PLNOG15 :Scale and Secure the Internet of Things with Intelligent DNS Services
2 likes170 views
The document discusses the Internet of Things and how it is driving changes to network architectures. It covers using intelligent DNS services to securely scale networks for IoT use cases internally and externally. The topics of DNS security, user protection from protocol abuse, and the operational cost savings of a DNS firewall solution are summarized.
PLNOG15 :Scale and Secure the Internet of Things with Intelligent DNS Services
- 1. Scale and Secure the Internet of Things with Intelligent DNS Services Nigel Ashworth Solution Architect F5 Networks 28th September 2015
- 2. © F5 Networks, Inc 2 • Drivers for the Internet of Things • Architecture changes • Security • Scale • Use cases – Internal and external • CapEx vs OpEx • Audits • Service chaining and DNS • GI Firewall / TCP optimisation / Rate management Agenda • User attributes • Parental control / contracts • White lists and filters • DDOS Attacks • Protocol Abuse • DNS Firewall • Not a Firewall for DNS • Reporting
- 3. Drivers
- 4. © F5 Networks, Inc 4 50 Billion Connected Devices 6 Billion Connected Devices 20202013 20182016 The Driving Force behind Device-Based Network and App Congestion
- 5. © F5 Networks, Inc 5 • Internet of Things needs scalable DNS services • Combination = 5 to 10 times Internet revolution • 10 billion devices in 2014 = 77 billion mobile apps • Ensure really fast connections and responses The Internet of Things and DNS
- 6. © F5 Networks, Inc 6 Connected Cars Connected Homes Connected Cities Wearables/Connected Devices/Utilities Surge in connected devices accessing SP networks Increasing connection rates (Connections per Sec) Spikes in application usage 50B connected devices worldwide by 2020 Surge in DNS queries DNS security vulnerabilities New advanced persistent threat vectors New DDoS attack vectors Network signaling spikes Diameter signaling storms IPv6 addressing requirements Lower ARPU per device Packet Core Gi-LAN Data Centers IMS Core Service Provider Challenges Implications for Service Providers Scaling the networks. End to end security. Profitable new services.
- 7. © F5 Networks, Inc 7 Connected Cars Wearables/Connected Devices/Utilities Surge in connected devices accessing SP networks Increasing connection rates (Connections per Sec) Spikes in application usage 50B connected devices worldwide by 2020 Packet Core Gi-LAN Data Centers IMS Core High Performance Hybrid Architectures Simpler Architecture / Network Flexibility Extensibility Virtualised Network Functions Scalable VNFs Virtual Software Editions • Scalable DNS • Load balancing • Network firewall • Application layer firewall • IPv6 routing • Carrier grade NAT • Traffic classification • Subscriber classification • Application awareness • Diameter routing • Protocol gateway • Policy enforcement Connected Homes Connected Cities Hybrid Architectures
- 8. Use cases
- 9. © F5 Networks, Inc 9 Mobile (e)NodeB SGW/SGSN MME Fixed Fixed Core Mobile Core BRAS DNS/GSLB GGSN/ PGW DNS Caching/ Resolvers Transparent Cache Internet Core Infrastructure DNS64 NAT64 Web Caching WAP Gateways Content Streaming DataPlaneControlPlane PCRF DNS Authoritative Local Zones Subscriber Management HSS/HLR DHCP Activation PKI CSCF Billing/Self Service Customer Portal IP Multimedia Subsystem (IMS) MGCF SBC DNS ENUM Infrastructure Authoritative DNS Auth. Local Zones LDNS Simplified and Consolidated DNS
- 10. © F5 Networks, Inc 10 • Intelligent DNS for Evolved Packet Core • Proactively monitor for service-level adherence • Enhanced subscriber experience • Robust, scalable portal and service access • Exponential DNS performance and DDoS security protection • Optimise global service delivery • Faster DNS for 3G/4G LTE • Enhanced performance through transparent cache • Caching resolver for server consolidation • Mitigate DNS threats by blocking malicious IPs Intelligent DNS and Global Service Optimisation LDNS Authoritative Infrastructure
- 11. Archiecture
- 12. © F5 Networks, Inc 12 Traditional Architectures will Buckle ... under the strain of increasing demand Data volumes double every 18 months Applications double every four years Source: IDC Directions, Battle for the Future of the Datacenter: The Role of Disaggregated Systems, March 2014 Forrester Consulting, April 2014 Customer populations four orders of magnitude larger than employee/partner
- 13. © F5 Networks, Inc 13
- 14. © F5 Networks, Inc 14
- 15. Firewall for DNS or a DNS Firewall ?
