The call for microsegregation and zero trust

This diagram is turned inside out by the zero trust model. In the modern landscape of cyberattacks, stopgaps are significantly lacking in comparison to the designs of the past. Among the disadvantages are:

• Inadequate traffic inspections within zones

• Physical and logical host placement are inflexible

• A single point of failure

By removing network locality requirements, VPNs are no longer required. An IP address can be obtained remotely through a virtual private network (VPN). In the remote network, the traffic is decapsulated and routed after tunneling from the device. No one ever suspected that it was the greatest backdoor.

VPN, along with other modern network constructs, is suddenly rendered obsolete by declaring network location to be of no value. By putting enforcement at the edge of the network, this mandate reduces the core’s responsibility while pushing enforcement as far as possible. In addition, stateful firewalls are available in all major operating systems, and advances in switching and routing have made it possible to install advanced capabilities at the edge. It is time for a paradigm shift based on all of these gains.

Implementing Zero Trust

Micro-segmentation is a fundamental component of implementing a zero-trust network. It divides the network into smaller, more manageable, and secure zones, enabling organizations to precisely regulate data flow between different sectors of the network.

Zero trust emphasizes verification over blind trust, which requires this level of control. Regardless of the network environment, each segment is subject to strict access and security policies.

Microsegmentation enables the following capabilities:

• Due to their isolation and relatively small size, segments can be closely monitored because they are more visible.

• By defining associated policies, granular access control is possible.

Micro-segmentation is crucial to mitigating the risk of threats spreading within the network in today’s ever-growing threat landscape. It prevents breaches from spreading and causing broader compromises by isolating them to specific segments. Micro-segmentation enables organizations to manage and secure diverse network environments with a unified framework as they adopt hybrid and multi-cloud architectures.

Software-defined Perimeter

Logically air-gapped, dynamically provisioned, on-demand software-defined perimeter networks minimize the risk of network-based attacks and isolate them from unsecured networks. Drop-all firewalls enable SDPs to enhance security by requiring authentication and authorization before users or devices can access assets concealed by the SDP system. SDP also restricts connections into the trusted zone based on who may connect, from what devices to what services and infrastructure, and other factors.

IPv6 Data Center Microsegmentation

When examining a technology insight for microsegmentation, we can consider using IPv6 for the data center network microsegmentation. Datacenter micro-segmentation techniques vary depending on the data center design requirements. However, the result will be more or less the same with your technique. Network microsegmentation is a network security technique that enables security architects to logically divide the data center into distinct security segments down to the individual workload level, then define security controls and deliver services for each segment. In this technology insight for microsegmentation, we will address IPv6 micro-segmentation. 

Layer-2 Security Issues

When discussing our journey on IPv6 data center network microsegmentation, we must consider that Layer-2 security mechanisms for IPv6 are still as complicated as those for IPv4. Nothing has changed. We are still building the foundation of our IPv6 and IPv4 networks on the same forwarding paradigm, relying on old technologies that emulate thick coaxial cable, known as Ethernet. Ethernet should be limited to where Ethernet was designed: the data link layer between adjacent devices. Unfortunately, the IP+Ethernet mentality is tightly coupled with every engineer’s mind.

Before you proceed, you may find the following helpful post for pre-information.

1. Zero Trust Security Strategy
2. Zero Trust Networking
3. IPv6 Attacks
4. IPv6 RA
5. IPv6 Host Exposure
6. Computer Networking
7. Segment Routing

Back to basics with network security

Securing network access and data center devices has always been a challenging task. The new network security module is Zero Trust (ZT); it is a guiding concept that indicates the network is always assumed to be hostile and external and internal threats always exist. As a result, the perimeter has been moved closer to the workload. Zero Trust mandates a “never trust, always verify, enforce least privilege” approach, granting least privilege access based on a dynamic evaluation of the trustworthiness of users and their devices and any transaction risk before they can connect to network resources. A core technology for zero Trust is the use of microsegmentation.

Enhanced Security

One of the key benefits of microsegmentation is its ability to enhance network security. Organizations can isolate critical data and applications by segmenting the network into smaller parts, limiting their exposure to potential threats. In a security breach, microsegmentation prevents lateral movement, containing the attack and minimizing the possible impact. This fine-grained control significantly reduces the attack surface, making it harder for cybercriminals to infiltrate and compromise sensitive information.

