LAN security-HSRP attack and Prevention

The working principle of HSRP is not introduced here. I believe everyone knows it.

Here is only the characteristics of HSRP:

1. 1 HSRP virtualizes a brand new IP address and MAC address.
2. 2. The host address version of HSRP is 224.0.0.2 (vrouters of all local networks), and the host address of version 2 is 224.0.0.102 (all HSRP vrouters ).
3. The TTL of HSRP is 1, so it is impossible to implement cross-network attacks.
4. The default verification password is in plaintext "cisco"
5. IPV4 uses UDP port 1985 and IPV6 uses UDP port 2029.

How to create a virtual MAC:

The packet capture method is used to verify the above correctness:

I set MAC to 10.

Verify the plaintext key:

Three TTL Verification

We can see from the above that it is very easy to attack a HSRP. We use a notebook to install a fake router, first use the packet capture software to check if HSRP is used, and then set the fake router www.2cto.com priority to 255, then, all received packets are discarded to implement a DOS attack.

Of course, HSRP is also a gateway, and man-in-the-middle attacks can also be easily implemented.

Precaution:

1. Use strong authentication

Key chain hsrp
Key 1
Key-string root

 

Standby 10 authentication md5 key-chain hsrp

 

Verification:

 

Problems:

This method is not feasible for replay attacks. We can use vlan map and ios acl.

Only valid HSRP protocols and port security are allowed.

It indicates that the HSRP version is incorrectly displayed due to the software I captured. Due to my limited level, it is inevitable that an error will occur. I hope my friends can point it out.

The configuration is as follows: http://up.2cto.com/2012/0511/20120511102848619.rar

From wenlf136's BLOG