Propagating black hole shunts to remote routers with split tunnel and IPSec direct encapsulation

• US 20070104197A1
• Filed: 11/09/2005
• Published: 05/10/2007
• Est. Priority Date: 11/09/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: King, Joel
• Granted Patent: US 7,873,993 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Remote routers are configured to block the return path to malicious websites with the use of split tunneling while allowing paths to third party resource websites. The iBGP protocol runs on the agent'"'"'s router, advertises routes and enables the head-end to set up a policy at each remote router. Enterprise policies for blocking access to “blackholed” website addresses are centrally administered but third party website traffic is not routed to the enterprise'"'"'s network resources. Since remote offices may connect directly to third party websites, latency is minimized and network resources at the enterprise are not unduly burdened.

Claims

1. A method for managing a network having at least one remote router coupled to a head-end location, said method comprising:

identifying at least one rogue website;

advertising the address of said at least one rogue website to said remote router to set up a centrally administered policy at said remote router; and

blocking traffic from said rogue website at said remote router by routing packet traffic destined for said rogue website to a black hole shunt at said remote router.

2. The method of claim 1 wherein the said remote router is coupled to said head-end location by a split IPSec tunnel.

3. The method of claim 1 further comprising blocking incoming traffic from said rogue website at a firewall.

4. The method of claim 1 further comprising configuring a shunt router to advertise the address of said rogue website to said remote router.

5. The method of claim 1 further comprising configuring a route reflector internal border gateway protocol (iBGP) router to push the address of said rogue website to said remote router.

6. The method of claim 5 further comprising routing packet traffic destined to said rogue website to a Null0 interface at said remote router.

7. The method of claim 1 wherein the address of said rogue website identifies a rogue web server.

8. The method of claim 1 wherein said remote router has either a static IP address or a dynamic IP address.

9. The method of claim 1 further comprises:

defining a central policy that identifies a websites associated with an email phishing scheme.

10. The method of claim 1 further comprising configuring a route reflector internal border gateway protocol (iBGP) router to advertise the address of said rogue website to at least one peer remote router so that traffic destined to said website is blackholed.

11. A network topology comprising:

an enterprise head-end having at least one shunt router coupled to a remote router by a split IPSec tunnel, said remote router having a Null0 IP route to blackhole traffic destined for a rogue address identified by said shunt router.

12. The network topology of claim 11 further comprising a route reflector iBGP router for advertising blackholed addresses to said remote router.

13. The network topology of claim 11 wherein said route reflector router and said remote router are BGP peers.

14. The network topology of claim 11 wherein said route reflector router and said remote router are coupled by an IPSec tunnel.

15. The network topology of claim 14 wherein traffic between said head-end and said remote router is sent on said IPSec tunnel.

16. The network topology of claim 14 wherein said router blackholes traffic destined for a rogue website.

17. The network topology of claim 11 further comprising:

means for defining a central policy to block access to a websites associated with an email phishing scheme.

18. A network topology comprising:

an enterprise head-end having at least a shunt router;

a remote router coupled to said head-end by a split IPSec tunnel, said remote router having a Null0 IP route to blackhole traffic destined for rogue address identified by said shunt router; and

means for generating a list of blackholed website addresses and for advertising said list to said peer routers.

19. In a network system having a router coupled to a peer shunt router by an IPSec split tunnel, a method for blocking access to a malicious website comprising:

receiving, at said router, a central policy that specifies that access to said malicious website is denied for outgoing traffic;

sending traffic destined for said malicious website to a black hole; and

blocking incoming traffic from said malicious website.

20. The method of claim 19 for further comprising:

advertising said central policy to said router using the internal border gateway protocol (iBGP).

21. The method of claim 20 wherein said black hole comprises a route having an address of:

ip route 192.0.2.0 255.255.255.0 Null0 name TEST_NET.

22. The method of claim 21 further comprising:

establishing a TCP session from said router to said malicious website;

propagating said central policy to said router, said central policy comprising a list of “

blackholed”

website; and

entering the route to the malicious website at said shunt router.