Bookpool: Router Security Strategies: Securing IP Network Traffic Planes

NEW RELEASES

BEST SELLERS

SUBJECTS

PUBLISHERS

PROMOTIONS

ARTICLES

Router Security Strategies: Securing IP Network Traffic Planes

View Larger Image	Gregg Schudel, David J. Smith Cisco Press, Paperback, Published December 2007, 700 pages, ISBN 1587053365
	List Price: $65.00 Our Price: $50.50 You Save: $14.50 (22% Off)
	Availability: Out-Of-Stock

Customer Reviews: 2 Average Customer Rating:

Write a Review and tell the world about this title!

People who purchase this book frequently purchase:

Interconnecting Cisco Network Devices, Part 1 (ICND1) Exam 640-822, 2nd Edition; Stephen McQuerry, $46.50, 22% Off!
Interconnecting Cisco Network Devices, Part 2 (ICND2) 3rd Edition; Stephen McQuerry, $46.50, 22% Off!
VMware ESX Server in the Enterprise; Edward L. Haletky, $38.95, 22% Off!
LAN Switch Security: What Hackers Know About Your Switches; Eric Vyncke, et al, $46.50, 22% Off!

Books on similar topics, in best-seller order:

Books from the same publisher, in best-seller order:

Cisco Press

Router Security Strategies: Securing IP Network Traffic Planes provides a compre-hensive approach to understand and implement IP traffic plane separation and protection on IP routers. This book details the distinct traffic planes of IP networks and the advanced techniques necessary to operationally secure them. This includes the data, control, management, and services planes that provide the infrastructure for IP networking.

The first section provides a brief overview of the essential components of the Internet Protocol and IP networking. At the end of this section, you will understand the fundamental principles of defense in depth and breadth security as applied to IP traffic planes. Techniques to secure the IP data plane, IP control plane, IP management plane, and IP services plane are covered in detail in the second section.

The final section provides case studies from both the enterprise network and the service provider network perspectives. In this way, the individual IP traffic plane security techniques reviewed in the second section of the book are brought together to help you create an integrated, comprehensive defense in depth and breadth security architecture.

“Understanding and securing IP traffic planes are critical to the overall security posture of the IP infrastructure. The techniques detailed in this book provide protection and instrumentation enabling operators to understand and defend against attacks. As the vulnerability economy continues to mature, it is critical for both vendors and network providers to collaboratively deliver these protections to the IP infrastructure.”

-- Russell Smoak, Director, Technical Services, Security Intelligence Engineering, Cisco

• Understand the operation of IP networks and routers

• Learn about the many threat models facing IP networks, Layer 2 Ethernet switching environments, and IPsec and MPLS VPN services

• Learn how to segment and protect each IP traffic plane by applying defense in depth and breadth principles

• Use security techniques such as ACLs, rate limiting, IP Options filtering, uRPF, QoS, RTBH, QPPB, and many others to protect the data plane of IP and switched Ethernet networks

• Secure the IP control plane with rACL, CoPP, GTSM, MD5, BGP and ICMP techniques and Layer 2 switched Ethernet-specific techniques

• Protect the IP management plane with password management, SNMP, SSH, NTP, AAA, as well as other VPN management, out-of-band management, and remote access management techniques

• Secure the IP services plane using recoloring, IP fragmentation control, MPLS label control, and other traffic classification and process control techniques

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

Foreword xix

Introduction xx

Part I

IP Network and Traffic Plane Security Fundamentals 3

Chapter 1

Internet Protocol Operations Fundamentals 5

IP Network Concepts 5

Enterprise Networks 7

Service Provider Networks 9

IP Protocol Operations 11

IP Traffic Concepts 19

Transit IP Packets 20

Receive-Adjacency IP Packets 21

Exception IP and Non-IP Packets 22

Exception IP Packets 22

Non-IP Packets 23

IP Traffic Planes 24

Data Plane 25

Control Plane 27

Management Plane 29

Services Plane 30

IP Router Packet Processing Concepts 32

Process Switching 36

Fast Switching 39

Cisco Express Forwarding 44

Forwarding Information Base 44

Adjacency Table 45

CEF Operation 46

General IP Router Architecture Types 50

Centralized CPU-Based Architectures 50

Centralized ASIC-Based Architectures 52

Distributed CPU-Based Architectures 54

Distributed ASIC-Based Architectures 56

Summary 62

Review Questions 62

Further Reading 606

Index

About the Authors

Gregg Schudel, CCIE® No. 9591, joined Cisco in 2000 as a consulting system engineer supporting the U.S. service provider organization. Gregg focuses on IP core network security architectures and technology for interexchange carriers and web services providers.