Improved Compliance

Compliance with industry standards and regulations is a top priority for organizations operating in heavily regulated industries. Microsegmentation plays a crucial role in achieving and maintaining compliance. By isolating sensitive data, organizations can ensure that only authorized individuals have access to it, meeting the requirements of various regulations such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA). Microsegmentation provides the necessary controls to enforce compliance policies and protect customer data.

Efficient Resource Utilization

Another advantage of microsegmentation is its ability to optimize resource utilization. Organizations can allocate resources more efficiently based on specific requirements by segmenting the network. For example, critical applications can be assigned dedicated resources, ensuring their availability and performance. Additionally, microsegmentation allows organizations to prioritize network traffic, ensuring mission-critical applications receive the necessary bandwidth while less critical traffic is appropriately managed. This efficient resource allocation leads to improved performance and reduced latency.

Simplified Security Management

Contrary to what one might expect, microsegmentation can simplify security management for organizations. With a traditional security approach, managing complex network policies and access controls can be challenging, especially as networks grow in size and complexity. Microsegmentation simplifies this process by breaking the network into smaller, more manageable segments. Security policies can be easily defined and enforced at the segment level, reducing the complexity of managing security across the entire network.

Data Center Micro-Segmentation

What is Layer 2? And why do we need it? Layer 2 is the layer that allows adjacent network devices to exchange frames. Every layer 2 technology has at least three components:

1. Start-of-frame indication.
2. End-of-frame indication.
3. Error correction mechanism in case the physical layer cannot guarantee the error-free transmission of zeroes and ones.

• A key point: Layer 2 MAC address

You may have realized I haven’t mentioned the layer 2 MAC address as a required component. MAC addresses are required when more than two devices are attached to the same physical network. MAC addresses are in Ethernet frames because the original Ethernet standard used a coax cable with multiple nodes connected to the same physical medium.

Therefore, layer 2 addressing on point-to-point Fiber Channel networks is not required, while you need layer 2 addressing on shared cable-based Ethernet networks. One of the main reasons for the continuation of MAC addresses in Ethernet frames is backward compatibility. More importantly, no one wants to change device drivers in every host deployed in a data center or Internet.

Technology Insight for Microsegmentation and IPv6

 “IPv6 microsegmentation is an approach used to solve security challenges in IPv6.”

Firstly, when discussing data center network microsegmentation, with IPv6 micro-segmentation, we have many layer-2 security challenges. Similar to the IPv4 world, the assumption is one subnet is one security zone. This can be represented as a traditional VLAN with a corresponding VLAN ID or a more recent technology of VXLAN with a corresponding VXLAN ID.

Devices in that domain are in one security domain, and all enjoy the same level of trust, representing several IPv6 security challenges. If intruders break into that segment, they can exploit that implicit trust between all devices. The main disadvantage is that intra-subnet communication is not secured, and multiple IPv6 first-hop vulnerabilities ( RA and NA spoofing, DHCPv6 spoofing, DAD DoS attacks, and ND DoS attacks).

A review of IPv6 security

The attacker can spoof the neighbor advertisement messages and affect the ND cache on the host. Thus, it takes over and intercepts traffic sent to other hosts. It can also intercept DHCP requests and pretend to be a DHCP server, redirecting traffic to itself or DoS attacks with incorrect DNS records. The root cause is that everything we operate on today simulates the thick coaxial cable we use for Ethernet. In the early days, Ethernet segments had one coaxial cable segment, and all stations could attach to this segment, resulting in one large security domain. Networks evolved, and new technologies were introduced. 

The coaxial cable was later replaced with thin cable and hubs to switches. Unfortunately, we haven’t changed the basic forwarding paradigm we used 40 years ago. We still emulate thick coaxial cable while relying on the same traditional basic forwarding paradigm. The networking industry is trying to fix the problem without addressing and resolving the actual source of the problem.

The networking industry is retaining the existing forwarding paradigm while implementing a layer-2 security mechanism to overcome its limitations. All these layer-2 security measures ( first-hop security ) lead to complex networks from design and operational aspects. They are adding more kludges; hence, every technology tries to fix the shortcomings when they should be addressing the actual source of the problem.

