Router/Switch authentication in the network

He doesn't want authentication on the devices themselves, or at least that is not what he has asked for. He is looking to stop a device from coming onto the network without proper authentication, similar to that of dot1x, to ensure that someone doesn't turn up a router that influences traffic. To be honest, my first answer is to use authentication on your routing protocols to ensure that a false router cannot come online and begin participating in advertisements on the network. Additionally, secure your rooms with your network equipment to ensure that your only risk is someone plugging in a router at their desk, which would be worthless if you use auth on your routing protocols. I do understand what you are asking for, but locking down every IP to a MAC address or authentication mechanism is not practical in most scenarios (although I'm not doubting that you may really need this setup). I would encourage you to protect from major gaps or risks, while not going crazy and making a network that is too needy to manage efficiently. If you lock down your network rooms, use authentication like TACACs for your devices, use authentication on your routing protocols, you should protect yourself from the majority of risks. That isn't to say someone can't do a man in the middle attack and spoof your routers IP to sniff traffic, but at least it will not be manipulating the core of your network routing/switching wise.

the other posters have suggested some places to start, but lots of organisations have issued "best practice" guides for this kind of thing - so some Google searches will get you going.

the are some cisco best practice guides around for routers rather than generic security - try

Additionally, secure your rooms with your network equipment

This may be putting the cart before the horse as at some point you will find you need to compromise cost against hassle and operational support etc.

At that point you need to decide which things you will do 1st / only - and you need to decide which things work well for you.

the mantra from a security expert starts with "what is your security policy" - before you starting deciding what to do it is a good idea to decide why and how much ....

try

routing:

Thanks for the quick responses :) I went over the majority of the best practice guides you've suggested. My network devices are secure behind strong lockers and md5 authentication will likely be used between routers. BTSH for OSPF/EIGRP would have been great if it were available, but all in all the routers and switches are physically secure with routing updates being authenticated. The unresolved issue being addressed is if someone wants to add a switch or router to the network edge, or possibly the core (even though it's far less likely). For example our team has been given a scenario of someone trying to get by Dot1x authentication by connecting a simple switch at the user port where the supplicant was, and connecting the supplicant to that simple switch along with an attacker's host. It is suggested that under this scenario the dot1x will be foiled since the supplicant will be validated by the authenticating switch and afterwards both the supplicant and the attacker computer will have access to the network since Dot1x isn't point to point. That is an example why authentication of the network device itself is a solution I'm looking into.

Would the scenario I mentioned really allow the attacker's computer to gain access to the network?

The security aspects of the network are a top priority, i'd prefer to not map static MACs to each switch and router if other mechanisms can properly secure the network, since spoofing MACs is two lines of work in any *nix system and a simple matter of freeware for Windows systems. If routing authentication, physical security, dot1x, firewalls between vlans, and strongly encrypted VPNs between networks is enough to be considered world class security, then that's great to hear. By the way this is a single private autonomous system, no BGP is necessary.

Again thanks for your input :)

try

routing:

you could "plug" this hole by limiting how many MAC addresses are allowed per port on a switch - 2 or more MACs and the port goes into ErrDisable state. The default state on a 4500 at least is that only 1 device is allowed on a port.

Note this will not stop a traffic sniffer from recieving copies all packets on that port as long as it never sends anything, and if 2 devices end up with the same MAC you might be able to get around it that way.

However - i think you need to work through where your "trust" boundary should be, and what security you need.

Your description sounds like a recipe for end to end encryption / authentication at the application level rather than worrying about LANs and devices.

Not by default on IOS AFAICT, but it may not be too much work to get around that.

Given you are pushing the limits on common network deployments, you need to verify anything you do, test it, try penetration attacks and so on.

and did anyone mention you will need to spend lots of money, resources and time to get this done?

I suspect this is one of those "buy lots of gear and lock some engineers in a lab for 6 months" type problems :)

i suspect the only way you will "push" this to individual devices and make sure authentication is per device is to use IPsec VPN or something else with encryption as an overlay.

in that case your threoretical bad guy may be able to spoof his way onto the network - but user traffic is in encrypted tunnels and that doesnt get him to a useful end point.

Now making that work for all devices on a network - difficult.

Ever seen a printer with IPsec, or a badge card reader etc, or all the other wierd devices that get hooked up these days?

Given your constraints you cannot use separate encryption boxes as that gives the attacker a point to get to the unencrypted traffic.