CCNA Security online course

Protecting the Network Data Plane

Learn how Cisco routers and switches protect transit traffic with ACLs, anti-spoofing, DoS mitigation, rate limiting, IDS/IPS, and port security.

The data plane is the forwarding function that carries user and application packets across a network. For example, when a client requests HTTPS data from a server, the packets cross routers and switches as transit traffic. Protecting this flow is the focus of data-plane security.

Traffic addressed to the router or switch itself is different. Routing-protocol messages belong primarily to the control plane, while SSH, SNMP, and other administrative access belong to the management plane. Data-plane controls protect packets being forwarded through a device, although some controls can also affect traffic destined for the device.

Data-plane threat model

Data-plane threats include unwanted or unauthorized services, reconnaissance scans, malformed packets, forged source addresses, SYN floods, excessive ICMP, and attacks against switching resources. A switch can also be targeted with MAC flooding, in which an attacker sends frames with many invented source MAC addresses to exhaust the CAM table. When the switch cannot associate a destination with a port, it may flood frames out multiple ports.

A control should be placed where it can stop harmful traffic close to its source or at a trust boundary. An Internet-facing interface is a useful point for rejecting spoofed internal addresses and unapproved services. An access switch is the right place to restrict endpoint MAC addresses. Internal segmentation controls reduce the damage if a trusted host or segment is compromised.

Security must be balanced with forwarding performance, availability, and legitimate application requirements. A deny rule that blocks an attack but also blocks DNS, return traffic, monitoring, or emergency access is not a successful design. Baseline normal traffic, document exceptions, log useful events, and review controls periodically.

Access control lists for traffic filtering

An ACL is an ordered list of permit and deny rules. A standard ACL generally matches a source IPv4 address. An extended ACL can match source and destination addresses, IP protocol, and transport-layer ports such as TCP 443 or UDP 53.

ACL entries are evaluated from top to bottom. The first matching entry determines the result. Traffic that matches no permit entry is rejected by the implicit deny at the end of the ACL. For clarity and troubleshooting, many administrators add an explicit final deny with logging, but that explicit entry does not replace careful rule design.

• Inbound: packets are filtered as they enter an interface, before the router makes its forwarding decision. This commonly stops unwanted traffic close to an untrusted boundary.
• Outbound: packets are filtered as they leave an interface, after the forwarding decision. This can be useful when the policy is naturally defined by the destination interface.
• Apply ACLs to routed physical interfaces, routed subinterfaces, and, where appropriate, switched virtual interfaces representing VLANs.
• Include every required business flow, including return traffic when the platform and design require explicit treatment.

Example: edge filtering

This example uses documentation addresses. Replace them only after confirming the real addressing plan and all required services.

ip access-list extended EDGE-IN
 deny ip 10.0.0.0 0.255.255.255 any log
 deny ip 172.16.0.0 0.15.255.255 any log
 deny ip 192.168.0.0 0.0.255.255 any log
 permit tcp any host 203.0.113.10 eq 443
 deny ip any any log
interface GigabitEthernet0/0
 ip access-group EDGE-IN in

Anti-spoofing filtering

IP spoofing is the use of a forged source IP address to impersonate another host or evade controls. A packet arriving from the public Internet should not claim to come from an address belonging to the organization's internal network. Ingress filtering rejects private, internal, loopback, reserved, or otherwise invalid source ranges at an untrusted interface.

Ingress filtering is usually implemented with an extended ACL. The exact blocked ranges depend on the interface, provider design, and address plan. Do not blindly reject a range that is legitimately routed through the interface.

Unicast Reverse Path Forwarding (uRPF) adds source validation by checking whether the routing table has a valid return path to the packet's source. In strict mode, the expected reverse path normally uses the same interface on which the packet arrived:

interface GigabitEthernet0/0
 ip verify unicast source reachable-via rx

Strict uRPF works best with symmetric routing. In an asymmetric environment, a valid packet may arrive on one interface while the routing table points back through another, causing a legitimate packet to be dropped. Verify routing behavior before enabling it; use an appropriate loose-mode design if supported and justified, or use explicit ingress ACLs.

Denial-of-service mitigation

A DoS attack attempts to make a service unavailable by exhausting bandwidth, connection state, processing capacity, or forwarding resources. In a SYN flood, an attacker sends many TCP SYN requests but does not complete the three-way handshake. The server retains incomplete connection state while waiting for the final acknowledgment.

TCP Intercept helps protect a TCP server by validating connection establishment before allowing the server to consume resources. It can operate on connections selected by an ACL and use high and low incomplete-connection thresholds:

access-list 150 permit tcp any 203.0.113.0 0.0.0.255
ip tcp intercept list 150
ip tcp intercept mode intercept
ip tcp intercept max-incomplete high 1000
ip tcp intercept max-incomplete low 800

Thresholds must be based on normal connection rates. A setting that is too low can disrupt legitimate traffic during a busy period. ACLs, rate limiting, monitoring, and TCP Intercept complement one another. No single feature prevents every DoS attack, including attacks that target bandwidth, application logic, distributed sources, or non-TCP protocols.

Bandwidth management and rate limiting

Some traffic is legitimate but can become harmful at high volume. ICMP is useful for diagnostics and error reporting, yet an ICMP flood can consume a link or device resources. Rate limiting restricts the maximum rate of selected traffic.

• Policing enforces a rate and commonly drops or remarks packets that exceed it.
• Shaping buffers excess traffic and sends it later at a controlled rate, when buffering is appropriate.
• Prioritization gives selected traffic preferential treatment during congestion; it does not necessarily reduce the total offered load.

