VMware ESXi and vSphere Cluster Management

Cisco Network Foundation Protection (NFP) Framework

Learn how Cisco Network Foundation Protection organizes router and switch security into management, control, and data planes to preserve network availability.

Network Foundation Protection (NFP) is a Cisco framework for organizing the functions of network devices and the security controls used to protect them. It groups network activity into three logical sections: the management plane, control plane, and data plane.

NFP applies to routers and switches, the protocols they use, and the traffic associated with their operation. Its goal is not to provide one single security feature. Instead, it combines several security approaches so infrastructure devices remain protected and available during failures or attacks.

Why Cisco NFP Uses Three Planes

A network device handles different types of traffic for different purposes. Some traffic is sent to the device so an administrator can manage it. Some traffic is exchanged automatically between devices so they can discover neighbors and learn routes. Other traffic simply passes through the device between end users and remote destinations.

Separating these functions into planes makes security analysis more systematic. For each plane, an administrator can ask:

• Who or what generates the traffic?
• Is the traffic intended for the device or forwarded through it?
• What happens if the traffic is blocked, altered, overloaded, or abused?
• Which controls are appropriate for protecting the function?

The planes are logically distinct, but they are not independent. A control-plane problem can prevent data-plane forwarding, while a management-plane problem can prevent administrators from diagnosing and repairing either issue.

The Three NFP Planes

Management Plane

The management plane consists of administrator-originated protocols and traffic used to configure, monitor, and administer a network device. Remote device administration is a management-plane function because the administrator is communicating with the device itself.

For example, an administrator might open an SSH session from an approved management workstation to a Cisco IOS router. The session is directed to the router so the administrator can view configuration, change settings, or investigate an incident.

Telnet can perform a similar administrative role, but it does not protect session contents with encryption. Usernames, passwords, commands, and device output can be exposed to someone who captures the session. SSH is therefore the preferred protocol for secure remote administration.

Management-Plane Security Guidelines

• Restrict administrative access: Permit management connections only through approved interfaces, networks, or management workstations.
• Use authenticated and encrypted protocols: Prefer SSH over Telnet and require strong administrator authentication.
• Protect credentials: Avoid shared accounts, use appropriate privilege controls, and protect stored passwords and secrets.
• Limit permitted sources: Apply management access restrictions so arbitrary user networks cannot open administrative sessions.
• Monitor administrative activity: Record successful and failed access attempts where the device and monitoring system support it.

If the management plane fails or is compromised, administrators may lose remote access to the router or switch. The device might continue forwarding traffic, but diagnosing a fault, changing a route, or recovering from an attack becomes more difficult.

Introductory Cisco IOS Protection Concepts

The following example shows the general sequence for enabling SSH-based management. Exact commands and syntax can vary by IOS release and device model, so validate the configuration in the platform documentation and a controlled environment.

hostname R1
ip domain-name example.local
username netadmin privilege 15 secret Use-a-strong-secret
crypto key generate rsa
ip ssh version 2
line vty 0 4
 login local
 transport input ssh

This example creates a local administrative identity, enables SSH prerequisites, and restricts the virtual terminal lines to SSH. A production configuration should also use centralized authentication and authorization when appropriate, restrict the source addresses permitted to connect, and protect the management network itself.

A conceptual source restriction might use an access control list applied to the device's virtual terminal lines:

ip access-list standard MGMT-SOURCES
 permit 192.0.2.10
 deny any
line vty 0 4
 access-class MGMT-SOURCES in

The important security idea is that only an approved management host or subnet should be able to reach the administrative service. Do not treat an example address or password as suitable production values.

By contrast, a configuration that permits Telnet exposes the management session:

line vty 0 4
 transport input telnet

Telnet may be encountered in legacy environments, but it is unsuitable for secure administration because the session contents are sent without encryption. If it must exist temporarily for compatibility, restrict its source and plan its removal.

Control Plane

The control plane handles device-to-device protocol processing. This work occurs automatically rather than through direct administrator interaction. Control-plane activity lets devices discover one another, learn topology information, exchange reachability details, and maintain the information needed to make forwarding decisions.

ARP messages are one example. On a local network, ARP associates an IP address with a link-layer address so a device can deliver a frame to the appropriate neighbor. Routing-protocol updates are another example. Devices exchange these updates to communicate reachable networks and calculate or maintain routes.

Control-plane traffic is directed at the device or processed by the device as part of its network operation. It is different from ordinary user traffic that the device forwards toward another destination.

Control-Plane Risks

A control-plane failure can stop devices from exchanging, learning, or maintaining routing information. Even when physical links remain up, a router that has lost its required routes may not know where to send user packets.

