Tại sao cần bảo mật LAN?
LAN (Local Area Network) là "xương sống" kết nối mọi thiết bị trong tổ chức. Giả định "bên trong an toàn" đã lỗi thời. Tấn công nội bộ (Insider threat, Compromised device, Lateral movement, Ransomware spread) bắt nguồn từ LAN. Cần áp dụng Zero Trust: "Never trust, always verify" ngay cả bên trong LAN.
Chiến lược Defense in Depth cho LAN (7 Lớp bảo vệ)
- Lớp 1 - Vật lý & Quản trị (Physical & Administrative):
- Khóa rack server, cabinet mạng, port bảo vệ (port lock)
- Chính sách: Clean desk, no tailgating, visitor escort, asset tagging
- Phân đoạn rack: Management network, Production, DMZ, Backup, Out-of-band
- Lớp 2 - Ranh giới LAN (Perimeter - North/South):
- Firewall/NGFW tại Internet edge, Data Center edge, Branch edge
- IPS/IDS, DDoS Protection, SSL/TLS Inspection, Threat Intelligence Feed
- DNS Security (RPZ, DNS Firewall - Cisco Umbrella, Infoblox, Quad9)
- Lớp 3 - Phân đoạn mạng (Segmentation - East/West):
- VLAN + ACL (Basic): User, Server, Management, IoT, Guest, OT/ICS, DMZ - Inter-VLAN routing qua firewall/L3 switch ACL
- Micro-segmentation (Advanced): Host-based (Illumio, Guardicore/Akamai, VMware NSX, Calico, Cilium) - policy theo workload/identity, không phụ thuộc IP
- Zero Trust Network Access (ZTNA): Thay thế VPN, least privilege access per app/resource
- Lớp 4 - Kiểm soát truy cập mạng (Network Access Control - NAC):
- 802.1X (EAP-TLS/PEAP) cho wired/wireless - Machine auth + User auth
- Posture Assessment: AV running, disk encrypted, patch level, domain joined → Assign VLAN/ACL dynamic
- Guest/Contractor/IoT: Captive portal, MAB (MAC Auth Bypass), Profiling, Quarantine VLAN
- Cisco ISE, Aruba ClearPass, FortiNAC, Portnox, Cloud-native (JumpCloud, Kolide)
- Lớp 5 - Bảo vệ Endpoint trên LAN:
- EDR/XDR (CrowdStrike, SentinelOne, Defender for Endpoint, Cortex XDR)
- Application Control / Allowlisting (AppLocker, WDAC, Carbon Black)
- Disk Encryption (BitLocker, FileVault, LUKS)
- Patch Management (WSUS, SCCM/Intune, Automox, JetPatch)
- Local Firewall (Windows Defender Firewall, nftables/iptables, pf) - Default Deny Inbound
- Lớp 6 - Giám sát & Phát hiện (Monitoring & Detection):
- Network Traffic Analysis (NTA/NDR): ExtraHop, Corelight (Zeek), Darktrace, Vectra, Cisco Secure Network Analytics (Stealthwatch)
- NetFlow/IPFIX/sFlow collection & Analysis (Plixer, Kentik, ntopng, ElastiFlow)
- SPAN/TAP/Network Packet Broker (Gigamon, Keysight, Niagara) feed SIEM/NDR
- SIEM: Splunk, Elastic, Sentinel, QRadar - Correlation rules, MITRE ATT&CK mapping
- Deception Technology: Canary tokens, Honeytokens, Honeypots (Thinkst Canary, Illusive)
- Lớp 7 - Phản hồi & Phục hồi (Response & Recovery):
- Network Quarantine/Containment: Automated via NAC/EDR/SOAR (block switch port, VLAN quarantine, host isolation)
- Network Forensics: PCAP retention (rolling buffer), Zeek logs, Full packet capture cho critical segment
- Backup & DR: Offline/Immutable backup, Network config backup (Ansible, NetBox, GitOps)
Cấu hình Switch/Router an toàn (Hardening)
| Biện pháp | Lệnh Cisco mẫu | Mục đích |
|---|---|---|
| Disable unused ports | `interface range gi1/0/1-24` → `shutdown` | Giảm attack surface vật lý |
