2009 srs 07 layer2attacks - cursuri automatica si...
TRANSCRIPT
Whatthislectureisabout:
Securinghostsinsideanetwork Hosts&servers
Switches
IPphones SANs
Layer2aGacks Onthenetwork Onitsdevices
2
Securing“inside”and“outside” Youknowaboutsecuringtheperimeterofanetworkagainstoutsidethreats: ACLs(normal,reflexive,dynamic)
CBAC
ZPF TCPintercept
IDS/IPS:NIPS
Internalthreatsarethere,too. Howwellcanyoucontrolwhoaccessesyourinternalnetwork?
4
Overviewofendpointsecurity So\warehasweaknesses(people,too). People_using_so\wareissomethingyoucansecureuptoacertainlimit. Trustworthinessofyourso\wareANDuserscanbeimprovedby:
Hardeningsecurity
Restric_ngaccesstounneededfeatures
Blockingaccesstovulnerablefeatures
5
Big‐picturestrategyforendpointsecurity NAC(NetworkAdmissionControl)
Asolu_onthatrequireseveryendpointtocomplywithcompanypolicies.
Non‐compliantendpointsaredeniedaccess.
Endpointprotec_on HIPSdon’tlie…
…butprotectagainstworms,viruses,trojans
ImplementedusingCSA(CiscoSecurityAgent)
ComplementedbyIronPortPerimeterSecurityAppliances
Networkinfec_oncontainment BeforestoppinganaGack,containmentinrequired
Mustbeanautomatedprocess
ImplementedasaNAC,CSAorIPSservice
6
Opera_ngsystemsecurity Protec_nganendpointisprotec_ngitsservicesandapplica_ons.
Ul_mately,anopera_ngsystemhasfullaccessoverahost.
Protec_ngtheopera_ngsystembecomesapriority.
OS’eshavebasicsecurityfeatureslike: Processes–independentaddressspaces
Privileges–execu_onmustbemadefromauseraccountwithsufficientprivileges.
Leastprivilegeconcept Appliestoprocessesandusers,aswell.
7
Gainingaccess:directlyandindirectly Securitymustbeviewedfromanetworkperspec_ve,too.
Hostshaveprivilegesandcanbe“trusted”,too.
8
Strategy:NAC–NetworkAccessControl NACprovidesseveralfeaturesinordertoenforceanetworksecuritypolicy: Authen_ca_onandauthoriza_on
Evalua_ngaforeigndeviceagainstthepoliciesofthenetwork
Quaran_ningofnoncompliantsystems Remedia_onofnoncompliantsystems
9
Strategy:NAC–NetworkAccessControl
Purpose:ensurethatonlyauthen_catedandpolicy‐complianthostsaregivenaccesstothenetwork. Protectsagainstforeigndevicessuchaslaptops,PDAs,smartphones.
Notonly“guest”devices,butalsodevicesfromyourcompanythathavegoneoff‐siteandmighthavebecomeinfected.
Thesedevicescaninfectanetworkfrominsidetheperimeter. NetworkIntrusionPreven_onSystem(NIPS)doesn’thelphere
10
CiscoNAC CiscoimplementsNACintwologicalmodels:
NACframework Distributedsolu_on,forlargenetworks,manynetworkconnec_onsandmanyendpoints.
Suitedforremoteaccesssolu_ons,too.
NACappliance Simplifiedsolu_on,self‐contained
An_‐virusandvulnerabilityupdates
CanbeusedonanyCiscoplamorm
Turnkeysolu_on
11
CiscoNACframework–distributedsolu_on Severaldevicesenforcingdifferentsecuritypolicies.
12
AAA Server Credentials
RADIUS
Credentials
HTTPS
Access Rights Comply?