Infrastructure protocols and device resources should be protected from:

• Malformed control messages designed to trigger errors or excessive processing.
• Excessive protocol traffic that consumes CPU, memory, or bandwidth.
• Spoofed messages that falsely claim to represent a neighbor or route.
• Unauthorized control traffic from locations where infrastructure protocols should not operate.

Controls may include protocol authentication, filtering at network boundaries, limiting which interfaces participate in infrastructure protocols, rate controls, and monitoring of device resource usage. The exact control depends on the protocol and platform.

Data Plane

The data plane forwards end-user or transit traffic through a network device. This traffic is not primarily intended to manage the device or teach it how the network is structured.

For example, when a user opens a website, the user's packets travel through one or more routers toward the web server. The router examines each packet, selects a forwarding action using its forwarding information, and sends the packet toward the next hop. This is data-plane activity.

Data-plane protection focuses on securely and reliably forwarding permitted user traffic. Controls can include appropriate filtering, anti-spoofing measures, segmentation, traffic inspection, and resilience against excessive traffic. If data-plane forwarding fails, users may be unable to browse websites, access applications, or communicate with other networks.

Interdependence Between the Planes

NFP separates functions for analysis, but normal network operation depends on cooperation between the planes.

Control Plane Supporting the Data Plane

A router normally needs control-plane information before it can make correct data-plane decisions. If routing updates stop or routes are removed, the router may not know the next hop for a user's web traffic. The user's packets are data-plane traffic, but the outage may have originated in the control plane.

Management Plane Supporting Recovery

Administrators use the management plane to inspect status, change configuration, apply a fix, and recover a device. If remote management access is unavailable, the device may continue operating in a degraded state while administrators lose the ability to respond quickly. They might need console or out-of-band access instead.

Data Plane Affecting Administration

Management sessions also require forwarding through the network. A damaged data plane can make a healthy SSH service appear unreachable from a management workstation. Troubleshooting must therefore distinguish a failed management service from a forwarding or path problem.

NFP and Network Availability During Attacks

Network availability is the ability of the network and its services to remain operational for users and administrators. NFP helps organize availability defenses according to the function being attacked or disrupted.

• An attack against administrative services may lock out administrators or expose device credentials.
• An attack against routing, ARP, or another infrastructure protocol may prevent correct topology or route information from being learned.
• An attack against transit traffic may consume forwarding capacity or cause permitted traffic to be dropped.

These attacks can have different symptoms and require different protections. Protecting only SSH does not secure routing exchanges, and protecting routing protocols does not guarantee that user packets will be forwarded. Effective infrastructure protection addresses all three planes together.

Troubleshooting by Plane

Administrators Cannot Remotely Access a Router or Switch

Likely plane: Management plane.

1. Test reachability from the authorized management host.
2. Verify that the remote-access service is enabled and listening on the expected interface or virtual terminal lines.
3. Check management access restrictions, including source-address filters and interface access controls.
4. Check authentication, authorization, account status, and credential settings.
5. Use console or out-of-band access if remote management is unavailable.

Devices Stop Learning Routes

Likely plane: Control plane.

1. Check routing-protocol neighbor relationships.
2. Inspect received and transmitted routing updates.
3. Verify that interfaces and infrastructure protocol processing are operational.
4. Look for malformed, spoofed, or excessive control traffic.
5. Check whether CPU, memory, or other device resources are being exhausted.

Users Cannot Reach a Website or Another Network

Likely plane: Data plane, potentially caused by a control-plane problem.

1. Check whether the device is forwarding packets as expected.
2. Verify that an appropriate route and next hop are present.
3. Determine whether the device learned the required route through a control-plane protocol.
4. Check whether a control-plane outage removed or prevented the forwarding decision.
5. Review filtering and other data-plane protections for unintended packet drops.

Exam-Relevant Distinctions

• Management plane: An administrator manages the device. SSH and Telnet sessions are examples.
• Control plane: Devices communicate automatically to discover, learn, and maintain network information. ARP and routing updates are examples.
• Data plane: User or transit traffic is forwarded through the device. A user's web request is an example.
• A plane describes a function, not necessarily a separate physical interface or hardware component.
• A control-plane failure can cause a data-plane outage because forwarding depends on learned network information.
• A management-plane outage can make recovery harder even if forwarding continues.

Summary

Cisco Network Foundation Protection organizes router and switch security around the management, control, and data planes. The management plane protects administrative access, the control plane protects automatic device-to-device operations and routing information, and the data plane protects the forwarding of permitted user traffic.

The planes help administrators match risks and controls to network functions. Because the planes depend on one another operationally, a resilient design protects all three rather than treating them as isolated systems.

See also: Cisco Network Foundation Protection (NFP) Framework.