David J. Smith, CCIE No. 1986, joined Cisco in 1995 and is a consulting system engineer supporting the service provider organization. David focuses on IP core and edge architectures including IP routing, MPLS technologies, QoS, infrastructure security, and network telemetry.

Customer Reviews

Customer Reviews: 2 Average Customer Rating:

Mar 25, 2008 Rik Guyler, Solutions Architect from Dayton, Ohio USA
Excellent coverage of the intended subject matter
We finally have a book that pulls several different IOS security strategies together. So many references prior to this one touch on these topics sporadically but I have yet to find a better resource that covers all the bases as does this one.

The things I like about this book:

So many authors tend to try to spread their subject matter out too wide and take too broad of an approach when writing about network security. Schudel and Smith didnt do that. Instead they focused on specific areas and worked diligently to stay on target. It was very refreshing to read a book that actually didnt wander off on tangential subjects on a regular basis.

As for actual subject matter I was very pleased to find a book that discussed the various planes within Cisco IOS. In my opinion Cisco has not been very good about documenting this subject and so this book has cleared up several knowledge gaps I had prior to reading it. All of the bits of information Ive heard or read about in the past were pulled together in a clear and concise manner. It was also pleasing to see just the right amount of configuration shows rather than pages and pages of them.

I also was very happy that this book was not full of fluff. The authors used just enough background info to convey their message but did not go overboard in non-essential detail. As with any technical reference I prefer thorough and correct information but many times there is just too much description that just gets in the way.

Some reviewers stated that the authors repeated themselves within this book. For me this was not a negative. There are certain topics that I very much need repeated in order to retain it thoroughly and so this was not a problem for me. The repetitious content was neither significant nor time consuming so I consider it to be a positive rather than a negative.

The things I do not like about this book:

This is trivial but I would have much preferred a hardback book rather than a paperback. This is a personal preference of course but hardbacks tend to last longer for me.

Mar 23, 2008 Afaq Muhammad Khan from Santa Clara, CA, USA
Thats just yet another great title from Cisco Press!. This boo
Thats just yet another great title from Cisco Press!. This book does a great job of logically dividing the overall router security into each logical context by way of describing the router's planes. I also found very elaborate and diverse Further Reading towards the end of each chapter very useful. I particularly liked the idea of overall structure and quality of contents in the book which relate to both a casual and an advanced reader!

Book is structured into four Parts;

Part I focuses on laying the foundation for the rest of the book. It achieves this purpose by talking about the Enterprise and SP network fundamentals. This also includes day-in-the-life-of-a-packet through various router switching mechanisms. Chapter 2 re-hashes the network security/threat models but does a nice job of dividing it into various aspects of architectures including various IP VPNs scenarios.

For an advanced reader, this should serve as a nice refresher!

Part II introduces you to real meat of router security, i.e., securing the router planes in both IP and MPLS networks. Authors do a good job of describing the details of each component. Chapters in this section contain working details and IOS configuration snippets to enhance the understanding of various concepts discussed. An advanced user will find all the details given here very useful, and prefer read them cover to cover.

Part III walks you through various case studies to further the concepts explained in the prior chapters. I particularly like the idea of covering both Enterprise and SP case studies. It provides use cases, application examples, and best practices guidelines for the key concepts discussed in the whole book

In Part IV, I very much like the idea of not just copying pasting the headers as-is, rather adding the security implications of each and putting them into its context. Cisco IOS to IOS-XR Security transition is also useful although to mostly SP audience.

This book discusses security as in Router planes for both IP and MPLS VPNs Security. A few times you can notice that authors are repeating themselves.

Overall, I strongly recommend this book to all network security engineers as MPLS (due to its inherent advantages and applications) is gaining momentum not only in the service provider space but also in the enterprise market segment.

Forgot your password?
FAQs

Shipping Options
Returns

Your Orders
Your Account

Table of Contents