Vendor Servers
Policy Server Decision Points and Remediation
Credentials
EAP/UDP,
EAP/802.1x
Notification
Hosts Attempting Network Access
Enforcement
CiscoNACappliance
13
CiscoNACcomponents: NAS(NACApplianceServer)
Storesnetworksecuritypolicies
Performsdevice‐compliancechecks
NAM(NACApplianceManager) Administra_oninterfaceusedbysupportpersonnel
Allowsconfigura_onofNAS
NAA(NACApplianceAgent) Clientso\ware,runsonendpointmachines
Read‐onlyrightsovertheopera_ngsystem
Performsconstantdeepinspec_onandanalysis
HowdoesCiscoNACappliancework?
14
THE GOAL
Intranet/ Network
Cisco NAS
Cisco NAM
Authentication Server
M G R
Quarantine Role
Host attempts to access a web page or uses an optional client.
Network access is blocked until wired or wireless host provides login information.
1
Host is redirected to a login page.
Cisco NAC Appliance validates username and password, also performs device and network scans to assess vulnerabilities on device.
2
The host is authenticated 3
Device is noncompliant or login is incorrect.
Host is denied access and assigned to a quarantine role with access to online remediation resources.
3aDevice is “clean”.
Machine gets on “certified devices list” and is granted access to network.
3b
Strategy:IronPort AcquiredbyCiscoin2007. Leadingproviderofan_‐spam,an_‐virus,an_‐spywareappliances.
C‐series:e‐mailsecurity,virusandspamcontrol
S‐series:websecurity,an_‐spyware,an_‐malware
M‐series:e‐mail,webandorganisa_on‐specificpolicies
15
Strategy:IronPortcombinedfunc_onality
16
Web Proxy
Antispyware
Antivirus
Antiphishing
URL Filtering
Policy Management
Firewall
Users
Before IronPort
Internet
Firewall
Users
IronPort S-Series
After IronPort
Internet
HIPSsolu_on:CiscoSecurityAgent(CSA) CSA–HIPSsolu_onprovidingendpointsecurity
Installsondesktopandserversystems
Onemagementconsolefor>100.000clients:scalable
Components: ManagementcenterforCSA
Administra_veinterface,allowsdefini_onofgroupsandpolicies
Maintainslogsforalertssentbyclients
CiscoSecurityAgent Installedonhostsystem
Con_nousmonitoringofapplica_onsandtheopera_ngsystem
17 Management Center for Cisco Security Agent with Internal or External Database
Security policy
Server Protected by Cisco Security Agent
Administration Workstation
Events Alerts
SSL
CSAfunc_onality Whenapplica_onsrequiresystemresources,theymakeanopera_ngsystemcalltothekerne.
CSAinterceptssystemcallsandcomparesthemtothesystempolicy.
Iftherequestviolatesthepolicy: CSAblocksit
Sendsanappropriateerrormessagetotheapplica_on SendsanalerttotheManagementCenter
18
opera_ngsystemcall kernel
CSAinterceptfeature CSAinterceptsopera_ngsystemcallsusingfourspecializedinterceptors: Filesysteminterceptor:read/writerequeststoallfilesystems
Networkinterceptor:inspectsnetworktraffic;canforcelimita_onstoprotectfromDoSaGacks
Configura_oninterceptor:read/writerequeststotheopera_ngsystem’sconfigura_on(liketheregistry)
Execu_onspaceinterceptor:protectsthedynamicrun_meenvironment Blocksrequeststomemorythatisnotownedbyanapplica_on
19
CSAsecurityfeatures CSAenablesprotec_onagainstallphasesofanaGack:
20
ProbephasePingscansPortscans
TransferexploitcodetotargetPenetratephase
InstallnewcodeModifyconfigura_on
Persistphase
AGackothertargetsLeverageotherhosts.
Propagatephase
CrashsystemErasefilesStealdata
Paralyzephase
Thissec_onwillcover: Layer2aGackmethods:
MACaddressspoofing
STPmanipula_on MACtableoverflow
LANstorms
VLANaGacks
Also,aliGlebriefrecapoftheLANtechnologiesmen_onedabove.
