MPLS Security

[husseinmuneer]

Dear all,

We are ISP and we deployed an IP/MPLS network so we need your information how can we protect it and what equipments we need for this purpose ?

In the same time the IP/MPLS as an IP/MPLS could doesn't have only one end to install firwall or something like this so what usually deploy to protect the IP/MPLS network?

Regards

[Ivan Krimmel]

Hi Hussein,

every ISP should be protected against intrusions and DDoS attacks, as well as from all sorts of spoofing techniques. In case of MPLS VPN service, label spoofing is also a concern. Since MPLS VPNs are not secure in nature, IPSec for data integrity/confidentiality shouldn't be forgotten. Out of band management implementation should be treated with great attention.

As for devices, firewalls of all arts might be examined, Cisco  Traffic Anomaly Detector can help to mitigate DDOS attacks.

Security in MPLS environment is a big domain, for an extended view you might be interested to learn the MPLS VPN  Security book.

I would summarize my post like this: It is more important which tools/features to use to secure an ISP and it's MPLS infrastructure, rather a which device to install.

Hope that clarifies.