In the layer 2 world, everyone tries to retain the existing forwarding paradigm, even with the most recent data center overlay technologies. For example, they are still trying to emulate the thick coaxial cable over the VXLAN segment over IP. VXLAN uses historic flooding behavior. In the IPv6 world, to overcome shortcomings with layer 2, vendors started implementing a list of first-hop layer-2 security mechanisms. Implementing these to secure the layer 2 IPv6 domain would be best.

All these features are complicated technologies to implement. They are used solely to fix the broken forwarding paradigm of layer 2—recent issues with MLD ( multicast listener discovery protocol ), which is part of IPv6. MLD can break into multicast streams on Local Area Networks ( LAN ) and gain control of first-hop router communication. So, in the future, we will need to implement MLD guard as a new first-hop security mechanism. The list goes on and on—a constant cat-and-mouse game. So, we need to ask ourselves whether we can do better than that. And what can we implement or design to overcome these shortcomings? Just get rid of layer 2? :

We can remove layer 2 from “some” networks. If the first-hop router is a layer 3 device, we don’t need to implement all the security kludges mentioned above. However, as end hosts have Ethernet cards, we would still need Ethernet between the end host and router. Using a layer 3 device as the first hop immediately removes all IPv6 spoofing attacks.

For example, RA Gaurd is unnecessary as the router will not listen to RA messages. ND spoofing is impossible as you can’t bridge ND across segments. However, DoS attacks are still possible. This layer 3-only design is implemented on xDSL and Mobile networks—designed by putting every host in a /64 subnet. But; now, we are returning to 64-bit segments to implement security between segments.

• Is this possible to use in the data center when moving VMs across mobility domains?

Technology Insight For Microsegmentation

IPv6 micro-segmentation for the data center

In data centers, we have issues with live VM migration. We must move VMs between servers while retaining IPv6 addresses to keep all Transmission Control Protocol ( TCP ) sessions intact. Layer 3 solutions exist but are much slower ( as layer 3 routing protocol convergence is slower than layer 2 convergence ) than we can get with simple flooding of MAC address with reverse Address Resolution Protocol ( ARP ) and gratuitous ARP.

We usually have some VLAN that spans the domain with an actual VLAN or VXLAN segment. VLANs must span the entire mobility domain, expanding the broadcast domain throughout the network. Expanding the broadcast domain also broadens the scope of layer 2 security attacks. Private VLANs exist, but on a large scale, private VLANs are messy and complex.

You can use one VLAN per VM, which would cause an explosion of VLAN numbers. You still need to terminate layer 3 on Core switches, meaning all traffic between two VM must traverse to Core. Inter-VLAN communication is sent to Core ( layer 3 devices) even when the VM sits on the same hypervisor. Not a good design.

Also, if you want mobility across multiple core switches, you can’t aggregate traffic and must pass the IPv6 prefixes to support VM mobility. Now, we have loads of /64 prefixes in the IPv6 forwarding table when using one prefix per VM. Vendors like Brocade only support 3k IPv6 prefixes, and Juniper supports up to 1k. In the future, this scale limitation will represent design problems. So, do we need some other type of design? We need to change the forwarding paradigm. In an ideal world, use layer-3 only networks, layer-3 devices as first-hop devices, and still support VM mobility. At the same time, it does not generate many IPv6 prefixes.

Intra-subnet ( host route ) layer 3 forwarding

Is it possible to design and build layer-3-only IPv6 networks without assigning a /64 prefix to every host?

Intra-subnet layer 3 forwarding implements /128 for hosts, which is propagated with updates across the network. At a host level, nothing changes. It can use DHCP or other mechanisms to get its address. Now that we are using /128, we don’t need to use the IPv6 forwarding table for this prefix. Instead, we can put the /128 into IPv6 Neighbor Discovery ( ND ) entries.

This is how the ND cache is implemented on hardware-based platforms. There is no difference between ND entities and 128-host routes in the IPv6 routing table. The critical point is that you can use ND entries instead of the IPv6 forwarding table, which, by default, has small table sizes on most platforms.

For example, the Juniper EX series can have 32k ND entities but only 1K IPv6 entries. This design trick can significantly increase the number of hosts under an IPv6 microsegmentation design.

Data center network microsegmentation

Cisco dynamic fabric automation ( DFA )

Virtual Machine microsegmentation with Cisco DFA allows you to implement a VLAN per VM addressing scheme without worrying about VLAN sprawl and all those problems experienced with provisioning. More importantly, all layer 3 traffic is not terminated on the core switch but on the leaf switch.