22
Switchednetworks Ahubisanintermediarydevicethatforwardsdatatoallportsexcepttheoneitwasreceived.
Switchesop_mizethisbehaviour: Theyforwarddataonspecificports,basedondes_na_onMACaddresses.
So,switchesmustlearnonwhichportiseachMACaddresslocated.TheCAMmemorystoresthesemappings.
HowdoesaswitchlearnaboutMACaddresses?
CanaswitchlearnaMACaddressonmorethanoneport?
CanaswitchlearnmorethanoneMACaddressperport? Giveanexample.When?
24
MACspoofing ThewayswitcheslearnMACaddressesisavulnerabilitybyitself.
HostscanuseanotherMACaddresstoimpersonateanotherdeviceand“fool”theswitch. TheswitchreceivesframeswiththespoofedMACaddress.
Itlookatthesourceaddressandlearnsitonadifferentport. TheswitchupdatesitsCAMtableandmapstheoldMACaddressonthenewport.
Framesdes_nedtothetargesthostarenowsenttotheaGackinghost.
25
MACaddresstableoverflowaGack AswitchstoresMAC‐portmappingsinitsCAMmemory.
Which,ofcourse,islimited…
Floodingaswitchwithmanyfake(spoofed)sourceMACaddresseswillfillupthismemory. Havingitsmemoryfull,theswitchcannotlearnnewMACaddresses.
Whatdoesaswitchdowhenitdoesnothavethedes_na_onMACaddressinitsmemory?(whatwouldYOUdo?)
Theswitchwillstartac_nglikeahub. AnyaGackerwillbeabletosnifftrafficbetweenanytwohostsinthenetwork.
27
STPquickrecap STP=SpanningTreeProtocol
AProtocolthatSpansTreesoveryourlocalnetwork
TheMACaddresslearningmethodusedbyswitchesdoesnotworkifthereisaloopinthenetwork.
Also,loopsinaLANcancause: Datacyclingindefinitelyintheloop
MACaddresstableinconsistency
STPcreatesaloop‐freetopology(atree)coveringallyourswitches.
Trafficwillflowonlyonthetree’slinks.
28
STPfacts SwitchesinSTParecalled“bridges”.
Arootbridgeiselectedbasedon: Lowestconfiguredpriority
Iftheaboveareequal,thelowestMACaddressisthe_ebreaker(now,ifTHOSEareequalyou’vegotbiggerproblems…)
STPshutsdownswitchportsinordertocreatealoop‐freepath.
Incaseoffailures,closedportswillbeopenedagain. Thus,ensuringredundancy.
29
Rootbridge
STPmanipula_onaGacks Theelec_onprocessfortherootbridgeiscarriedoutusingBPDUs ABPDU(BridgeProtocolDataUnit)isasmallpieceofdataexchagedbetweenadjacentswitchesevery2seconds.
ItcontainsrelevantdataforSTPelec_onadstability.
SendingfalseBPDUscanchangethelogicaltopologyofthenetwork. AGackerscansendfalseBPDUstomakethemselvestherootbridgesandtobeabletoreceivealltraffictraversingthenetwork.
30
LANstormaGack Broadcastsarevitalforanetworktofunc_onproperly.
Exampleprotocols:ARP,DHCP
Butfloodinganetworkwithbroadcasttrafficdegradesnetworkperformance.
Broadcaststorm:floodingthenetworkwithexcessivebroadcasttraffic. Whyisthispossible?
Becauseswitchesforwardbroadcastsoutonalltheirports.
32
Mi_ga_ngLANstorms
Broadcastscannotbeelliminatedfromthenetwork.
Solu_on:Stormcontrol(trafficsuppression) Monitorsunicast,mul_castandbroadcasttrafficonaninterface
Comparestheamountoftraffictoapredefinedthreshold.
