HP Networking guide to hardening Comware-based devices

17
There are two types of ICMP redirect messages: redirect for a host address and redirect for an entire subnet. A malicious
user can exploit the ability of the router to send ICMP redirects by continually sending packets to the router, forcing the
router to respond with ICMP redirect messages. This produces an adverse impact on the CPU and on the performance of
the router. In order to prevent the router from sending ICMP redirects, use the undo ip redirects command.
For more information on ICMP redirects, see “IP Performance Optimization” in the Layer-3 IP Services Command
Reference Guide.
ICMP unreachables
Generating ICMP unreachable messages can increase CPU load on the device. ICMP unreachable message generation can
be disabled using the undo ip unreachables command.
ICMP TTL-expiry
Generating ICMP timeout messages can increase CPU load on the device. ICMP TTL timeout message generation can be
disabled using the undo ip ttl-expires command.
Proxy ARP
Proxy ARP is the technique in which one device, usually a router, answers ARP requests that are intended for another
device. By "faking" its identity, the router accepts responsibility for routing packets to the real destination. Proxy ARP
can help machines on a subnet reach remote subnets without configuring routing or a default gateway. Proxy ARP is
defined in RFC 1027.
There are several disadvantages to utilizing proxy ARP. Doing so can result in an increase in the amount of ARP traffic on
the network segment, as well as resource exhaustion and man-in-the-middle attacks. Proxy ARP presents a resource
exhaustion attack vector because each proxied ARP request consumes a small amount of memory. An attacker can
exhaust all available memory by sending a large number of ARP requests.
Man-in-the-middle attacks enable a host on the network to spoof the MAC address of the router, resulting in
unsuspecting hosts sending traffic to the attacker. Proxy ARP can be disabled using the undo proxy-arp enable
command in interface view.
For more information on this feature, see “ARP Configuration” in the Layer-3 IP Services Command Reference Guide.
Network time protocol
Network Time Protocol (NTP) is not an especially dangerous service, but any unneeded service can represent an attack
vector. If NTP is used, it is important to explicitly configure a trusted time source and to use proper authentication.
Accurate and reliable time is required for syslog purposes, such as during forensic investigations of potential attacks, as
well as for successful VPN connectivity when depending on certificates for Phase 1 authentication.
NTP time zone—When you configure NTP, the time zone needs to be configured so that timestamps can be accurately
correlated. There are usually two approaches to configuring the time zone for devices in a network with a global
presence. One method is to configure all network devices with the Coordinated Universal Time (UTC—previously
Greenwich Mean Time [GMT]). The other approach is to configure network devices with the local time zone. More
information on this feature can be found in “clock timezone” in the HP product documentation.
NTP maximum dynamic sessions—Use the ntp-service max-dynamic-sessions command to set the maximum number
of dynamic NTP sessions that are allowed to be established locally. Please see “NTP” in the Network Management and
Monitoring Configuration Guide and Command Reference Guide.
NTP access control—Configure the access control right to restrict the NTP peers. The access control right mechanism
provides only a minimum degree of security protection for the system running NTP. A more secure method is identity
authentication. For more information, see “NTP” in the Network Management and Monitoring Configuration Guide and
Command Reference Guide.
NTP authentication—Configuring NTP authentication provides some assurance that NTP messages are exchanged
between trusted NTP peers. For more information on how to configure NTP authentication, see “NTP” in the Network
Management and Monitoring Configuration Guide and Command Reference Guide.