- 16. © F5 Networks, Inc 16
- 17. © F5 Networks, Inc 17 Anatomy of a DNS Firewall • IP Anycast • Pre filter • Packet inspection • Performance • Scaling resolution • DNSsec and Validation • Reporting and Automation • DNS Reputational Intelligence • DNS scrubbing • Hardware sizing • Certification
- 18. © F5 Networks, Inc 18 Anatomy of a DNS Firewall • IP Anycast • Pre filter • Packet inspection • Performance • Scaling resolution • DNSsec and Validation • Reporting and Automation • DNS Reputational Intelligence • DNS scrubbing • Hardware sizing • Certification Clients IPv4/IPv6 TCP/UDP Protocol Validatio n+ACL iRules DNSSEC GSLB 6 4 GSLBiRules DNS Express 6 4 DNSSEC RPZ /Cache/ Resolver DNS6-4 DNSLB Pool DNS Server Pool iRules LocalBIND Request Response AXFR Request AXFR Response Zone XFR Zone XFR
- 19. © F5 Networks, Inc 19 Anatomy of a DNS Firewall • IP Anycast • Pre filter • Packet inspection • Performance • Scaling resolution • DNSsec and Validation • Reporting and Automation • DNS Reputational Intelligence • DNS scrubbing • Hardware sizing • Certification Performa nce Time TMOS Single Process or SMP 8x 4x 2x
- 20. © F5 Networks, Inc 20 Anatomy of a DNS Firewall • IP Anycast • Pre filter • Packet inspection • Performance • Scaling resolution • DNSsec and Validation • Reporting and Automation • DNS Reputational Intelligence • DNS scrubbing • Hardware sizing • Certification
- 21. © F5 Networks, Inc 21 Anatomy of a DNS Firewall • IP Anycast • Pre filter • Packet inspection • Performance • Scaling resolution • DNSsec and Validation • Reporting and Automation • DNS Reputational Intelligence • DNS scrubbing • Hardware sizing • Certification Advanced DNS Analytics – Applications – Virtual Servers – Query Name – Query Type – Client IP
- 22. © F5 Networks, Inc 22 Anatomy of a DNS Firewall • IP Anycast • Pre filter • Packet inspection • Performance • Scaling resolution • DNSsec and Validation • Reporting and Automation • DNS Reputational Intelligence • DNS scrubbing • Hardware sizing • Certification RESPONSE POLICY ZONES* URL FILTERING IP INTELLIGENCE Screens a DNS request against domain names with a bad reputation. Categorize the FQDN from the request & make a decision. Categorize the IP address from the response & make a decision. MITIGATES THREATS BY FQDN POLICY CONTROL BY FQDN Ingress DNS path Any IP Protocol with iRules HTTP, HTTPS and DNS with iRules MITIGATES THREATS BY FQDN MITIGATES THREATS BY FQDN
- 23. © F5 Networks, Inc 23 Anatomy of a DNS Firewall • IP Anycast • Pre filter • Packet inspection • Performance • Scaling resolution • DNSsec and Validation • Reporting and Automation • DNS Reputational Intelligence • DNS scrubbing • Hardware sizing • Certification Legitimate Users Threat Feed Intelligence DDoS Attacker ISPa/b Cloud Scrubbing Service Scann er Anonym ous Proxies Anonym ous Request s Botnet Attack ers Network attacks: ICMP flood, UDP flood, SYN flood DNS attacks: DNS amplificatio n, query flood, dictionary attack, DNS poisoning IPS Next-Generation Firewall Tier 2 SSL attacks: SSL renegotiatio n, SSL flood HTTP attacks: Slowloris, slow POST, recursive POST/GET Applicatio n Corporate Users Financial Services E- Commerce Subscriber Tier 2 Threat Feed Intelligence Strategic Point of Control Multiple ISP strategy Network and DNS Tier 1 Access Control, Policy Enforcemen t
- 24. © F5 Networks, Inc 24 Anatomy of a DNS Firewall • IP Anycast • Pre filter • Packet inspection • Performance • Scaling resolution • DNSsec and Validation • Reporting and Automation • DNS Reputational Intelligence • DNS scrubbing • Hardware sizing • Certification Platforms
- 25. © F5 Networks, Inc 25 Anatomy of a DNS Firewall • IP Anycast • Pre filter • Packet inspection • Performance • Scaling resolution • DNSsec and Validation • Reporting and Automation • DNS Reputational Intelligence • DNS scrubbing • Hardware sizing • Certification CONVENTIONAL DNS THINKING Internet External Firewall DNS Load Balancing Array of DNS Servers Internal Firewall Hidden Master DNS DMZ Datacenter F5 PARADIGM SHIFT Internet Master DNS Infrastructure BIG-IP Global Traffic Manager 30M RPS
