Capstone: Securing Network Borders

Congratulations on reaching the capstone chapter of our network security module! Up to this point, you have explored packet filtering mechanics, configured standard and extended access lists, and designed multi-tier demilitarized zones. Now, you will combine all of these protective measures to defend an enterprise perimeter router against real-world internet threats.

Edge routers face continuous scrutiny from automated botnets, scanning scripts, and distributed denial of service (DDoS) reflection attacks. In this capstone project, you will deploy industry-standard Ingress Anti-Spoofing Filters based on RFC 2827 and BCP 38, block dangerous management protocols from reaching the router chassis, and verify full perimeter resilience.

The Threat of IP Address Spoofing

Because standard IPv4 packet headers do not include cryptographic sender verification, an attacker on the public internet can easily forge (spoof) the source IP address inside an outgoing packet. An attacker might transmit malicious exploit payloads to your public edge router while claiming to originate from your internal private subnet (such as 192.168.1.50).

If your edge router accepts packets arriving on its external WAN interface with internal private source addresses, your internal firewall rules can be tricked into trusting that malicious packet! Furthermore, attackers use IP spoofing to launch massive reflection attacks, sending queries with a forged victim IP address so that innocent servers bombard the victim with overwhelming response traffic.

Constructing the RFC 2827 Ingress Anti-Spoofing Filter

To implement Best Current Practice 38 (BCP 38) and RFC 2827 on an enterprise edge router, network engineers bind an extended access control list inbound on the external internet interface. The access list explicitly drops any incoming packet whose source address belongs to private or non-routable address space:

# Drop inbound spoofed private source addresses on WAN link
Router(config)# ip access-list extended WAN_INBOUND_FILTER
Router(config-ext-nacl)# 10 deny ip 10.0.0.0 0.255.255.255 any
Router(config-ext-nacl)# 20 deny ip 172.16.0.0 0.15.255.255 any
Router(config-ext-nacl)# 30 deny ip 192.168.0.0 0.0.255.255 any
Router(config-ext-nacl)# 40 deny ip 127.0.0.0 0.255.255.255 any
Router(config-ext-nacl)# 50 deny ip 169.254.0.0 0.0.255.255 any

# Permit legitimate public internet responses and authorized traffic
Router(config-ext-nacl)# 100 permit tcp any host 203.0.113.10 eq 443
Router(config-ext-nacl)# 200 permit icmp any any echo-reply
Router(config-ext-nacl)# 999 deny ip any any

By enforcing this filter on interface GigabitEthernet0/1 (the WAN uplink), the router discards illegitimate spoofed traffic before it can penetrate into the internal corporate switching fabric.

Protecting the Router Control Plane

Beyond protecting internal user PCs and servers, edge security requires hardening the router itself. The router CPU and operating system—collectively known as the Control Plane—must never accept administrative connections from random public internet addresses.

Insecure legacy protocols like Telnet (port 23) and SNMPv1/v2 community queries must be completely blocked on the WAN interface. Administrative terminal access should be restricted to encrypted SSH (port 22) originating strictly from designated administrative VPN subnets. This ensures that credential sniffing attacks and automated dictionary password sprays are completely blocked at the perimeter.

Hands-On Capstone Project

In this comprehensive capstone lab, you will audit the edge defense of an enterprise gateway router connecting an internal office LAN to an external ISP simulation cloud. You will examine the anti-spoofing ingress filter, verify that external packets with spoofed RFC 1918 private source addresses are immediately rejected, and confirm that legitimate outbound corporate traffic and web responses flow without interruption.

Upon completing this exercise, you will have mastered the practical security tools and packet filtering methodologies necessary to protect modern networks from unauthorized intrusion.