Explain MPLS technology could take several entries. Therefore I'm just going to make a brief summary of some of the most important refresher for those who already know. For the rest I suggest you you read any of the following references:
- MPLS Fundamentals: A Comprehensive Introduction to MPLS Theory and Practice. Luc De Ghein. Cisco Press.
- Advanced MPLS Design and Implementation. Vivek Alwayn. Cisco Press.
MPLS technology ( RFC 3031) is an IETF open standard technology that basically fits " tag switching, Cisco's proprietary system and stressed against the IP Switching, similar technology proposed by Ipsilon Networks but restricted to the ATM architecture.
is a technology for transporting data at MAN and WAN network belonging to the family of technologies based on packet switching. It also provides a shuttle service oriented data access through the creation of virtual circuits, prior to transport information. A level OSI model of communications is located between the link level and network level, so we can talk about a fictional level 2.5. The core of this technology is that packet forwarding is done based on some labels that are included in the protocol header. These labels are changing jump to jump and define a path (LSP) has been calculated in advance by the network nodes based on predefined criteria called FEC (ie traffic destined for a network with a range of requirements of high service quality). Note the difference with traditional IP transport, in which the control plane and data plane are intertwined. The tags define the way and are distributed based on a protocol for the exchange of labels ( LDP, RSVP-TE , MP-BGP, etc.).
MPLS technology is being adopted by most Internet service providers (ISP) allowing them to reduce costs in the operation of the network and offer their customers SLAs with QoS real commitments , which is becoming a real need with the introduction of the VoIP business. The reduction in operating costs is because MPLS allows multiple services to offer virtually transport (Ethernet, ATM, FR, HDLC, PPP, etc.) With a single network, so it is no longer necessary to maintain and configure equipment different networks, with a corresponding reduction in specialist staff involved. This feature of MPLS is known for AToM (Any Transport Over MPLS). However, at present its peak comes from the hand of another service, virtual private network (VPN) and security will be in the service in which the input focus.
Some terms that are central to understanding what will be listed below. Each contains a hyperlink to the definition.
- PE router (Provider Edge Router) or E-LSR (Label Switching Edge Router) Router
- P (Provider Router) or LSR (Label Switching Router)
- Label Switched Path (LSP )
- Forwarding Equivalent Class (FEC) Virtual
- Routing and Forwarding Instance (VRF)
- Route distinguised (RD)
Before discussing the security of virtual private networks based on MPLS technology is essential to have a high-level view of how to provide this service .
Each PE router can be connected to multiple CE routers within the same or different clients. The CE routers are those that interact directly with level three PE routers of the ISP, which give access to the MPLS network. Are therefore non-existence of an MPLS network and do not understand labels, LSP, LDP, VRF, etc. Each PE router maintains a separate routing table for each VPN also of global. That is, if a PE supports the delegations of two different companies keep two separate routing tables, one for each company and the global routing table in which routes are kept inside the MPLS core itself. PE router interface that connects to an EC must have an IP address within the address range of the VPN to which it belongs CE, so that the ISP involved in directing the company to which it serves. This lack of transparency is probably the only disadvantage of MPLS VPN service. Following the explanation, each CE propagates routes (reachability information) from its routing table into the PE (either by IGP or through eBGP) and this in turn propagates to the EC routes that come from other PE, reported in turn by its EC neighbors. Communication PE-PE routing requires a more detailed explanation. This is done by as iBGP routes are exchanged all the VPNs to which the ISP serves. Since two different companies belonging to VPN can opt for the same private address space, you need to find a mechanism to distinguish. This is the goal of RD, which is nothing more than an extension of BGP, which is used when it propagates the routes between PE routers. It is important to note that the P routers, which form the core MPLS network, do not participate in the exchange of VPN routes. These only run one IGP routing protocol among themselves and with the PE to exchange reachability information of the MPLS core, information to be used to distribute labels that allow the forwarding of packets within the core (see below).
Now that we know how to build the routing tables, need to know how to propagate different VPN packets across the network. When a packet arrives at a PE from a CE with a host destination is in a remote delegation, is encapsulated with the corresponding MPLS header. This header also includes two nested MPLS cloud, the deepest identifies the VPN to which it belongs the outer package and allows the network to perform MPLS forwarding the packet to the destination PE. Once the packet arrives at PE right, it removes the outer label and the label is set deeper, which tells which VPN the packet belongs, and hence what interface (and therefore to what CE) to forward the packet. Finally, the EC partner is responsible for getting the package to the destination host. Completed
and this "brief" introduction to MPLS technology we are able to analyze the fundamentals of security VPN service. Assuming we do not have access to equipment MPLS core network (routers PE and P), and from the point of view of an attacker, what more we could be interesting is to see from a VPN to what we do have access (eg, are employees of a company that has contracted a service-based VPN MPLS) can either intercept the traffic and access to computers belonging to another VPN, or build a denial of service to other VPN.
As can be inferred from the explanations above, if the attacker whether in a branch office located within a particular VPN, when you want to access another delegation just see that your traffic is a route that passes IP at least four different jumps (EC-PE-PE-CE), the first jump the default GW. This default GW is actually the EC of its delegation which communicates with a virtual router, known as VRF MPLS terminology, and that is just the route table associated with the VPN and packet forwarding instance associated . As we know, both are included in the PE router.
Thus, the first option that can happen to us to try to access a different VPN would send packets encapsulated with a MPLS header which in turn will incorporate appropriate tags. These labels, because they are not known a priori, could be determined through trial and error. Thus, if we were not interested in a specific target but indiscriminately reach other VPN client ISP, could serve perfectly. However, the RFC states that when you get a MPLS packet through an interface associated with a CE, it is discarded automatically. Enno Rey, in a presentation made at the Blackhat a couple of years ago, said he had checked with Cisco routers and in all cases was verified compliance with the RFC.
Another possible attack would take an incorrect implementation of the connections to CE-PE level. Imagine for a moment that two CE belonging to different VPNs are connected to respective virtual interfaces that are actually the same physical interface. Suppose further that the links from the PE focus on a switch before connecting against PE using VLAN technology . Could not make an attack on the VLANs (for example with Yersinia ) if you commit the CE router in order to finish accessing the VPN client from another ISP? In these cases it is best to implement separate physical links PE-CE.
also desirable that the interfaces of PE routers that connect to incorporate EC ACLs that only allow traffic routing. Any additional services could be exploited by an attacker to gain access to the PE router (remote login, tft for loading configurations, etc.).
regard to denial of service, what better way to let a delegation alone knock out the EP that lets you communicate with other delegations. How to do it, then taking advantage of the only service that should be accessible, some dynamic routing protocol that runs between our EC and EP. Imagine that flooded the EP with a number of routes invented and that change every few minutes. If the router is not configured properly, we will flood your memory and bring the CPU to 100% leaving it unusable for the rest of VPNs to which they served.
Source: http://blog.s21sec.com
0 comments:
Post a Comment