security assessment on a vxlan-based network

IntroductionVXLAN prototype

Security assessmentQ&A

Security assessment on a VXLAN-based network

Guido Pineda Reyes

MSc. Systems and Networking EngineeringUniversity of Amsterdam

February 5, 2014

Guido Pineda Reyes Security assessment on a VXLAN-based network



Outline

1 IntroductionVirtual eXtensible LANResearch questionApproach

2 VXLAN prototype

3 Security assessmentMAC Flood AttackDouble-Encapsulated 802.1Q/Nested VLAN AttackARP AttackUDP Flood AttackFuture researchConclusions

4 Q&A




Virtual eXtensible LANResearch questionApproach

Outline


2 VXLAN prototype


4 Q&A





Virtual eXtensible LANIntroduction

Still an Internet Draft, current revision: 7th

Allows to extend logical networks

Encapsulates layer MAC-based Layer 2 frames within a UDPpacket

Up to 16 million logical networks

Security measurements have not been performed yet





Virtual eXtensible LANTypical use case





Outline


2 VXLAN prototype


4 Q&A





Research questions

Main question: How feasible are the known VLAN attacks ina VXLAN environment?

Subquestions:

Which attacks were successful?What is the difference between these attacks in a VLAN and aVXLAN environment?Is there anyway to prevent them or mitigate them?





Outline


2 VXLAN prototype


4 Q&A





Approach

Build the VXLAN prototype.

Deploy the security assessment on the prototype.

Focus on successful attacks.

Understand how this attacks work to give a solution on howto mitigate or prevent them.




VXLAN prototypeDesign




VXLAN prototypeOptions

VMware vSphere products

VMware vSphere + Cisco Nexus 1000v

VXLAN Linux implementation (needs kernel modification)




VXLAN prototypeConnectivity tests: UDP encapsulated traffic




VXLAN prototypeConnectivity tests: VXLAN encapsulation




MAC Flood AttackDouble-Encapsulated 802.1Q/Nested VLAN AttackARP AttackUDP Flood AttackFuture researchConclusions

Security Assessment

MAC Flood Attack

Double-Encapsulated 802.1Q/Nested VLAN Attack

ARP Attack

UDP Flood Attack

Evaluation





Outline


2 VXLAN prototype


4 Q&A





MAC Flood AttackScenarios





MAC Flood Attack

Tool: macof

Results:

Attacker on physical net:SuccessfulAttacker on logical net:Failed

Mitigation/Prevention:

Restrict the number ofMAC addresses to oneportSpecify static MACaddress associationIDS





Outline


2 VXLAN prototype


4 Q&A





Double-Encapsulated 802.1Q/Nested VLAN AttackScenario





Double-Encapsulated 802.1Q/Nested VLAN AttackConcept





Double-Encapsulated 802.1Q/Nested VLAN Attack

Tool: scapy

Results:

Attacker on logical net:Failed





Outline


2 VXLAN prototype


4 Q&A





ARP AttackScenarios





ARP AttackSummary

Tool: arpspoof

Results:

Attacker on physical net:SuccessfulAttacker on logical net:Successful


Blocking directcommunication betweenthe attacker and thevictim.

Configuring privatecommunication between thehosts at the service providerlevel.





ARP AttackScenarios





Outline


2 VXLAN prototype


4 Q&A





UDP Flood AttackSummary

Tool: flood.pl

Results:

Attacker on physical net:Failed


IDS to detect unusualUDP traffic





Outline


2 VXLAN prototype


4 Q&A





Further researchPossible vulnerability

Trying to modify the FDB and redirect all traffic to theattacker.





Outline


2 VXLAN prototype


4 Q&A





ConclusionsMost relevant points

Building the prototype is not trivial

Some attacks are feasible

Double-Encapsulation attack and MAC flooding attacks failuresshow that VXLAN segments are isolated from each other.

ARP attacks show that Man in the Middle Attacks or DoS arepossible from within any network (physical & logical).

Mitigation and prevention is mainly related to best practices.Guido Pineda Reyes Security assessment on a VXLAN-based network



Q&A

Questions?


security assessment on a vxlan-based network

Documents