I85PREP
⌘ K
Nokia MPLS study materials
Nokia MPLS study resources

Nokia MPLS: IP network security

Nokia MPLS · Work through your exam, one topic at a time.

All guide sections

IP network security

IP network security

This domain tests hardening and policy on Nokia SR OS: control-plane protection, filters and ACLs, routing authentication, Layer 2 security, and management access.

Core rules

  • CPM filters protect the control plane. They are ingress filters applied to CPM traffic and should default to drop with explicit permits for BGP, IGP, SSH, NTP, and TACACS+/RADIUS.
  • Route authentication: BGP supports TCP MD5 and keychains using SHA-1/SHA-256; IS-IS and OSPF support authentication. Keychains allow rotation.
  • uRPF drops packets with spoofed source addresses; loose mode is used on multihomed links.
  • Management: TACACS+/RADIUS for AAA, SSHv2, SNMPv3, and local fallback; disable Telnet.
  • Layer 2 hardening includes MACsec, DHCP snooping, and port security where supported.

Worked example

A PE peers eBGP with a customer on 192.0.2.1/30. Create a CPM IPv4 filter with default action drop; permit TCP 179 from 192.0.2.1 to local 192.0.2.2; then apply the filter to CPM. Verify that SSH from an unauthorised subnet is dropped and that the BGP session stays up.

Traps

  • A default-drop CPM filter without NTP or TACACS+ permits locks out management.
  • Applying an ACL to a SAP instead of CPM leaves the control plane exposed.
  • MD5 authenticates BGP but does not encrypt it.
  • Forgetting that CPM filters affect all CPM traffic, including management and routing.