Ifthenumberofincomingpacketsistoohigh,trafficisblocked. Stormcontrolublockstraffica\eraperiodof_me.
33
VLANsandVLANaGacks AVLAN(VirtualLAN)isalogicalbroadcastdomainwithinaswitchednetwork. Mul_pleVLANsappearasdifferentsubnets.
Allowsegmenta_onoftheLANwithoutusingrouters.
HostscannotcommunicatebetweenVLANswithoutarou_ng‐capabledevice(router,layer3switch).
VLANsareasimplewaytosecurelyisolategroupsofhostsinsideaLAN.
AGemp_ngtogainaccesstoanotherVLANisatypeofaVLANaGack.
34
VLANextensibility VLANsarenotrestrictedtoasinglegeographicalloca_on.
Inter‐switchlinksthatcarrymorethanoneVLANsarecalledtrunklinks. Commontrunkingprotocol:IEEE802.1q(“dot1q”)
PortsthatconnecthoststoasingleVLANarecalledaccessports.
35
VLANhoppingaGacks End‐users(theirhosts)arealwaysmembersofasingleVLAN.
AccessinganotherVLAN,otherthantheoneassignedtoyourswitchport,iscalledVLANhopping.
Method:establishyourowntrunklinkwiththeswitch. ThetrunklinkcantransportanyVLAN
DTP(DynamicTrunkingProtocol)isac_vebydefaultandwillautoma_callynegociateatrunkwhenpossible.
36
802.1Q
Server Attacker sees traffic destined for servers
Server
Trunk
VLAN 20
VLAN 10
VLANhoppingmi_ga_on Solu_on:
DisableDTPonportsthatdonotrequiretrunking. Negocia_onofatrunkwillnotbepossibleanymore.
Preferably,manuallyenabletrunkingwhereneeded.
Unwantedtrunklinkscanbecreatedusing: AhostthatactslikeaswitchandsendsDTPnegocia_onframes.
Anormalswitch,ownedbytheaGacker.
37
Trunksandna_veVLANs Whenpassingoveratrunk,aframemustretainitsVLANinforma_on. SothattheendswitchwillknowtowhichVLANitbelongsto.
“Tagging”aframewithitsVLANinforma_onisdoneusingthedot1qprotocol.
Ifaframedoesnothaveatag,itisconsideredtobelongtothe“na_veVLAN”ofthetrunklink.
38
VLANhopping:double‐tagging
39
Victim (VLAN 20)
Note: This attack works only if the trunk has the same native VLAN as the attacker’s access VLAN.
20
Trunk (Native VLAN = 10)
802.1Q, Frame
Attacker is on VLAN 10 but also puts a 20 tag in the packet
1
The first switch strips off the first tag and does not retag it (native traffic is not retagged). It then forwards the packet to switch 2.
2
The second switch receives the packet on the native VLAN
3
The second switch examines the packet, sees the VLAN 20 tag and forwards it accordingly.
4
Overview
Overviewofthissec_on: Configuringportsecurity
Verifyingportsecurity
ConfiguringBPDUGuardandRootGuard ConfiguringStormControl
41
Portsecurity Portsecurityisafeaturethatallowsyouto:
ConfigurethemaximumnumberofMACaddressesaswitchcanlearnonacertainport.
Sta_callyconfiguretheallowedMACaddresses.
Protectsagainst: Unauthorizedexpansionofthenetwork. Foreignhostsorswitchesbecomingmembersofyournetwork.
AllincomingframesusingunallowedMACaddressesaredropped.
Bydefault…
42
Configuringportsecurity Changingtheinterfacemodetoacces:[access!=trunk]
S1(config)#interface FastEthernet 0/24 S1(config-if)#switchport mode access
Thedefaultmodeonaswitchport(interface)isdynamicauto,whichwilluseDTPtotryanddynamicallynecogiateatrunkonthelink.
Portsecuritycannotbeenabledondynamicautoports.
