Subject: RE: [VRRP] Security Issues with VRRP

From: "PC Drew" <[email-masked]>
Date: Tue, 26 Nov 2002 16:47:57 -0700

The only problem that I have with just notifying the administrator is
that in the time it takes for the administrator to see the error and fix
the misconfiguration, all traffic going through the two machines using
VRRP is probably halted.

Using my previous example with Router A and Router B where Router B is
the misconfigured router, if Router A comes up at 8:00AM and Router B
comes up at 9:00AM, then from 9:00AM until the router configuration is
changed, the two routers would be at odds with each other regarding who
is the master.  That could mean a whole lot of down time that might be
avoided by simply not allowing Router B to come up.

I totally agree that notifying the administrator MUST occur, I'm just
wondering what the effects would be of only notifying the administrator.

-----Original Message-----
From:	Mukesh Gupta
Sent:	Tue 11/26/2002 12:50 PM
To:	[email-masked]
Cc:	
Subject:	Re: [VRRP] Security Issues with VRRP
[WG chair hat ON]

I agree with Bob.

For the following reasons, I would prefer the solutions that will inform
the
administrator about the authentication failure.

- Authentication mechanisms in VRRP (or in other routing protocols) do
not
provide much security against various possible attacks on LANs.
- VRRP is supposed to be running in an enterprize network which is
secured
from the internet via other means.
- There are many VRRP implementations already out there so making major
changes to the protocol will not be a good idea.

So please don't digress to new schemes and try to decide if "notifying
the
administrator" is enough or not.

Anyone who thinks that "notifying the administrator about the
authentication
failure" doesn't suffice, please speak up. If we don't hear anything
back for
a week or so, I would consider the matter resolved.

regards
Mukesh

ext Bob Hinden wrote:

> One thing to keep in mind when thinking about the appropriate
> authentication measures in VRRP is that once a node is connected to a
LAN,
> there are many attacks that can be performed.  For example an attacker
can
> send bogus ARP replies, listen to all traffic, forward packets to new
> places, etc.  Strong authentication in VRRP doesn't help with any of
> these.  An attacker can disrupt communication a LAN without going to
the
> trouble of implementing VRRP.  I suggest that it is better to focus on
> detecting misconfiguration, than worrying too much about using strong
> authentication to prevent attacks.
>
> The consequences of being misconfigured only results in two masters
that
> forward packets to the same destination.  This is better than having
no
> VRRP routers forwarding traffic :-)
>
> Solutions that inform the people configuring the routers via console
> messages, SNMP traps, etc., seem a reasonable approach to me.
>
> Bob
>
> _______________________________________________
> vrrp mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/vrrp

_______________________________________________
vrrp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/vrrp

---

From: "Don Provan" <[email-masked]>
Date: Wed, 27 Nov 2002 10:14:51 -0800

Why do you say that? Theoretically, two masters shouldn't cause a problem,
so long as they're both functioning correctly. The switch might be a problem
as it's not clear (to me, anyway) how a switch will react to being yanked
back and forth between two systems both sending advertisements using the
same MAC source address. But I think the protocol already depends on layer 2
to deliver packets to the last node that used the virtual router's MAC
address. That means we'd expect the traffic to always get to one of the two
routers.

So some good things aren't happening -- flows are being split, the load
isn't balanced as intended, etc. -- but I don't see that anything bad will
happen. On the other hand, I'm reasonably convinced that *any* action that
causes an authentication failure to shutdown a router creates a security
hole that's easily exploitable to deny service. (Unless, as was suggested
but vetoed, we change everything to make authentication depend on a trusted
third party, which I think would be overkill even if it were reasonable to
make that significant a change.)

-don provan
[email-masked]

> From: PC Drew [mailto:[email-masked]]On Behalf Of PC Drew
> Sent: Tuesday, November 26, 2002 3:48 PM
> To: Mukesh Gupta; [email-masked]
> Subject: RE: [VRRP] Security Issues with VRRP
> 
> 
> The only problem that I have with just notifying the 
> administrator is that in the time it takes for the 
> administrator to see the error and fix the misconfiguration, 
> all traffic going through the two machines using VRRP is 
> probably halted.
> 
> Using my previous example with Router A and Router B where 
> Router B is the misconfigured router, if Router A comes up at 
> 8:00AM and Router B comes up at 9:00AM, then from 9:00AM 
> until the router configuration is changed, the two routers 
> would be at odds with each other regarding who is the master. 
>  That could mean a whole lot of down time that might be 
> I totally agree that notifying the administrator MUST occur, 
> I'm just wondering what the effects would be of only 
> notifying the administrator.
> 
> 
> For the following reasons, I would prefer the solutions that 
> will inform the
> - Authentication mechanisms in VRRP (or in other routing 
> protocols) do not
> - VRRP is supposed to be running in an enterprize network 
> which is secured
> So please don't digress to new schemes and try to decide if 
> "notifying the
> failure" doesn't suffice, please speak up. If we don't hear 
> anything back for
> > authentication measures in VRRP is that once a node is 
> connected to a LAN,
> > there are many attacks that can be performed.  For example 
> an attacker can
> > these.  An attacker can disrupt communication a LAN without 
> going to the
> > The consequences of being misconfigured only results in two 
> masters that
> > forward packets to the same destination.  This is better 
> than having no