Medianet Reference Guide - Cisco

Solution
Chapter 1
Medianet Architecture Overview
For these restricted access video scenarios, network virtualization technologies can be deployed to
isolate the endpoints, servers, and corresponding media applications within a logical network partition,
enhancing the security of the overall solution. Cisco Catalyst switching products offer a range of network
virtualization technologies, including Virtual Routing and Forwarding (VRF) Lite and Generic Route
Encapsulation (GRE), that are ideal for logical isolation of devices and traffic.
Securing Media in the Campus
As previously discussed, a layered and integrated approach to security provides the greatest degree of
protection, while at the same time increases operational and management efficiency. To this end, campus
network administrators are encouraged to use the following tactics and tools to secure the Campus
medianet:
Basic security tactics and tools:
• Access-lists to restrict unwanted traffic
• Separate voice/video VLANs from data VLANs
• Harden software media endpoints with Host-based Intrusion Protection Systems (HIPS), like Cisco
Security Agent (CSA)
• Disable gratuitous ARP
• Enable AAA and roles based access control (RADIUS/TACACS+) for the CLI on all devices
• Enable SYSLOG to a server; collect and archive logs
• When using SNMP, use SNMPv3
• Disable unused services
• Use SSH to access devices instead of Telnet
• Use FTP or SFTP (SSH FTP) to move images and configurations around and avoid TFTP when
possible
• Install VTY access-lists to limit which addresses can access management and CLI services
• Apply basic protections offered by implementing RFC 2827 filtering on external edge inbound
interfaces
Intermediate security tactics and tools:
• Deploy firewalls with stateful inspection
• Enable control plane protocol authentication where it is available (EIGRP, OSPF, HSRP, VTP, etc.)
• Leverage the Cisco Catalyst Integrated Security Feature (CISF) set, including:
– Dynamic Port Security
– DHCP Snooping
– Dynamic ARP Inspection
– IP Source Guard
Advanced security tactics and tools:
• Deploy Network Admission Control (NAC) and 802.1x
• Encrypt all media calls with IPSec
• Protect the media control plane with Transport Layer Security (TLS)
• Encrypt configuration files
1-28
Medianet Reference Guide
OL-22201-01