HP 6125G HP Networking guide to hardening Comware-based devices - Page 25

25

#

undo ip redirects

#

For more information on the

undo ip redirects

command, see “IP Performance Optimization” in the

Layer-3 IP Services

Configuration Guide

.

Disable or limit IP Directed broadcasts

IP Directed Broadcasts make it possible to send an IP broadcast packet to a remote IP subnet. Once it reaches the remote

network, the forwarding IP device sends the packet as a Layer 2 broadcast to all stations on the subnet. This directed

broadcast functionality has been leveraged as an amplification and reflection aid in several attacks, including the

Smurf attack.

Current versions of HP Comware products have this functionality disabled by default; however, it can be enabled via the

ip forward-broadcast

command.

If a network absolutely requires directed broadcast functionality, its use should be controlled. This is possible using an

access control list as an option to the


command. The following configuration example limits

directed broadcasts to those UDP packets originating at a trusted network, 192.168.1.0/24:

#

acl number 3001

rule 0 permit udp source 192.168.1.0 0.0.0.255

#

interface Ethernet 0/1/0

ip forward-broadcast acl 3001

#

For more information about the


command, see “IP Performance Optimization Configuration” in

the

Layer-3 IP Services Configuration Guide

.

Filtering transit traffic with Transit ACLs

ICMP packet filtering

The Internet Control Message Protocol (ICMP) was designed as a control protocol for IP. As a result, the messages it

conveys can have far-reaching ramifications on TCP and IP in general. ICMP is used by the network troubleshooting tools

ping and traceroute, as well as by Path MTU Discovery; however, external ICMP connectivity is rarely needed for the

proper operation of a network.

HP Comware software provides functionality to specifically filter ICMP messages by name or type and code.

The following example ACL allows ICMP from trusted networks while blocking all ICMP packets from other sources:

#

acl number 3000 name ACL-TRANSIT-IN

#

# Permit ICMP packets from trusted networks only

#

rule permit icmp source <trusted-networks>

#

# Deny all other ICMP traffic.

#

rule deny icmp

#

Section	Page
Introduction	2
Management plane	2
General management plane hardening	2
Password control	2
Disable unused services	4
EXEC timeout	4
Using management interfaces	4
Memory Threshold Notification	5
CPU Threshold Notification	5
Limiting access to the network with infrastructure ACLs	5
ICMP packet filtering	6
Filtering IP fragments	6
Securing interactive management sessions	7
Console and AUX ports	7
Control VTY and TTY lines	8
Warning banners	9
Using authentication, authorization, and accounting	9
Authentication, authorization, and accounting with RADIUS	9
Authentication, authorization, and accounting with HWTACACS	10
Authentication and authorization with LDAP	10
Authentication fallback	11
Redundant AAA servers	11
Fortifying Simple Network Management Protocol	11
SNMP community strings	11
SNMP community strings with ACLs	11
SNMP Views	12
SNMP Version 3	12
Logging best practices	13
Send logs to a central location	13
Logging level	13
Do not log to console or monitor sessions	14
Use buffered logging	14
Configure logging source interface	14
Configure logging timestamps	15
HP Comware software configuration management	15
Configuration Replace and Configuration Rollback	15
Backup configuration file and boot file	15
Configuration change notification	16
Control plane	16
General control plane hardening	16
IP ICMP redirects	16
ICMP unreachables	17
ICMP TTL-expiry	17
Proxy ARP	17
Network time protocol	17
Limiting the CPU impact of control plane traffic	18
Understanding control plane traffic	18
FTP and TFTP ACLs	18
User interface ACLs	18
HTTPS ACLs	19
Control plane protection	19
Rate limiting packets on network management interfaces	19
TCP SYN Cookie and protection against Naptha attacks	19
Securing BGP	20
Generalized TTL Security Mechanism	20
BGP peer authentication with MD5	20
Configuring maximum prefixes	20
Filtering BGP prefixes with prefix lists	21
Filtering BGP prefixes with autonomous system path access lists	21
Securing Interior Gateway Protocols	22
Routing protocol authentication and verification with MD5	22
Silent-interface commands	23
Route filtering	23
Securing Virtual Router Redundancy Protocol	24
Data plane	24
General data plane hardening	24
Disable ICMP redirects	24
Disable or limit IP Directed broadcasts	25
Filtering transit traffic with Transit ACLs	25
ICMP packet filtering	25
Filtering IP fragments	26
Anti-spoofing protections	26
URPF	26
IP source guard	26
Port security	27
ARP Detection	29
Anti-spoofing ACLs	29
Limiting the CPU impact of data plane traffic	30
Features and traffic types that impact the CPU	30
Traffic identification and traceback	30
NetStream	30
sFlow	32
Classification ACLs	33
Access control with VLAN QoS policy and port access control lists	34
Access control with VLAN QoS policy	34
Access control with PACLs	34
Access control with MAC	35
Using private VLANs	35
Isolated VLANs	35
Community VLANs	36
Promiscuous ports	36
Port isolation	37
Isolated ports	37
Uplink port	38

HP 6125G HP Networking guide to hardening Comware-based devices - Page 25

Disable or limit IP Directed broadcasts, Filtering transit traffic with Transit ACLs

Page 25 highlights