Server room, modern data center. 3D illustration

Technology Insight For Microsegmentation

 

IPv6 Microsegmentation

 

Technology Insight For Microsegmentation

In today’s digital landscape, cybersecurity has become a critical concern for organizations. With the ever-evolving threat landscape, traditional security measures are no longer sufficient to protect sensitive data and systems. Enter microsegmentation – a cutting-edge security technique that offers granular control and enhanced protection. This blog post will explore microsegmentation and its benefits for modern businesses.

Microsegmentation is a security strategy that divides a network into small, isolated segments, allowing for more refined control over data traffic and access privileges. Unlike traditional network security approaches that rely on perimeter defenses, microsegmentation focuses on securing each segment within a network. By implementing this technique, organizations can establish strict security policies and reduce the risk of lateral movement within their networks.

 

Highlights: Microsegmentation

  • IPv6 Data Center Microsegmentation

When examining a technology insight for microsegmentation, we can consider using IPv6 for the data center network microsegmentation. Datacenter micro-segmentation techniques vary depending on the data center design requirements. However, the result will be more or less the same with your technique. Network microsegmentation is a network security technique that enables security architects to logically divide the data center into distinct security segments down to the individual workload level, then define security controls and deliver services for each segment. In this technology insight for microsegmentation, we will address IPv6 micro-segmentation. 

  • Layer-2 Security Issues

When discussing our journey on IPv6 data center network microsegmentation, we must consider that Layer-2 security mechanisms for IPv6 are still as complicated as with IPv4. Nothing has changed. We are still building the foundation of our IPv6 and IPv4 networks on the same forwarding paradigm, relying on old technologies that emulate thick coaxial cable, known as Ethernet. Ethernet should be limited to where Ethernet was designed: the data link layer between adjacent devices. Unfortunately, the IP+Ethernet mentality is tightly coupled with every engineer’s mind.

 

Before you proceed, you may find the following helpful post for pre-information.

  1. Zero Trust Security Strategy
  2. Zero Trust Networking
  3. IPv6 Attacks
  4. IPv6 RA
  5. IPv6 Host Exposure
  6. Computer Networking
  7. Segment Routing

 



Technology Insight For Microsegmentation

Key Technology Insight For Microsegmentation Discussion Points:


  • Introduction to network microsegmentation and what is involved.

  • Highlighting the details of this type of segmentation and the benefits it offers.

  • Critical points on microsegmentation and IPv6.

  • Technical details on IPv6 security.

  • Technical solutions for IPv6 in the data center with IPv6 micro-segmentation.

 

Back to basics with network security

Securing network access and data center devices has always been a challenging task. The new network security module is Zero Trust (ZT); it is a guiding concept that indicates the network is always assumed to be hostile and external and internal threats always exist. As a result, the perimeter has been moved closer to the workload. Zero Trust mandates a “never trust, always verify, enforce least privilege” approach, granting least privilege access based on a dynamic evaluation of the trustworthiness of users and their devices and any transaction risk before they can connect to network resources. A core technology for zero Trust is the use of microsegmentation.

Enhanced Security

One of the key benefits of microsegmentation is its ability to enhance network security. Organizations can isolate critical data and applications by segmenting the network into smaller parts, limiting their exposure to potential threats. In a security breach, microsegmentation prevents lateral movement, containing the attack and minimizing the potential impact. This fine-grained control significantly reduces the attack surface, making it harder for cybercriminals to infiltrate and compromise sensitive information.

Improved Compliance

Compliance with industry standards and regulations is a top priority for organizations operating in heavily regulated industries. Microsegmentation plays a crucial role in achieving and maintaining compliance. By isolating sensitive data, organizations can ensure that only authorized individuals have access to it, meeting the requirements of various regulations such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA). Microsegmentation provides the necessary controls to enforce compliance policies and protect customer data.

Efficient Resource Utilization

Another advantage of microsegmentation is its ability to optimize resource utilization. Organizations can allocate resources more efficiently based on specific requirements by segmenting the network. For example, critical applications can be assigned dedicated resources, ensuring their availability and performance. Additionally, microsegmentation allows organizations to prioritize network traffic, ensuring mission-critical applications receive the necessary bandwidth while less critical traffic is appropriately managed. This efficient resource allocation leads to improved performance and reduced latency.