Ac_va_ngportsecurityontheinterface:S1(config-if)#switchport port-security
SetthemaximumnumberofMACaddressesthatcanbelearnedontheinterface:
S1(config-if)#switchport port-security maximum 3
44
ConfiguringportsecurityMACaddresses
SpecifyingoneormoreMACaddressesthatcanbelearnedontheinterface:
S1(config-if)#switchport port-security mac-address 0026.08de.f22e
Wes_llhaveonlyamaximumof3MACaddressesontheinterface.
ConfiguringoneMACaddressleavestheother2tobedynamicallylearned.
ThefirstMACaddressofasendinghostwillberecorded.
45
Configuringportsecurityac_ons Theac_onthatistobetakenbytheswitchportwhenaninvalidsourceMACaddressisdetectedontheportiscalledviola_on.
Sewngtheviola_onmode:S1(config-if)#switchport port-security violation ? protect Security violation protect mode restrict Security violation restrict mode shutdown Security violation shutdown mode
Sewngtheviola_onmodeisop_onal. Thedefaultistoshutdowntheport.
46
Portsecurityviola_onmodes Protect
Unacceptedpacketsaredropped.
RemovesomesecureMACaddressesorincreasethemaximumallowednumbertoletthempass.
Nono_fica_onsaresent.
Restrict Unacceptedpacketsaredropped.
Samesolu_onasforProtectmode.
SNMPtrapsaresent,syslogmessagesaswell,andtheviola_oncounterincreases.
Suscep_bletoDoSaGacks.
Shutdown Completelyshutsdowntheinterface.
Sendsthesameno_fica_onsasinRestrictmode.
Theportissetintheerror‐disabledstate.
Theporthastobemanuallybroughtup.
47
Witnessinga“shutdown”viola_on Aportshuwngdowna\erreceivingonemoreMACaddressthanthemaximumallowed:
2d17h: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/1, putting Fa0/1 in err-disable state 2d17h: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0019.e792.8321 on port FastEthernet0/1. 2d17h: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down
2d17h: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down
Checkingportstate:SW3(config-if)#do sh ip int brief | incl 0/1 FastEthernet0/1 unassigned YES unset down down
Checkingfortheerror‐disabledstate:SW3#show int fa 0/1
FastEthernet0/1 is down, line protocol is down (err-disabled) Hardware is Fast Ethernet, address is 001a.6cf8.8c01 (bia 001a.6cf8.8c01)
48
Recoveringfroma“shutdown”viola_on DonotaGemptthefollowing:
SW3(config)#int FastEthernet0/1 SW3(config-if)#no shutdown
…asitwillhavethefollowing“effect”:SW3(config-if)#do sh ip int brief | inc 0/1 FastEthernet0/1 unassigned YES unset down down
Err‐disabledstateisnotreallya“shutdown”modeoftheinterface.
Recoverbyshuwngdowntheinterfaceandbringingitupagain:SW3(config-if)#shutdown
SW3(config-if)#no shutdown 2d17h: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
2d17h: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up
49
Or,evenbeGer,automatethistorecovera\er60minutes:SW3(config)#errdisable recovery cause psecure-violation SW3(config)#errdisable recovery interval 60
The“s_cky”ones… DynamicallylearnedMACaddressesarelosta\ertheswitchreloads. Theywillbelearnedagainbutthiscouldbeasecurityrisk.
YoucanmakealldynamicallylearnedMACaddresses“s_cky”. MACaddresseswills_llbedynamicallylearned.
