Service Provider Security — the practice of defending a large-scale network from attacks that could disrupt service for millions of users. For the 350-501 exam, you need to understand how an ISP protects its own infrastructure, not just its customers, using three specific layers: the management plane, the control plane, and the data plane. This chapter breaks down those layers, the tools used to secure each one, and the exact concepts you will be tested on.
Jump to a section
A simple way to picture Service Provider Security
How does a service provider keep its network safe without slowing down every packet? Think about a major international airport. The airport must protect itself from threats—unauthorised people, dangerous items—while still letting thousands of legitimate passengers flow through smoothly every hour. That is exactly what a service provider does with its network, and it uses three layers of security, just like an airport.
The first layer is the terminal itself—the 'management plane'. This is like the airport's staff-only areas and central security office. Only authorised employees with special badges can enter. A hacker who gets into the management plane can change flight schedules or disable security cameras. Similarly, if someone gains access to a router's management interface (like SSH or SNMP), they can control the entire network. Service providers protect this with strong passwords, encryption, and access control lists that say 'only these IP addresses can even try to log in'.
The second layer is the departure gate—the 'control plane'. This is where air traffic controllers decide which planes take off, land, and in what order. In a network, the control plane is the router's brain, running protocols like OSPF and BGP to decide how traffic flows. An attacker could flood the control plane with fake routing information, causing delays or crashes. Providers use Control Plane Policing (CoPP) to rate-limit control plane traffic, just as an airport limits how many planes can talk to the tower at once.
The third layer is the passenger itself—the 'data plane'. This is the actual traffic moving through the network, like passengers walking through the terminal. The airport uses baggage screening and metal detectors to inspect each passenger. In a network, the data plane forwards packets, and threats like malware or DoS attacks hide inside. Service providers use ACLs and firewalls to filter this traffic without inspecting every single packet on the fast path.
Service provider security is about protecting the core of an internet service provider's network. Unlike a small office network, an ISP's routers handle traffic for thousands or millions of customers. If one router goes down, it can knock entire cities offline. That is why service providers build security into the network itself, not just as an add-on.
Let us start with the three planes of a router. Every router, from a small home device to a massive carrier-grade router, has three logical parts: the management plane, the control plane, and the data plane. Think of them as separate 'rooms' inside the router, each with a different job.
The management plane is the 'staff-only' area. This is how a network engineer logs into the router to configure it, check its status, or troubleshoot. Common protocols used here are SSH (Secure Shell) for command-line access, SNMP (Simple Network Management Protocol) for monitoring, and syslog for logging. If an attacker gets into the management plane, they can change the router's configuration, disable security features, or even steal routing tables. To protect it, service providers use strong authentication (like usernames and passwords), encryption (TLS or SSH), and access control lists (ACLs) that restrict which IP addresses are allowed to connect. They may also use management plane protection features like 'login block-for' to lock out an IP after too many failed attempts.
The control plane is the 'brain' of the router. It runs routing protocols like OSPF (Open Shortest Path First) and BGP (Border Gateway Protocol) to learn how to reach different networks. It also handles protocols like ARP (Address Resolution Protocol) and ICMP (Internet Control Message Protocol). The control plane is constantly receiving packets from other routers—hello messages, routing updates, and keepalives. An attacker can send a flood of these packets to overwhelm the CPU, causing the router to drop legitimate routing updates or even crash. This is called a control plane denial-of-service (DoS) attack. Service providers protect the control plane using Control Plane Policing (CoPP). CoPP creates a policy that says, 'only allow a certain amount of control plane traffic per second; drop the rest'. For example, a provider might allow 1000 BGP packets per second from a known peer, and drop anything beyond that. This ensures the router's CPU stays responsive even during an attack.
The data plane is the 'highway' for user traffic. This is where actual packets from customers—web traffic, video streams, email—get forwarded from one interface to another. The data plane is designed to forward packets at very high speed, often using dedicated hardware like ASICs (Application-Specific Integrated Circuits). Because it runs at wire speed, the data plane cannot do complex security checks on every packet without slowing down. Instead, service providers use ACLs and firewall rules to filter traffic at the edge of the network, before it enters the core. For example, an ISP might block incoming packets with source IP addresses from its own internal ranges (anti-spoofing) at the ingress interface.
Now, let us look at BGP security specifically. BGP is the protocol that connects different ISPs and exchanges routes across the internet. It is often called 'the glue that holds the internet together'. But BGP was designed in the 1980s without security in mind—anyone can announce any IP prefix, and other routers will believe it. This allows a malicious actor to hijack IP addresses by announcing a more specific prefix or a prefix that is not theirs. To prevent this, service providers use several mechanisms:
BGP prefix filtering: Routers are configured with filters that only accept routes for IP blocks that the neighbour is authorised to announce. For example, an ISP will only accept routes for its own customers' IP ranges.
