CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

Information

The Route Processor (RP) is critical to all network operations because it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Any disruption to the RP or the control and management planes can result in mission-critical network outages.

A DoS attack targeting the RP can result in excessive CPU and memory utilization. To maintain network stability and RP security, the router must be able to handle specific control plane and management plane traffic that is destined to the RP. In the past, one method of filtering was to use ingress filters on forwarding interfaces to filter both forwarding path and receiving path traffic, as well as limiting traffic destined to the device. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grows. Control plane policing increases the security of routers and multilayer switches by protecting the RP from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks, allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the Cisco switch to protect against known types of DoS attacks on the route processor.

Step 1: Configure the default policer rates for all control plane CPU queues and save the configuration.

Device> enable
Device# configure terminal
Device(config)# cpp system-default
Defaulting CPP : Policer rate for all classes will be set to their defaults
Device(config)# end
Device# copy running-configuration startup-configuration

Step 2: View the policy map and verify the correct policer rates are set according to organization-defined standards.

show policy-map control-plane

Step 3: Change any policer rates to match the organization-defined standards.

Note: Starting from Cisco IOS XE Fuji 16.8.1a, the creation of user-defined class-maps is not supported. A user can only enable/disable a CPU queue or change the policer rate of a CPU queue.

Item Details

Audit Name: DISA Cisco IOS XE Switch RTR STIG v3r2

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Plugin: Cisco

Control ID: 01b9284ae5dd03b2942a6c282a4f44e29ecc2c2f30de0a17a2f78bd4f90a6e83

Detections

Analytics

CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

Information

Solution

See Also

Item Details