Buttheywillbeautoma_callysavedintherunningconfig.SW3(config-if)#switchport port-security mac-address sticky
Therunning‐configwillautoma_callyinclude:SW3#sh run | include sticky switchport port-security mac-address sticky switchport port-security mac-address sticky 0019.e792.8321
50
Agingportsecurityentries Configuringagingforsta_centries:
SW3(config-if)#switchport port-security aging static
Sewngthenumberofminutesa\erwhichtheentrieswillageout:
SW3(config-if)#switchport port-security aging time 15
Sewngthetypeofaging:SW3(config-if)#switchport port-security aging type ? absolute Absolute aging (default) inactivity Aging based on inactivity time period
Absolute:entrieswillageouta\er15minutes
Inac_vity:entrieswiiagououta\er15minutesofinac_vityfromthespecificMACaddress.
51
VerifyingportsecuritySW3#show port-security Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action (Count) (Count) (Count)
--------------------------------------------------------------------------- Fa0/1 3 3 0 Shutdown Fa0/22 3 1 0 Protect
--------------------------------------------------------------------------- Total Addresses in System (excluding one mac per port) : 2
Max Addresses limit in System (excluding one mac per port) : 8320
Showingalllearnedorconfiguredaddresses:SW3#show port-security address Secure Mac Address Table ------------------------------------------------------------------------
Vlan Mac Address Type Ports Remaining Age (mins)
---- ----------- ---- ----- ------------- 1 0019.e792.8321 SecureSticky Fa0/1 - 1 0025.bcdc.17b6 SecureConfigured Fa0/1 11
1 001b.9035.f118 SecureDynamic Fa0/22 - ------------------------------------------------------------------------
52
PortFast
STPtakes_metoconvergeandgoesthroughseveralstates.
ThePortFastfeaturecanbeenabledonaccesslinkstoavoidSTPcalcula_onsonthem. TheyarenotincludedintheSTPtree,anyway.
53
ConfiguringPortFastglobally
ConfiguringPortFastonallnon‐trunkingportsatonce:SW3(config)#spanning-tree portfast default %Warning: this command enables portfast by default on all interfaces. You should now disable portfast explicitly on switched ports leading to hubs, switches and bridges as they may create temporary bridging loops.
CiscoIOSrarelygivesyousuchlongmessagessoyoushouldprobablykeepitinmind.
54
ConfiguringPortFastatinterfacelevel
EnablingPortFastforaspecificinterface:SW3(config-if)#spanning-tree portfast
%Portfast has been configured on FastEthernet0/1 but will only have effect when the interface is in a non-trunking mode.
ProofthatPortFastcannotworkontrunklinks.55
ConfiguringBPDUguard BPDUguardprotectsthenetworkbyblockingBPDUsonportswheretheyshouldnotbereceived. Thiswaythenetworktopologyremainspredic_ble.
IntruderscannotaltertherootbridgeoftheSTPtree.
AccessportsshouldhaveBPDUguardenabled.
56
ConfiguringBPDUguard BPDUguardisaPortFastfeature.
Bydefault,BPDUguardwillshutdowntheportifaBPDUisreceived.
EnablingBPDUguardgloballyontheswitch:SW3(config)#spanning-tree portfast bpduguard default
Verifying:SW3#show spanning-tree summary Switch is in pvst mode Root bridge for: VLAN0001
Extended system ID is enabled Portfast Default is enabled PortFast BPDU Guard Default is enabled
Portfast BPDU Filter Default is disabled Loopguard Default is disabled
[…output ommited…]
57
Rootguard
AnaGackercansendspoofedBPDUsinanaGempttobecometheroot.
Thedeviceconnectedtotheswitchportcanpar_cipateinSTPaslongasitdoesnottrytobecometheroot.
Rootguardputstheportintheroot‐incosistentstate. Itautoma_callyrecoverswhentheoffendingBPDUsstop.
58
ConfiguringRootguard ConfiguringRootguardontheinterface:
Switch(config-if)#spanning-tree guard root 00:16:27: %SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port FastEthernet0/1.
Rootguardshouldbeconfiguredonportsthatdonotleadtotherootswitch.
