Data Center Access Layer Security Recommendations

Every time I have been asked what kind of security recommendations are required for data center access layer? Let's understand what does Access Layer in data center is used for first.

The data center access layer provides Layer-2 connectivity for server farms. In most cases the primary role of the access layer is to provide port density for scaling the server farm or a network segment; it could be Physical or Virtual. Security at the access layer is primarily focused on securing Layer-2 flows and communication within the sites.

Recommendations for this layer are:

Use VLANs to segment and isolate traffic where it’s needed. This is the very basic stuff used in almost every data centers but always not consider it as security. Deploy private VLANs (PVLANs) after confirming that traffic flows will not be affected once they are deployed. It is best to ensure that hosts that need to communicate are placed in the same community while hosts that don’t require such connectivity are isolated. Communication of host matrix must be given by customer by clearly defines the traffic flows.

The following layer 2 security mechanisms should be enabled at the access layer :
1. Address Resolution Protocol (ARP) inspection/Arp Spoofing: Private vlan edge feature will to help mitigate this type of attack. 2. Dynamic Host Configuration Protocol (DHCP) Snooping.
3. IP Source Guard.
4. Port security where it can be used to lock down a critical server to a specific port
5. Blocking user-user L2 communication: Private vlan edge/Protected Port feature will to help mitigate this type of attack
6. Broadcast/Multicast Suppression: Strom Control feature will to help mitigate this type of attack
7. MAC address hijacking: protected port and port security features will to help mitigate this type of attack
8. IP source spoofing: uRPF feature will to help mitigate this type of attack
9. Content-addressable memory (CAM) overflow: This can be mitigated by using port security on customer facing port
10. Dynamic Host Configuration Protocol (DHCP) DoS: This can be mitigated by using port security/DHCP Snooping on customer facing port
11. DoS storms: This can be mitigated by using port security/private vlans edge on customer facing port

Click Here To Read Rest Of The Post...

VXLAN Key Concepts & Basic Operation

This section considers some key concepts to consider deploying VXLAN (Read More About VxLAN Overview). Virtual Tunnel End Point (VTEP). As the name implies, the VTEP corresponds to the IP address that defines the beginning or the end of the overlay tunnel. Depending on the role, the VTEP can reside in many places. Initially, it was defined on the virtual switch, but later on, it found its way to other devices such as physical switches, firewalls, routers and so forth.

Depending on the location of the VTEP, devices can play different roles in the VXLAN construct. At the edge, the virtual switch played the role of encapsulation or de-capsulation device, ingesting the packets from the virtual machine and inserting or stripping of the correct VXLAN header respectively. Examples are the VMware DVS and the Cisco Nexus 1000v. These devices implement the basic VXLAN function.

Below provides an overview of this basic function of VXLAN. A virtual machine sends a packet to another virtual machine on another physical host. The traffic enters the vSwitch untagged and based on the vnic configuration will be assigned a VXLAN segment id and will be encapsulated in a UDP packet with VTEP source and destination IP address. The packet is routed over the layer 3 network and eventually reaches the VTEP tunnel destination IP address where the VXLAN header is stripped off and the packet forwarded to the destination virtual machine.

Click Here To Read Rest Of The Post...

VxLAN Overview

Virtual Extensible LAN, VXLAN, is another layer 2 overlay network technology that came into existence to initially address particular problems:
•In massively scaled virtualized data centers, the 4096 VLAN limitation implied through a 12 bit long dot1q tag played a significant role to come up with a more scalable solution.

•The static nature of trunk provisioning is another key driver. One of the most attractive aspects of virtualization is the short deployment timelines brought by the simplified deployment of server workloads, but these were hampered by a slow network deployment time.

•Many of these virtual deployments require layer 2 adjacency of virtual machines, especially in clustered environments. The workload deployments preferably can be placed anywhere in the network irrespective of physical boundaries.

VXLAN initially was conceived as a host overlay technology as the basic function was executed at the hypervisor virtual switch layer.

VXLAN Key Concepts & Basic Operation

some key concepts to consider deploying VXLAN. Virtual Tunnel End Point (VTEP). As the name implies, the VTEP corresponds to the IP address that defines the beginning or the end of the overlay tunnel. Depending on the role, the VTEP can reside in many places. Initially, it was defined on the virtual switch, but later on, it found its way to other devices such as physical switches, firewalls, routers and so forth. Depending on the location of the VTEP, devices can play different roles in the VXLAN construct. At the edge, the virtual switch played the role of encapsulation or de-capsulation device, ingesting the packets from the virtual machine and inserting or stripping of the correct VXLAN header respectively.
Click Here To Read Rest Of The Post...