IP Network Security
This domain tests hardening and policy enforcement in Nokia IP networks: management-plane protection, AAA, ACLs and CPM filters, uRPF, remote triggered blackhole, 802.1X, MACsec, and IPsec. The emphasis is on applying policy in the correct direction and plane.
Core rules
- CPM filters protect the control/management plane; interface ACLs filter transit traffic.
- Filters are evaluated in order and end with an implicit deny. Direction and match criteria matter.
- Use SSHv2, SNMPv3, and AAA via TACACS+ or RADIUS. Disable insecure management protocols.
- uRPF strict checks that the source is reachable via the incoming interface; loose mode checks reachability only.
- RTBH uses a BGP community to blackhole a host or prefix during an attack.
- MACsec secures Layer 2 links; IPsec secures IP traffic.
Worked example
Only the NOC subnet 198.51.100.0/24 may SSH to the CPM; all other management access must be denied. Create a CPM filter with entry 10 permitting TCP from 198.51.100.0/24 to destination port 22, then entry 20 denying all IP. Apply it ingress on the CPM. Test from the NOC and from an unauthorized subnet. Applying the filter egress does not protect inbound CPM access.
Traps that cost marks
- Forgetting the implicit deny or placing a broad permit before a specific deny.
- Applying a transit ACL to the CPM or vice versa.
- Blocking routing protocols or return traffic with an overly strict filter.
- Confusing uRPF strict and loose behavior.
Key points
- CPM filters protect the management plane.
- Filter order and implicit deny decide the result.
- Use SSHv2, SNMPv3, and AAA.
- uRPF validates source reachability.
- RTBH is a BGP-community blackhole response.