- 26. User Protection and Protocol Abuse
- 27. © F5 Networks, Inc 27 Updates CACHE RESOLVER PROTOCOL VALIDATION IRULES IPV4/V6 LISTENER REPUTATION DATABASE SPECIAL HANDLING ADC GTM RPZ feed • Prevent malware and sites hosting malicious content from ever communicating with a client • Internet activity starts with a DNS request, inhibit the threat at the earliest opportunity Client Protection Prevent subscribers from reaching known bad domains
- 28. © F5 Networks, Inc 28 • RPZ filters out and provides NXDOMAIN, redirect for know bad domains • URL filtering provides granular policy controls using categories • IP intelligence blocks based on resolved IP, can also be used in data path for other protocols Layered Client Protection QUERY: WWW.DOMAIN.COM DNS iRules (Request / Response) CACHE RESOLVER iControl iQuery Subscriber Policy RPZ IP Intelligence URL Filtering EGRESS DNS PATH INGRESS DNS PATH RPZ Feed IPI Feed URL Feed iRule DNS request path DNS response path
- 29. © F5 Networks, Inc 29 • Classify the traffic • Mobile or fixed • SLA for RPS and allowed response size • When a client sends in a query • Is query for a blocked domain? • Is query rate above allowed rate? • Client previously above allowed rate? • Resolve request and analyse response • Factor in response size to the score • Take an action • Is client above score threshold? • Drop request • Suspend DNS service for a period Preventing DNS Abuse ClientA ClientB ClientC ClientD ClientE ClientF Drop threshold Suspend threshold RESPONSE SIZE SCORING QUERY RATE SCORING
- 30. © F5 Networks, Inc 30 DNS Service Protection Policing Requests for Fairness and Availability Service Providers need to ensure availability of DNS services to customers according to their service level. Intelligent per-Client IP Rate Limiting gives SPs the tools to inhibit bad actors including DNS tunneling, without adversely affecting performance. MALICIOUS ACTOR COMPROMISE D CLIENT REGULAR CLIENT SUSPEND DNS SERVICE RATE LIMIT CLIENT LOG MALICIOUS IDENTITY ACTION S CACHE RESOLVE R Per-client DNS rates Rate limits DNS RATE LIMITER
- 31. © F5 Networks, Inc 31 DNS Tuneling
- 32. © F5 Networks, Inc 32 DNS Tunnelling Enforcement
- 33. © F5 Networks, Inc 33 DNS use case – Service Provider User Black List RPZ IPIOpt in/out Policy and Charging Rules Function Portal User Internet DNS • User Query request • PCRF request / response • Vip choice for protection profiles for: • Adult • Family • Child Exception Match DNS Query
- 34. Capex vs Opex
- 35. © F5 Networks, Inc 35
- 36. © F5 Networks, Inc 36 Lifecycle Costs for Traditional DNS Resolver Infrastructure Fixed and wireless ISP with 1M customers, 200K RPS today to 2M+ by 2016 Traditional DNS Resolver Topology CapExPatchOpEx 3M RPS caching resolver with discrete firewall, load balancer, and 60 DNS servers Investigate threat Design FW rules Review FW rule Test FW rule Deploy FW rule Administrative overhead 2 days 2 days 1 day 2 days 2 days 1 day Vulnerability identified Test patch in lab Deploy patch Revise firewall rules Administrative overhead 3 days 10 days 1 day 1 day Initial patch issued Test patch in lab Deploy patch Administrative overhead 3 days 10 days 1 day Final patch issued 39 days of effort per patch: Historically, traditional DNS servers are patched 6-10 times annually Numbers 39 Days annually @ $40 / hour x9 Patches per year Administration staff (team of 3) Total cost of hardware and maintenance (firewall, load balancer, and 60 servers) $424,800 $12,480 $112,320 $249,600 Total in year 1: $799,200 Total in year 2 onwards: $439,200 vs DNS Resolver Model Local zones 3M RPS caching resolver Test release in lab Deploy firmware 3 days 1 day Annual firmware release Annual maintenance: 4 days Total cost of hardware and maintenance $354,000 4 days annually $1,280 Total in year 1: $355,280 Total in year 2 onwards: $55,280
- 37. Summary
- 38. © F5 Networks, Inc 38 • Internet of Things • Use cases – Internal and external • Architecture changes • Security a DNS Firewall • User protection and Protocol abuse • CapEx vs OpEx Summary