Core: Layer 3 Control Plane

Securing routing protocols

Miro Kosut

Miro Kosut

— 2 min read
Share

In one line

Protect adjacency formation and route integrity so the control plane can't be spoofed, hijacked, or DoSed.

Techniques (apply at every trust boundary)

  • Neighbor authentication - OSPF/IS-IS/EIGRP key-chains; BGP TCP-AO (legacy MD5).
  • Passive interfaces - never form adjacencies toward hosts/access edges.
  • Control-plane protection - CoPP and interface ACLs to rate-limit/permit only expected protocol traffic.
  • GTSM / TTL-security - drop BGP packets that didn't originate one hop away.
  • Prefix controls - max-prefix limits, prefix/bogon filtering, and RPKI/ROA origin validation at the edge. Match the max-prefix action to the session: discard/reset on eBGP, warning-only on iBGP - resetting a core or RR session amputates far more than it protects.
  • Path validation - ASPA - RPKI validates only the origin, so it stops mis-origination but not route leaks (a legitimate origin re-advertised along an unauthorised path). ASPA publishes signed provider-authorisation records per AS, letting validators check the whole AS_PATH against declared customer->provider relationships - leak protection layered on origin validation.
  • Anti-loop tagging - tag routes on redistribution and deny tagged routes back (see Redistribution and route manipulation).
  • uRPF - drop spoofed sources.

Why it matters for design

A single rogue adjacency or one accepted bogus prefix can blackhole or redirect traffic. Authentication + filtering at every boundary is cheap insurance and an expected CCDE design reflex.

IPv6 / dual-stack note

Secure v6 routing equally: RA Guard, v6 ACLs, and OSPFv3/IS-IS authentication for the v6 topology.

Spaced repetition

The BGP mechanism that drops packets which did not originate one hop away is [...].

The BGP mechanism that drops packets which did not originate one hop away is GTSM / TTL-security.

You stop a routing protocol from forming adjacencies on host-facing links by making them [...].

You stop a routing protocol from forming adjacencies on host-facing links by making them passive interfaces.

BGP origin validation against signed route announcements at the internet edge uses [...].

BGP origin validation against signed route announcements at the internet edge uses RPKI / ROA.

RPKI validates only the origin AS; [...] adds signed provider-authorisation records so the whole AS_PATH can be checked - closing the [...] gap.

RPKI validates only the origin AS; ASPA adds signed provider-authorisation records so the whole AS_PATH can be checked - closing the route leak gap.

Sources

  • Cisco Live BRKMPL-2103 (2026): ASPA path validation; max-prefix action split (eBGP discard/reset vs iBGP warning).
  • Cisco Press, CCNP/CCIE Security Core SCOR; Optimal Routing Design.

domain: Core · blueprint-ref: Core 3.2.g Securing routing protocols · type: concept · status: complete · tags:

Read more