May, 2006 EdgeNet 2006 The Protection Problem in Enterprise Networks Martin Casado PhD Student in Computer Science, Stanford University

May, 2006 EdgeNet 2006 Talk Focus  Negative affects of protection measures on edge networks  Motivated by anecdotes from real networks  Introduce Ethane

May, 2006 EdgeNet 2006 Network Examples  National Lab, Small-moderate size business, academic, hospital  Security sensitive  More LAN than large routable network

May, 2006 EdgeNet 2006 Problems Areas  Inflexibility  Loss of Redundancy  Filtering woes

May, 2006 EdgeNet 2006 Problems  Inflexibility  Loss of Redundancy  Filtering Woes

May, 2006 EdgeNet 2006 Inflexibility L2 Switch Firewall + Router If one is compromised, can’t sniff traffic of others Can’t enumerate how many hosts on network Can only get “out” through proxy Prevent rogue connections

May, 2006 EdgeNet 2006 Inflexibility L2 Switch Firewall + Router If one is compromised, can’t sniff traffic of others Can’t enumerate how many hosts on network Can only get “out” through proxy Prevent rogue connections Firewall rules ACCEPT

May, 2006 EdgeNet 2006 Inflexibility L2 Switch Firewall + Router Turn of ARP Static ARP cache Ca:fe:d0:d Firewall rules ACCEPT Turn of ARP Static ARP cache ca:fe:de:ad:be:ef

May, 2006 EdgeNet 2006 Inflexibility Firewall + Router Turn of ARP Static ARP cache ca:fe:de:ad:be:ef Turn of ARP Static ARP cache Ca:fe:d0:d Firewall rules ACCEPT No DHCP Also insecure Might undermine firewall rules Might undermine static ARP cache

May, 2006 EdgeNet 2006 Inflexibility L2 Switch Firewall + Router Turn of ARP Static ARP cache ca:fe:de:ad:be:ef Turn of ARP Static ARP cache Ca:fe:d0:d Firewall rules ACCEPT No DHCP Might undermine firewall rules Might undermine static ARP cache Port Security Tie MAC address to Port ca:fe:de:ad:be:ef

May, 2006 EdgeNet 2006 Inflexibility  Topology (ports, interfaces) and addresses sprinkled throughout configuration state  No distributed maintenance like routing tables  Difficult to move machines  Moving machines can be bad  Indirection points (e.g. ARP, DHCP) insecure (.. often removed)  MAC addresses everywhere  Chew up memory  No aggregation 

May, 2006 EdgeNet 2006 Problems  Inflexibility  Loss of Redundancy  Filtering Woes

May, 2006 EdgeNet 2006 Loss of Redundancy

May, 2006 EdgeNet 2006 Loss of Redundancy  Easier to reason about/verify  Proxies are a catalyst  Distributed firewalls are not the solution  Lack of good support for L5 routing (does anyone have this turned on?)  Existing solutions exacerbate the problem  “do everything” proxies  Single bridge NACs

May, 2006 EdgeNet 2006 Problems  Inflexibility  Loss of Redundancy  Filtering Woes

May, 2006 EdgeNet 2006 Filtering Woes  Filtering done on the datapath today  Generally limited filtering state (so can have large forwarding tables)  Common problem is running out of ACLs  MAC addresses everywhere  Chew up memory  No aggregation   In some networks, forwarding tables + filters doesn’t make sense..

May, 2006 EdgeNet 2006  Centrally declare network policy  Authenticated end-hosts  Central-arbiter grants permission to connect on a per flow basis  Central-arbiter has fine grained control of routes Ethane: Towards a Solution

May, 2006 EdgeNet 2006 Publish martin.friends.ambient-streams allow tal, sundar, aditya Authenticate hi, I’m tal, my password is martin.friends.ambient-streams First packet to martin.friends.ambient-streams Global Network Policy: (allow all martin using rtp) Authenticate hi, I’m martin, my password is Ethane

May, 2006 EdgeNet 2006  Flexibility  Dynamic bindings are secure (movement is easy)  Security policy independent of topology  Redundancy  More switches != more configuration state  Fine grained control of routes allows L5 routing  Permission checks done on connection setup (taken off data path) Ethane: Properties

May, 2006 EdgeNet 2006 Thanks! ?

May, 2006 EdgeNet 2006 Isolation  Networks exist today with differing levels of sensitivity  Casino  Financial  Medical  Government/Military  Want reasonable Isolation  No DDoS from less secure to more  No data exfiltration from more secure to less  Note, VLANs generally insufficient This is not solely a government network problem

May, 2006 EdgeNet 2006 Today’s Solution (really) heavyweight, application proxy (cannonicalization + fuzzy timers) OR …

May, 2006 EdgeNet 2006 Isolation Cont …  Obviously suboptimal  Management  Number of components (MTTF)  Could use same components, separate queues, TDM  Consolidation on the road-map for some very large networks