1. May, 2006 EdgeNet 2006 The Protection Problem in Enterprise Networks Martin Casado PhD Student in Computer Science, Stanford University casado@cs.stanford.edu http://www.stanford.edu/~casado

2. May, 2006 EdgeNet 2006 Talk Focus  Negative affects of protection measures on edge networks  Motivated by anecdotes from real networks  Introduce Ethane

3. May, 2006 EdgeNet 2006 Network Examples  National Lab, Small-moderate size business, academic, hospital  Security sensitive  More LAN than large routable network

4. May, 2006 EdgeNet 2006 Problems Areas  Inflexibility  Loss of Redundancy  Filtering woes

5. May, 2006 EdgeNet 2006 Problems  Inflexibility  Loss of Redundancy  Filtering Woes

6. May, 2006 EdgeNet 2006 Inflexibility L2 Switch Firewall + Router If one is compromised, can’t sniff traffic of others Can’t enumerate how many hosts on network Can only get “out” through proxy Prevent rogue connections

7. May, 2006 EdgeNet 2006 Inflexibility L2 Switch Firewall + Router If one is compromised, can’t sniff traffic of others Can’t enumerate how many hosts on network Can only get “out” through proxy Prevent rogue connections Firewall rules ACCEPT 192.168.1.20

8. May, 2006 EdgeNet 2006 Inflexibility L2 Switch Firewall + Router Turn of ARP Static ARP cache Ca:fe:d0:d0 192.168.1.1 Firewall rules ACCEPT 192.168.1.20 Turn of ARP Static ARP cache ca:fe:de:ad:be:ef 192.168.1.20

9. May, 2006 EdgeNet 2006 Inflexibility Firewall + Router Turn of ARP Static ARP cache ca:fe:de:ad:be:ef 192.168.1.20 Turn of ARP Static ARP cache Ca:fe:d0:d0 192.168.1.1 Firewall rules ACCEPT 192.168.1.20 No DHCP Also insecure Might undermine firewall rules Might undermine static ARP cache

10. May, 2006 EdgeNet 2006 Inflexibility L2 Switch Firewall + Router Turn of ARP Static ARP cache ca:fe:de:ad:be:ef 192.168.1.20 Turn of ARP Static ARP cache Ca:fe:d0:d0 192.168.1.1 Firewall rules ACCEPT 192.168.1.20 No DHCP Might undermine firewall rules Might undermine static ARP cache Port Security Tie MAC address to Port ca:fe:de:ad:be:ef 192.168.1.20

11. May, 2006 EdgeNet 2006 Inflexibility  Topology (ports, interfaces) and addresses sprinkled throughout configuration state  No distributed maintenance like routing tables  Difficult to move machines  Moving machines can be bad  Indirection points (e.g. ARP, DHCP) insecure (.. often removed)  MAC addresses everywhere  Chew up memory  No aggregation 

12. May, 2006 EdgeNet 2006 Problems  Inflexibility  Loss of Redundancy  Filtering Woes

13. May, 2006 EdgeNet 2006 Loss of Redundancy

14. May, 2006 EdgeNet 2006 Loss of Redundancy  Easier to reason about/verify  Proxies are a catalyst  Distributed firewalls are not the solution  Lack of good support for L5 routing (does anyone have this turned on?)  Existing solutions exacerbate the problem  “do everything” proxies  Single bridge NACs

15. May, 2006 EdgeNet 2006 Problems  Inflexibility  Loss of Redundancy  Filtering Woes

16. May, 2006 EdgeNet 2006 Filtering Woes  Filtering done on the datapath today  Generally limited filtering state (so can have large forwarding tables)  Common problem is running out of ACLs  MAC addresses everywhere  Chew up memory  No aggregation   In some networks, forwarding tables + filters doesn’t make sense..

17. May, 2006 EdgeNet 2006  Centrally declare network policy  Authenticated end-hosts  Central-arbiter grants permission to connect on a per flow basis  Central-arbiter has fine grained control of routes Ethane: Towards a Solution

18. May, 2006 EdgeNet 2006 Publish martin.friends.ambient-streams allow tal, sundar, aditya Authenticate hi, I’m tal, my password is martin.friends.ambient-streams First packet to martin.friends.ambient-streams Global Network Policy: (allow all martin using rtp) Authenticate hi, I’m martin, my password is Ethane

19. May, 2006 EdgeNet 2006  Flexibility  Dynamic bindings are secure (movement is easy)  Security policy independent of topology  Redundancy  More switches != more configuration state  Fine grained control of routes allows L5 routing  Permission checks done on connection setup (taken off data path) Ethane: Properties

20. May, 2006 EdgeNet 2006 Thanks! ?

21. May, 2006 EdgeNet 2006 Isolation  Networks exist today with differing levels of sensitivity  Casino  Financial  Medical  Government/Military  Want reasonable Isolation  No DDoS from less secure to more  No data exfiltration from more secure to less  Note, VLANs generally insufficient This is not solely a government network problem

22. May, 2006 EdgeNet 2006 Today’s Solution (really) heavyweight, application proxy (cannonicalization + fuzzy timers) OR …

23. May, 2006 EdgeNet 2006 Isolation Cont …  Obviously suboptimal  Management  Number of components (MTTF)  Could use same components, separate queues, TDM  Consolidation on the road-map for some very large networks