MPP (Management Plane Protection) with access-Class on VTY clarification

[bernardo81]

Hello,
We would like to implement MPP on our Routers and Switches to limit Mgmt Protocols to specific interfaces.

I was reading about the advantages of MPP over regular ACL applied to interfaces that when a Management Protocol traffic arrived to an untrusted interface, the CPU is not punted thus preventing DOS attacks
 
The thing is that we want also to limit the source subnet that is allowed to SSH the Routers for Managing the devices via :

ip access-list extended ACL-Src-Subnet
 permit tcp 10.10.77.0 0.0.255 eq 22
 
line vty 0 4
 access-class ACL-Src-Subnet in

Will this configuration punt the CPU and defeat the purpose of MPP ?

Please advise

 

 

[balaji.bandi]

how is your configuration for the MPP, any specific interface ? do you have any specific OOB in place ?

[bernardo81]

Hello, I still did not configure MPP.

currently we have only the following:

ip access-list extended ACL-Src-Subnet
permit tcp 10.10.77.0 0.0.255 eq 22

line vty 0 4
access-class ACL-Src-Subnet in

I want to use MPP to avoid CPU Punting in case of attacks and to tighten the security.
The question is not how to configure MPP but will MPP with access-class configured punt the CPU in case someone outside 10.10.77.0/24 is trying to access the routers on an MPP configured interface that allows SSH ?

[Rob Ingram]

Hi,
If you are using an ACL on the VTY line and the ACL blocks the traffic then the local CPU would be used to indicate that the remote device the connection had been refused. Only using CoPP/CPPr would the CPU be protected, no indication that access was denied would be sent to the remote device (silently blocked).

If this device is on the inside of the network, therefore not on the internet edge, with modern hardware I doubt that the CPU is going to be impacted, so I personally wouldn't over complicate the configuration with CoPP/CPPr.

HTH

[bernardo81]

HI RJI,

Thank you for the reply.
So in brief you suggest to either use access-class on vty or MPP but not both together.
And preferably use access-class on VTY.
Right?

[Rob Ingram]

Just an ACL on the VTY lines should suffice.
MPP does meet your requirement of not punting to the CPU, but as I indicated earlier, it's overkill in my opinion.

HTH

[bernardo81]

Hello,

Thank you for the clarification , really helpful.

[rreed2010]

I just watch a video over at networklessons.com where they enforce MPP and show that it silently drops the denied packets.