UDP protocols and campus network design (draft)

[gdt]

The network time protocol has been used as traffic multipliers in denial of service attacks. This article looks at the choices in distributing time throughout a campus network.

Anti-spoofing. Interfaces connect to routers or to hosts, not to both. Do anti-spoofing for each host-facing subnet. At your border reject packets with your network in the source address, you can do that through routing plus anti-spoofing, or through a ACL.

Use application firewalls in your DMZ. NTP, DNS, SIP, H.323. Don't send all traffic through your general-purpose firewall as it can add less value (for example, it can't check DNSSEC responses for validity).

NTP

Run a GPS-based time server. GPS is run by the US Air Force and is closely monitored, so it's accuracy is understood. This will require an external antenna on the building with good views to the horizons and arranging this is usually the most difficult part of the exercise.

You need three additional servers, so that they can vote down your misbehaving GPS receiver. For security reasons those servers should be outside the GPS receiver's horizon, so that a local RF-based attack doesn't succeed against the remote servers too.

Internally run at least two NTP servers in your interior-facing DMZ, peered together. These are the ones your hosts are configured to use.

If you run multicast, block NTP multicast at the edge. Provide your own NTP on that multicast address within the interior.

On the firewall block all NTP, in and out. An interior host should only be able to reference the official servers within the site. An exterior host should not be able to reach a host which is unknowingly providing a NTP service.

DNS

H.323, SIP and QoS

These also control access to the Voice and Video QoS classes, so on the firewall reset other users of those DSCPs Users should be able to set two QoS classes: best effort and scavenger. Other QoS use should go via a application proxy to be validated.

Reset incoming DSCP to addresses other than the voice and video gateways.