Use selective limits rather than blocking all diagnostic traffic. Classify essential and nonessential traffic separately when supported, and choose a rate that preserves monitoring and troubleshooting.

ip access-list extended MATCH-ICMP
 permit icmp any any
class-map match-any ICMP-TRAFFIC
 match access-group name MATCH-ICMP
policy-map WAN-POLICY
 class ICMP-TRAFFIC
  police 128000 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy input WAN-POLICY

IDS and IPS deployment

An IDS observes traffic, matches signatures or policies, and generates alerts. An IPS performs similar detection but is placed inline so it can block, reset, or otherwise prevent selected traffic. Both can use signatures, behavioral rules, protocol analysis, and policy matching.

Place sensors near Internet edges, critical server VLANs, and other trust boundaries. IDS provides visibility; IPS adds enforcement. Neither replaces ACLs, which provide predictable coarse-grained filtering. Tune signatures and policies to reduce false positives, where legitimate activity is flagged, and false negatives, where malicious activity is missed. Keep signatures updated, review alerts, and test prevention actions against important applications.

Switch port security and MAC flooding

A switch learns source MAC addresses and stores each address with its associated port in the CAM table. For a known destination, the switch forwards a frame only to the appropriate port. If the destination is unknown, the frame may be flooded within the VLAN.

In a MAC flooding attack, many frames with forged source MAC addresses attempt to fill the CAM table. Excessive unknown-unicast flooding can expose traffic and consume switching resources. Port security limits the number of secure MAC addresses allowed on an access port.

• Static secure MAC: an administrator specifies the permitted address.
• Sticky secure MAC: the switch dynamically learns an address and retains it as a secure entry, subject to platform and configuration behavior.
• Violation action: the switch can restrict traffic, shut down the port, or use another supported action. Choose based on the organization's response policy.

Apply a one-endpoint policy primarily to endpoint-facing access ports. Phones, workstations behind phones, hypervisors, trunks, and infrastructure uplinks may legitimately use multiple MAC addresses and require a different design.

interface GigabitEthernet1/0/10
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation restrict

Recovery requires identifying the attached device, checking learned secure addresses, removing unauthorized equipment, and recovering the port according to local policy. Do not automatically raise the MAC limit without confirming that the additional devices are authorized.

Layered data-plane security design

Defense in depth uses multiple controls at different locations:

1. Internet edge: use ingress ACLs to reject spoofed sources and permit only required public services. Add uRPF where routing is suitable.
2. DoS and bandwidth layer: use TCP protections, selective policing, and monitoring to reduce resource exhaustion.
3. Trust boundaries: place IDS sensors or inline IPS devices between untrusted zones and sensitive server or user segments.
4. Internal segmentation: apply routed-interface or VLAN ACLs to restrict unnecessary movement between departments, server tiers, and user networks.
5. Access layer: use port security on endpoint access ports to limit unauthorized MAC addresses and reduce CAM flooding risk.
6. Operations: verify counters, collect logs, monitor drops and alerts, test legitimate flows, and review rules after network or application changes.

Use verification commands after deployment:

show access-lists
show ip interface GigabitEthernet0/0
show policy-map interface GigabitEthernet0/0
show ip tcp intercept statistics
show port-security interface GigabitEthernet1/0/10
show port-security address

Troubleshooting common failures

Legitimate application traffic fails after an ACL change

Inspect ACL sequence order and match counters. Confirm the interface and direction with show ip interface. Check that the required protocol, destination port, and return traffic are permitted. A narrowly scoped permit should be added only after the intended flow is understood.

Valid users are dropped after uRPF is enabled

Check the routing table and actual return path. Asymmetric routing may cause strict reverse-path validation to reject valid packets. Redesign for symmetry, use an appropriate supported loose mode, or use explicit ingress ACL filtering.

TCP Intercept makes new connections intermittent

Review TCP Intercept statistics and compare them with normal connection rates. The matching ACL may be too broad, or the incomplete-connection thresholds may be too low. Narrow the match and adjust the high and low thresholds carefully.

Monitoring cannot ping after ICMP policing

Check policy counters for exceeded packets. Increase the rate carefully or classify essential ICMP types separately where supported. Preserve enough ICMP for diagnostics without allowing an unrestricted flood.

An access port becomes restricted or error-disabled

Review port-security status and secure MAC addresses. Confirm whether the port has a phone, workstation, hypervisor, or other multi-MAC device. Remove unauthorized devices, change the maximum only when justified, and recover the port according to policy.

IPS blocks a legitimate application

Review the event and packet evidence for a false positive. Tune or scope the specific signature, or temporarily change its action while preserving protection against confirmed threats. Re-test after application or signature changes.

Exam-relevant notes

• The data plane forwards user traffic; the control plane builds forwarding knowledge; the management plane provides administrative access.
• ACLs are ordered, and unmatched traffic encounters an implicit deny.
• Extended ACLs can match source, destination, protocol, and ports.
• Ingress anti-spoofing filtering blocks packets that claim invalid internal sources.
• Strict uRPF can fail with asymmetric routing.
• TCP Intercept addresses incomplete TCP connection consumption, not every DoS type.
• Policing commonly drops or remarks excess traffic; shaping generally buffers it.
• IDS alerts, while IPS can block inline traffic.
• Port security limits secure MAC addresses and belongs primarily on endpoint access ports.

For related foundations, review basic security terms, control-plane protection, and management-plane protection.