Simplified Security Management

Contrary to what one might expect, microsegmentation can actually simplify security management for organizations. With a traditional security approach, managing complex network policies and access controls can be challenging, especially as networks grow in size and complexity. Microsegmentation simplifies this process by breaking the network into smaller, more manageable segments. Security policies can be easily defined and enforced at the segment level, reducing the complexity of managing security across the entire network.

 

Network Microsegmentation

Data Center Micro Segmentation

What is Layer 2? And why do we need it? Layer 2 is the layer that allows adjacent network devices to exchange frames. Every layer 2 technology has at least three components:

  1. Start-of-frame indication.
  2. End-of-frame indication.
  3. Error correction mechanism in case the physical layer cannot guarantee the error-free transmission of zeroes and ones.
data center network microsegmentation
Diagram: Starting the journey to data center network micro segmentation.

 

  • A key point: Layer 2 MAC address

You may have realized that I haven’t mentioned the layer 2 MAC address as a required component. MAC addresses are required when more than two devices are attached to the same physical network. MAC addresses are in Ethernet frames because the original Ethernet standard used a coax cable with multiple nodes connected to the same physical medium.

Therefore, layer 2 addressing on point-to-point Fiber Channel networks is not required, while you need layer 2 addressing on shared cable-based Ethernet networks. One of the main reasons for the continuation of MAC addresses in Ethernet frames is backward compatibility. More importantly, no one wants to change device drivers in every host deployed in a data center or Internet.

 

Technology Insight for Microsegmentation and IPv6

 “IPv6 microsegmentation is an approach used to solve security challenges in IPv6.”

Firstly, when discussing data center network microsegmentation, with IPv6 micro-segmentation, we have many layer-2 security challenges. Similar to the IPv4 world, the assumption is one subnet is one security zone. This can be represented as a traditional VLAN with a corresponding VLAN ID or a more recent technology of VXLAN with a corresponding VXLAN ID.

Devices in that domain are in one security domain, and all enjoy the same level of trust, representing several IPv6 security challenges. If intruders break into that segment, they can take advantage of that implicit trust between all devices. The main disadvantage is that intra-subnet communication is not secured, and multiple IPv6 first-hop vulnerabilities ( RA and NA spoofing, DHCPv6 spoofing, DAD DoS attack, and ND DoS attacks) exist.

 

IPv6 security
Diagram: IPv6 security.

 

A review of IPv6 security

The attacker can spoof the neighbor advertisement messages and affect the ND cache on the host. Thus, take over and intercept traffic sent to other hosts. It can also intercept DHCP requests and pretend to be a DHCP server, redirecting traffic to itself or DoS attacks with incorrect DNS records. The root cause is that everything we operate on today simulates the thick coaxial cable we use for Ethernet. In the early days, Ethernet segments had one coaxial cable segment, and all stations could attach to this segment, resulting in one large security domain. Networks evolved, and new technologies were introduced. 

The coaxial cable was later replaced with thin cable and hubs to switches. Unfortunately, we haven’t changed the basic forwarding paradigm we used 40 years ago. We are still emulating thick coaxial cable while relying on the same traditional basic forwarding paradigm. The networking industry is trying to fix the problem without addressing and resolving the actual source of the problem.

The networking industry is retaining the existing forwarding paradigm while implementing a layer-2 security mechanism to overcome its limitations. All these layer-2 security measures ( first-hop security ) lead to complex networks both from design and operational aspects. They are adding more kludges; hence, every technology tries to fix the shortcomings when they should be addressing the actual source of the problem.

data center micro segmentation

In the layer 2 world, everyone tries to retain the existing forwarding paradigm, even with the most recent data center overlay technologies. For example, they are still trying to emulate the thick coaxial cable over the VXLAN segment over IP. VXLAN uses historic flooding behavior. In the IPv6 world, to overcome shortcomings with layer 2, vendors started implementing a list of first-hop layer-2 security mechanisms. Implementing these to secure the layer 2 IPv6 domain would be best.