Toviewportstatesuse:Switch#show spanning-tree inconsistentports
BTW:sendingBPDUswithapriorityof0doesnotguaranteethatyouwillbecometherootbridge. Someotherswitchesmightexist,with0priorityandalowerMAC
address
59
Configuringstormcontrol Examplescenarionsforconfiguringstormcontrol:
Blockbroadcastpacketsover75.55%oftheinterface’scapacity:
sW(config-if)#storm-control broadcast level 75.55
Blockmul_castpacketsthatgoover5Mbps:sW(config-if)#storm-control multicast level bps 5000000
Configuretheinterfacetoshutdownwheneitherstormcontrolviola_onoccurs:
sW(config-if)#storm-control action shutdown
60
Verifyingstormcontrol Showstormcontrolstatus:
SW3# show storm-control Interface Filter State Upper Lower Current
--------- ------------- ---------- --------- ---------Gi0/1 Forwarding 20 pps 10 pps 5 pps
Gi0/2 Forwarding 50.00% 40.00% 0.00%
<output omitted>
61
MonitoringwithSPAN SPAN=SwitchedPortANalyzer ASPANportmirrorstraffictoanotherport. Monitorstheen_reinterface(port)orasingleVLAN
Monitorsinboundand/oroutboundtraffic
IdealdeploymentforIDSsystems.
Doesnotaffectnormalswitchingopera_on.
62
“Intruder Alert!”
IDS Protocol Analyzer
ConfiguringSPAN–Example1 The“monitorsession”command:
Sewngthesourceinterfacetomonitor:Switch(config)# monitor session 1 source interface gigabitethernet0/1
Sewngthedes_na_oninterface,wheretrafficwillbemirrored:Switch(config)# monitor session 1 destination interface gigabitethernet0/2 encapsulation replicate
The“encapsula_on”parametertellstheswitchtomirrortrafficwhileretainingthesameencapsula_onmethod.
63
ConfiguringSPAN–Example2 ThefollowingexamplemonitorsonlytwoVLANs:
MirroronlyreceivedtrafficonVLAN10:Switch(config)# monitor session 1 source vlan 10 rx
MirroronlysenttrafficonVLAN20:Switch(config)# monitor session 1 source vlan 20 tx
Thedes_na_oniss_llaninterface:Switch(config)# monitor session 1 destination interface FastEthernet 0/1
64
ViewingSPANconfigura_on
Usethe“showmonitor”commandtoviewconfigura_oninfoaboutallmonitorsessions:
#show monitor session 1 Session 1 --------- Source Ports: RX Only: None TX Only: None Both: Fa0/2 Destination Ports: Fa0/3
65
MonitoringwithRSPAN RSPAN=RemoteSPAN SPANmirrorstrafficbetweenportsonthesameswitch. RSPANmirrorstraffictoaportonadifferentswitch.
Thisway,trafficfrommul_pleswitchescanbemirroredtoasingledes_na_on. Mul_pletrafficflowscanbemonitoredatthesame_me.
UsingthesameIDS.
66
R S P A N V L A N
RSPANdeployment
RSPANcanbeusedtomonitortrafficfromseveraldifferentVLANs
67
IDS
Source VLAN
Source VLAN
Source VLAN
ConfiguringRSPAN
CreatetheRSPANVLANonbothswitches:2960-1(config)# vlan 100 2960-1(config-vlan)# remote-span 2960-1(config-vlan)# exit
ConfigureRSPANsourceportsandVLANs:2960-1(config)# monitor session 1 source interface FastEthernet 0/1 2960-1(config)# monitor session 1 destination remote vlan 100
reflector-port FastEthernet 0/2 2960-1(config)# interface FastEthernet 0/2 2960-1(config-if)# switchport mode trunk
ConfigureRSPANtraffictobeforwarded:2960-2(config)# monitor session 2 source remote vlan 100 2960-2(config)# monitor session 2 destination interface
FastEthernet 0/3 2960-2(config)# interface FastEthernet 0/2 2960-2(config-if)# switchport mode trunk
68