Hello, my name is Paolo Cruschelli.
I am an enterprise cloud architect working for a
cloud service provider in Italy.
In this course named Identity Management,
Authentication, and Access Control with VyOS,
we will learn what is VyOS platform,
how it fits within a NIST cyber security framework,
and what are the main features provided by VyOS.
Then we'll have four different labs to understand how VyOS can be deployed,
configured, and operated in a real‑world enterprise environment.
Let's go.
What is VyOS?
VyOS is an open‑source network operating system.
VyOS is a flexible platform suitable for cloud deployments.
What is the story behind the VyOS? After Brocade Communications stopped
development of Vyatta Core edition of the Vyatta Routing software, a
small group of people in 2013 took the last Community Edition, operated a
fork, and started building on it. The company which sits behind the
development of VyOS solution is named Sentrium S.L., and is led by those
three guys I have marked as VyOS creators. Let me provide you some more
details on VyOS. VyOS is a virtual platform with a wide range of features.
We have most common routing protocols (BGP, OSPF, policy‑based routing).
We have firewall features. We have a VPN in many flavors,
IPSEC, OpenVPN, GRE, L2TP. Current release is Long Term
Stable 1.3 release, which is a commercial product for which
you need to pay a subscription.
Otherwise, you can build from code or you can download a rolling
release or a pre LTS snapshot. Please take note that all the demos are
based on a full feature free version R1.3. VyOS is a very flexible
solution that you can deploy in a wide range of scenarios from bare
metal to virtual deployments.
Also take note that the VyOS R1.3 is available on major
public clouds (AWS, Azure, Google Cloud).
Finally,
I strongly recommend having a look to the public site, which is very
well maintained and user friendly. There you can find plenty of
information from licensing to admin documentation and knowledge base.
How VyOS fits to NIST cyber security framework? Let me try to explain
with a diagram. NIST is articulated in five main functions, namely,
Identify, Protect,
Detect, Respond, and Recover. The Protect function
is composed by many categories.
Let's focus for the moment on the Identity Management
Authentication and Access Control category, which in turn
is composed by many subcategories.
The one we are targeting here is PR.AC‑5, which is titled Network integrity is
protected. VyOS is a network platform which can act as the cornerstone for a
network segmentation and segregation strategy, thanks to its enhanced feature
set, its performances, and its flexibility.
One of the most typical attacks is called lateral movement attack.
Let's have a look on how it works.
Most common infrastructure design, I should say legacy design, is
made up of servers built around a flat network with a perimeter
firewall to protect against attackers.
What is lateral movement?
It is the ability of an attacker, once is able to compromise a single
server, to attack other servers leveraging on the poor security
policy, which rules the east to west traffic.
How we can prevent this scenario? By deploying a well‑designed
network segmentation and segregation strategy.
Let me provide some more details on network segmentation and segregation.
Network segmentation is the capability to partition
the network in smaller segments.
The first and most important effect is that the exposed surface is reduced,
being a single segment not visible to the other ones.
And typically, network segmentation can be realized with several approaches.
I mean VLAN, VRFs, VPNs, according if your goal is to
operate segmentation at layer 2, layer 3,
or at overlay layer. Apart from the protocol, the most critical part when
implementing a network segmentation is the design phase. On the other end,
network segregation is the capability to enforce a ruleset to control traffic
flows between endpoints. As a consequence,
a security policy is applied to traffic flows within your
infrastructure, and typically, this is implemented by means of a
wide range of firewall types and access control list. And now
it's time to run some demos.