All these features are complicated technologies to implement. They are used solely to fix the broken forwarding paradigm of layer 2—recent issues with MLD ( multicast listener discovery protocol ), which is part of IPv6. MLD can break into multicast streams on Local Area Networks ( LAN ) and gain control of first-hop router communication. So, in the future, we will need to implement MLD guard as a new first-hop security mechanism. The list goes on and on—a constant cat-and-mouse game. So, we need to ask ourselves whether we can do better than that. And what can we implement or design to overcome these shortcomings? Just get rid of layer 2? :

We can remove layer 2 from “some” networks. If the first-hop router is a layer 3 device, we don’t need to implement all the security kludges mentioned above. We would still need Ethernet between the end host and router as end hosts have Ethernet cards. Using a layer 3 device as the first hop, we immediately remove all IPv6 spoofing attacks.

For example, RA Gaurd is unnecessary as the router will not listen to RA messages. ND spoofing is impossible as you can’t bridge ND across segments. However, DoS attacks are still possible. This type of layer 3-only design is implemented on xDSL and Mobile networks—designed by putting every host in a /64 subnet. But; now, we are returning to 64-bit segments to implement security between segments.

 

  • Is this possible to use in the data center when moving VMs across mobility domains?

 

Technology Insight For Microsegmentation

IPv6 micro-segmentation for the data center

In data centers, we have issues with live VM migration. We must move VMs between servers while retaining IPv6 addresses to keep all Transmission Control Protocol ( TCP ) sessions intact. Layer 3 solutions exist but are much slower ( as layer 3 routing protocol convergence is slower than layer 2 convergence ) than we can get with simple flooding of MAC address with reverse Address Resolution Protocol ( ARP ) and gratuitous ARP.

We usually have some VLAN that spans the domain with an actual VLAN or VXLAN segment. VLANs must span the entire mobility domain, expanding the broadcast domain throughout the network. Expanding the broadcast domain also broadens the scope of layer 2 security attacks. Private VLANs exist, but on a large-scale private VLANs are messy and complex.

You can use one VLAN per VM, which would cause an explosion of VLAN numbers. You still need to terminate layer 3 on Core switches, meaning all traffic between two VM must traverse to Core. Inter-VLAN communication is sent to Core ( layer 3 devices) even when VM sits on the same hypervisor. Not a good design.

Also, if you want mobility across multiple core switches, you can’t aggregate traffic and must pass the IPv6 prefixes to support VM mobility. Now, we have loads of /64 prefixes in the IPv6 forwarding table when using one prefix per VM. Vendors like Brocade only support 3k IPv6 prefixes, and Juniper supports up to 1k. In the future, this scale limitation will represent design problems. So, do we need some other type of design? We need to change the forwarding paradigm. In an ideal world, use layer-3 only networks, layer-3 devices as first-hop devices, and still support VM mobility. At the same time not generate not than many IPv6 prefixes.

 

Intra-subnet ( host route ) layer 3 forwarding

Is it possible to design and build layer-3-only IPv6 networks without assigning a /64 prefix to every host?

Intra-subnet layer 3 forwarding implements /128 for hosts, which is propagated with updates across the network. At a host level, nothing changes. It can use DHCP or other mechanisms to get its address. Now that we are using /128, we don’t need to use the IPv6 forwarding table for this prefix. Instead, we can put the /128 into IPv6 Neighbor Discovery ( ND ) entries.

This is how the ND cache is implemented on hardware-based platforms. There is no difference between ND entities and 128-host routes in the IPv6 routing table. The Important point is that you can use ND entries instead of the IPv6 forwarding table, which by default in most platforms has small table sizes.

For example, the Juniper EX series can have 32k ND entities but only 1K IPv6 entries. This design trick can significantly increase the number of hosts under an IPv6 microsegmentation design.

 

Data center network microsegmentation

Cisco dynamic fabric automation ( DFA )

Virtual Machine microsegmentation with Cisco DFA allows you to implement a VLAN per VM addressing scheme without worrying about VLAN sprawl and all those problems experienced with provisioning. More importantly, all layer 3 traffic is not terminated on the core switch but on the leaf switch. 

 

Technology Insight For Microsegmentation