traffic, and it can encrypt traffic on a link.

Admin or scriptlogin or API callAAA and TLSRoutermanagement planeforwardsData trafficchecked by uRPF and ACLsent toNext hopMACsec on link

How it works

Each control covers one risk: who may log in, what may be sent, and who may read the link.

AAA and TACACS+

AAA means authentication (who are you), authorisation (what may you do) and accounting (what did you do). A central server holds the users, so one change applies to every router.

TACACS+ uses TCP port 49 and encrypts the whole body of the packet. It separates the three AAA functions, so it can authorise each command.

RADIUS uses UDP and encrypts only the password. TACACS+ is the usual choice for device administration.

Router(config)# aaa new-model
Router(config)# tacacs server TAC1
Router(config-server-tacacs)# address ipv4 192.0.2.50
Router(config-server-tacacs)# key SECRET
Router(config)# aaa authentication login default group tacacs+ local
Router(config)# aaa authorization exec default group tacacs+ local
Router(config)# aaa accounting commands 15 default start-stop group tacacs+

The local keyword at the end of each line is a fallback if the server cannot be reached. That is IOS XE syntax. IOS XR uses a similar model with aaa group server tacacs+.

REST API security

A REST API on a router is another door into the management plane. Protect it as you would a login.

  • Use HTTPS only, so that credentials and data are encrypted.
  • Authenticate every request, with a token, a password or a client certificate.
  • Authorise by role, so that a monitoring account cannot change configuration.
  • Limit which source addresses can connect.
Router(config)# no ip http server
Router(config)# ip http secure-server
Router(config)# restconf

These are IOS XE commands. Other platforms use different ways to enable and secure their APIs.

Traceback and DDoS

A DDoS attack sends enough traffic to exhaust a link or a service. Attackers often spoof source addresses, so you cannot trust the source in the packet.

Traceback finds the real entry point of such traffic. You follow it hop by hop from the victim, using flow records or ACL counters, until you reach the edge router where it enters.

Typical responses are:

  • Drop the traffic with RTBH.
  • Filter it with BGP flowspec rules.
  • Rate limit it at the edge.
  • Stop spoofed sources with uRPF.

uRPF

Unicast reverse path forwarding (uRPF) checks the source address of each packet against the routing table. A packet with an unreachable source is dropped.

ModeCheckRisk
StrictSource must be reachable through the receiving interfaceCan drop valid traffic on asymmetric paths
LooseSource must exist in the table through any interfaceWeaker, but safe with asymmetric routing
Router(config-if)# ip verify unicast source reachable-via rx
Router(config-if)# ip verify unicast source reachable-via any

The first is strict mode and the second is loose mode. On IOS XR the keyword is ipv4 verify unicast source reachable-via, with the same rx and any choices.

ACLs

An infrastructure ACL on the network edge permits only the traffic that should reach router addresses, such as BGP from known peers. An anti-spoofing ACL blocks packets that claim to come from your own address space.

RP/0/RP0/CPU0:PE1(config)# interface GigabitEthernet0/0/0/0
RP/0/RP0/CPU0:PE1(config-if)# ipv4 access-group EDGE_IN ingress

RTBH

Remotely triggered black hole filtering drops attack traffic at the edge by routing it to a discard route. A trigger router advertises the victim address through BGP with a next hop that every edge router points to Null0.

Trigger(config)# ip route 192.0.2.1 255.255.255.255 Null0
Trigger(config)# ip route 203.0.113.10 255.255.255.255 Null0 tag 666

These commands are IOS XE. A route map then matches the tag, sets the next hop to 192.0.2.1 and redistributes it into BGP. Each edge router now drops traffic for the victim.

This is destination based RTBH: the victim loses its traffic too, but the network survives. Source based RTBH drops by attacker address and needs loose uRPF.

Trigger routertag 666 routeBGP next hop 192.0.2.1Edge routerdiscard routedropsAttack trafficto victim address

MACsec

MACsec (IEEE 802.1AE) encrypts Ethernet frames on a single link, hop by hop. It adds a security tag and an integrity check, and it uses AES in GCM mode.

Keys are managed by MKA, the MACsec Key Agreement protocol. Because it works at Layer 2, MACsec protects traffic on the link whatever protocol runs above it.

What to remember for the exam

Seven facts cover most questions on this topic.

  • TACACS+ uses TCP and encrypts the whole body. RADIUS encrypts only the password.
  • TACACS+ can authorise each command.
  • A REST API needs HTTPS, authentication and role based authorisation.
  • Strict uRPF checks the receiving interface. Loose uRPF checks that any route exists.
  • Use loose uRPF where routing is asymmetric.
  • RTBH advertises the victim address with a next hop that the edge routers route to Null0.
  • MACsec encrypts one link at Layer 2, and MKA handles the keys.
Exam tip

Source based RTBH needs loose uRPF, because loose uRPF drops packets whose source address routes to Null0.

Common mistakes

These four mistakes appear often.

Using strict uRPF on multihomed links. Return paths can differ, and valid packets are dropped.

Leaving the local fallback out of AAA lines. If the server is down, nobody can log in.

Expecting MACsec to protect traffic end to end. It protects one link only, and each hop decrypts and encrypts again.

Leaving plain HTTP enabled next to RESTCONF. Credentials can then cross the network in clear text.

Watch out

Keep a console path and local login before testing AAA changes. A bad AAA policy can lock you out of every router.

Check yourself

Work through these three questions.

  • How does TACACS+ differ from RADIUS in protection?

    TACACS+ encrypts the whole packet body, while RADIUS encrypts only the password.

  • Why can strict uRPF break valid traffic?

    It requires the source to be reachable through the receiving interface, so traffic on an asymmetric path is dropped.

  • What does MACsec protect?

    It encrypts Ethernet frames on a single link, hop by hop, with MKA managing the keys.

Topic 6 of 6 in Architecture

Test yourself on Architecture

The full Cisco CCNP 350-501 SPCOR question bank has 738 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.