In assessing switch management and security, we sought to answer three questions: Did devices follow current best practices by default? Could users configure switches to follow these best practices? And could switches be wiped clean of any sensitive information before being taken out of deployment?
The “wipe clean” question stems from regulatory requirements in a growing number of industries. For example, NIST, the U.S. government’s standards body, and the credit card industry’s Payment Card Industry Data Security Standard (PCI DSS) both require the deletion of any personally identifiable information before disposal.
We assessed reset capabilities by deleting the startup configuration file of each switch after putting it through performance and security tests. For all but the Alcatel-Lucent, Extreme and HP switches, that was enough to wipe the systems clean. HP’s ProCurve switch stores passwords separately in flash memory, but these can be deleted through use of front-panel buttons. The procedure is documented, and HP also says it’s moving toward inclusion of encrypted passwords in the switch configuration file.
The Alcatel-Lucent and Extreme switches both retain passwords even after a factory reset. In addition, Extreme’s Summit X450 also retains the private SSH key, which could allow an attacker to pose as an authorized device even after the switch has been retired.
We also determined which management methods were enabled by default, and which would need to be enabled or disabled by network managers (see Management and Security Methods table).
These best practices include disabling insecure management methods such as telnet (supported out of the box over IPv4 by all switches by default), Web and SSHv1. Best practices mean accessing the switch only through secure means such as SSHv2 and/or Secure-HTTP and also logging switch events to a syslog server (a requirement under many enterprise security policies).
Cisco’s Catalyst 3750E adhered the closest to security best practices. However, it supports telnet by default, as do all other switches. Also, when enabling SSH the Catalyst supports the insecure Version 1 of that protocol (although SSHv1 can be disabled via an additional command).
In general, management over IPv6 isn’t as solid as over v4. Two switches, from Dell and HP, didn’t support IPv6 management on their default VLANs in our tests, although HP says it’s currently shipping 13.x software that does support IPv6 on the default VLAN. Also, there were a couple of cases where options offered with IPv4 weren’t available over IPv6. We were unable to configure syslog over IPv6 on the Cisco Catalyst or Extreme Summit X450. And the Extreme switch didn’t support Web or SSL-based management over IPv6.
As with multicast and 802.1X, IPv6 support is relatively new in many switches, and support for all features is far from complete. For network managers considering IPv6 deployment, it’s not enough to consider whether a switch will forward IPv6 packets; supporting management over IPv6 is critical as well.
Sharp-eyed readers will notice we haven’t covered SNMP management over either IPv4 or IPv6. Problems with our test bed setup prevented us from completing SNMP verifications; however, SNMP support is covered in our features section.
Storm control
Tools to block DoS attacks, once the exclusive purview of intrusion-detection/prevention systems, are now included in most switches’ security arsenals. While all switches we tested can classify and block malicious traffic in some way, there are differences in the depth of coverage.
At a high level, “storm control” takes two forms: Rate-controlling traffic and blocking specific attacks. Rate control in turn may be divided into separate commands for throttling unicast, broadcast and multicast traffic, though not all switches support this. For example, it may be desirable to set one drop threshold for unicast traffic (TCP SYNs, say, to block a SYN flood attack) and another threshold for broadcasts (perhaps to avoid overwhelming the switch’s CPU).
All switches offer the ability to throttle traffic. The D-Link 3650’s rate controls are limited to broadcast and multicast traffic, while the Extreme Summit X450’s rate controls specifically target CPU-bound packets. Dell’s PowerConnect 6248 Web-based GUI appears to allow rate control over only one class of traffic at a time (unicast, broadcast, or multicast) but in practice different classes with different thresholds can be defined by issuing multiple commands. The other switches (and the Dell PowerConnect’s CLI) all support individual commands for throttling different traffic classes.
Attack signature detection varied widely among switches. Some devices – such as those from Alcatel-Lucent, Dell, Extreme and Foundry – include signatures for anywhere between two (Foundry) and 29 (Extreme) well-known forms of attack, and to drop these packets HP’s ProCurve 3500 uses an anomaly-based approach it calls “virus throttling” to detect and block malicious traffic. Foundry’s X448 also has hooks that tie into external monitoring tools, such as SFlow monitors or a Snort IDS, that will drop frames when traffic matches a given signature.
No spoofing allowed
Some switches also support antispoofing mechanisms targeting DHCP, ARP and even plain-vanilla IP traffic.
All switches support DHCP snooping (D-Link calls this DHCP server dynamic binding), which sets up a binding between an authorized DHCP server’s IP and MAC addresses. This helps prevent clients from receiving bogus addresses from a rogue DHCP server.
The Cisco and Foundry switches support IP source guard, which is conceptually similar to DHCP snooping. Here, the switch blocks all traffic until it sees a valid DHCP conversation. Then it will allow traffic only from that IP-MAC binding. This helps prevent some man-in-the-middle attacks where an intruder spoofs a source IP address.
The Cisco, Extreme, Foundry and HP switches also support “dynamic ARP inspection,” which will drop any packet with previously unseen IP-MAC bindings. This is useful in preventing some man-in-the-middle attacks, where an attacker poses as a previously seen station, and redirects traffic through a different switch port using a new MAC address.
Review of 802.1X authentication in switches shows support is all over the map | Next story: For most switches tested, usability comfort zone lies within the CLI >
