IP network security
This domain covers protecting the router and the services it delivers: filter policies, CPM protection, management access control, routing-protocol hardening, and encryption at Layer 2 and Layer 3.
Core rules
- Filter policies (
config>filter>ip-filter,ipv6-filter,mac-filter) are applied to SAPs, network interfaces or CPM. Entries match fields and have actions (drop, forward, NAT, remark). - The CPM filter protects the control plane: permit management sources, drop the rest, and rate-limit ICMP/ARP where appropriate.
- Management access: SSH only, strong authentication via TACACS+ or RADIUS, per-user profiles, and restricted source addresses on
config>system>security. - uRPF (strict or loose) blocks spoofed source addresses on ingress.
- BGP hardening: max-prefix limits, TTL security (GTSM), TCP-AO or MD5, RPKI origin validation, and prefix filters.
- IPsec protects IP traffic; MACsec protects Ethernet links hop by hop.
Worked example
A PE terminates eBGP from a customer. Configure max-prefix 1000 with a shutdown threshold, enable ttl-security so BGP packets arrive with TTL 255, apply an import prefix filter allowing only the customer's registered space, and enable RPKI to mark invalid origins. An attacker announcing a more specific prefix is rejected by the prefix filter; a spoofed-source attack on the link is dropped by strict uRPF on the customer interface.
Traps
- Applying a filter to the wrong direction or context (SAP ingress vs. network egress).
- Locking yourself out by dropping SSH in the CPM filter without an exception for your management subnet.
- Relying on MD5 alone; it is weak and being replaced by TCP-AO.
- Forgetting that uRPF strict breaks asymmetric routing.
- Confusing MACsec (link) with IPsec (end-to-end IP).