| Port Security | `switchport mode access` → `switchport port-security` → `switchport port-security maximum 2` → `switchport port-security violation restrict` | Giới hạn MAC/port, chống rogue device |
| BPDU Guard / Root Guard | `spanning-tree portfast bpduguard default` / `spanning-tree guard root` | Chống STP manipulation, rogue switch |
| DHCP Snooping + DAI | `ip dhcp snooping` → `ip dhcp snooping vlan 10,20` → `ip arp inspection vlan 10,20` | Chống DHCP rogue, ARP spoofing |
| Dynamic ARP Inspection | `ip arp inspection validate src-mac dst-mac ip` | Validate ARP packet |
| IP Source Guard | `ip verify source` | Chặn IP spoofing trên port access |
| Private VLAN (PVLAN) | `switchport mode private-vlan host` → `switchport private-vlan host association 100 200` | Cô lập port trong cùng VLAN (shared hosting, DMZ) |
| Control Plane Policing (CoPP) | `policy-map type control-plane COPP` → `class COPP-CRITICAL` → `police 1000000` → `control-plane` → `service-policy input COPP` | Bảo vệ CPU switch/router khỏi DoS |
| Management Plane Hardening | `no ip http server` → `ip http secure-server` → `ip ssh version 2` → `management-interface VRF Mgmt` | Chỉ cho phép HTTPS/SSH, VRF tách quản trị |
| AAA + TACACS+/RADIUS | `aaa new-model` → `tacacs server TAC` → `address ipv4 10.1.1.10` → `key 7 SECRET` → `aaa authentication login default group tacacs+ local` | Tập trung xác thực, phân quyền, accounting |
Wireless LAN Security (Wi-Fi Enterprise)
- WPA3-Enterprise (SAE) hoặc WPA2-Enterprise (802.1X/EAP-TLS) - KHÔNG PSK cho corporate
- EAP-TLS (Certificate-based) - mạnh nhất, không password
- NAC integration: Posture check trước khi assign VLAN
- Guest Wi-Fi: Captive portal + Isolation (no internal access) + Rate limit + Content filter
- IoT/OT Wi-Fi: PSK mạnh + MAB + Profiling + Dedicated VLAN + Egress firewall rules
- RF Monitoring: Rogue AP detection, RF interference, Client fingerprinting
Kiểm tra & Đánh giá an ninh LAN định kỳ
- Internal Network Penetration Test (6 tháng/lần)
- Vulnerability Scan nội bộ (hàng tuần/tuần) - Credentialed scan
- Network Architecture Review (hàng năm): Segmentation, ACL, Firewall rule review (redundant, shadowed, expired)
- NAC/802.1X Effectiveness Test: Rogue device connection attempt
- Wireless Site Survey & Security Assessment (hàng năm)
- Purple Team Exercise: Simulate lateral movement, credential dumping, C2 trên LAN
- Configuration Audit: CIS Benchmark cho Switch/Router/Firewall/AP
Công cụ hỗ trợ (Tooling)
- Network Automation: Ansible (network modules), Nornir, Netmiko, Scrapli, Terraform (Network as Code)
- Network Source of Truth: NetBox, Nautobot, IP Fabric - IPAM, DCIM, Cable, Device, Config context
- Compliance/Config Audit: ciscoconfparse, Batfish, Netmiko + TextFSM, Golden Config (Ansible)
- Visualization: IP Fabric, Forward Networks, NetBrain, GraphNet - Dependency map, Path analysis, Blast radius
Kết luận
An ninh LAN hiện đại không chỉ là "đặt firewall ở gateway". Yêu cầu: Zero Trust Architecture + Micro-segmentation + NAC 802.1X + NDR/NTA + EDR/XDR + Automation + Continuous Validation. Bắt đầu từ: Visibility (NetFlow/SPAN) → Segmentation (VLAN/ACL → Micro-seg) → NAC (802.1X) → Hardening Switch → Monitoring (NDR/SIEM) → Automated Response. Đầu tư vào Network Source of Truth (NetBox) và Automation (Ansible) sớm để quản trị bền vững.