Route maps and prefix lists: These are used to match and filter specific attributes of a route, such as the AS path (the list of autonomous systems the route has passed through).
BGP TTL security check (GTSM): This ensures that a BGP packet is coming from a neighbour that is only one hop away, preventing spoofed packets from far away.
RPKI (Resource Public Key Infrastructure): This is a newer framework where IP address holders digitally sign their route announcements. Routers can then validate that a BGP update actually came from the legitimate owner of the prefix.
Another critical concept is infrastructure ACLs (iACLs). These are ACLs applied to routers specifically to protect the routers themselves, not user traffic. They block any traffic that should not be destined to the router's own IP addresses. For example, a typical iACL would deny inbound packets directed to TCP port 23 (Telnet) except from a management subnet. It would also drop packets with source IP addresses from RFC 1918 private ranges (like 10.0.0.0/8) because those should never come from the internet.
Management plane protection also includes login enhancements, such as 'aaa new-model' for authentication, accounting, and authorisation, and using local or RADIUS/TACACS+ servers for centralised access control. The exam loves to test the difference between local authentication (using a username/password stored on the router) and server-based authentication (where a central server like RADIUS checks credentials).
Finally, the exam covers CoPP configuration and verification. You need to know how to create a class-map that matches control plane traffic (e.g., BGP, SSH, ICMP), how to create a policy-map that sets police rates and actions (drop, transmit), and how to apply it to the control plane using 'service-policy input' under 'control-plane' configuration mode. You also need to know how to verify it with 'show policy-map control-plane'.
Identify the Threat
First, determine what type of attack or vulnerability you are addressing. For example, if a router's CPU is spiking because of ICMP floods, you need control plane protection. If a BGP session is receiving unauthorised routes, you need prefix filtering. This step determines which security mechanism to apply.
Classify Traffic with a Class-Map
For CoPP, create a class-map that identifies the specific control plane traffic you want to police, such as BGP packets or SSH. For example, 'match protocol bgp' matches BGP traffic. For an infrastructure ACL, define the traffic with an extended ACL statement.
Define a Policy or Rule
Create a policy-map for CoPP that assigns a police action (rate and action) to the class-map. For example, 'police 10000 2000 exceed-action drop' limits traffic to 10 kbps with a burst of 2000 bytes. For ACLs, define permit or deny statements based on source/destination IP, protocol, and port.
Apply the Policy to the Correct Location
For CoPP, apply the policy-map under the 'control-plane' configuration mode with 'service-policy input <policy-name>'. For an interface ACL, apply it to the ingress direction of the external interface using 'ip access-group <acl-name> in'. This places the filter at the correct point in the packet path.
Verify and Monitor
Use 'show policy-map control-plane' to see how many packets matched or were dropped by CoPP. Use 'show ip access-list <name>' to check ACL hit counts. Monitoring ensures the policy is working as expected and not dropping legitimate traffic. Adjust police rates or ACL entries if needed.
Imagine you work as a junior network engineer for an ISP called 'FastRoute'. One morning, the senior engineer gets an alert: one of your core routers (router CE-1) is showing high CPU usage. You jump on a troubleshooting call. What do you do?
First, you log into the router via SSH (you know to use SSH, not Telnet, because Telnet is unencrypted). You type 'show processes cpu' and see that the control plane process is using 95% CPU. That is bad—routing updates might be dropped.
Next, you check 'show ip bgp summary' to see if BGP sessions are flapping. They are not, but you notice the router is receiving a massive number of ICMP echo requests (pings) directed at its own IP address. Someone is launching a ping flood against the router's control plane.
You need to stop it fast. You remember the CoPP configuration your company uses. You check 'show policy-map control-plane' and see that your CoPP policy is already applied, but it has a default permit clause for unknown traffic. That means the flood is being permitted. You need to modify the policy.
You create a new ACL and class-map to match ICMP traffic, then update the policy-map to police that traffic to 1 Mbps, dropping excess. You apply it to the control plane with 'service-policy input CoPP-Filter'. Within 30 seconds, CPU drops to 30%. The router is stable. You document the change.
That same month, you are asked to harden all edge routers with infrastructure ACLs. Your boss gives you a checklist:
Deny inbound traffic with source IP equal to your internal management subnet (to prevent reflection attacks).
Deny inbound traffic with destination IP that is a broadcast address.
Only allow SSH from a specific management IP range.
Drop packets with source IP from RFC 1918 private ranges.
You create the ACL and apply it to all external interfaces using 'ip access-group INFRA-ACL in'.
Later, you are on a call with a downstream customer who wants to exchange BGP routes. You set up a new peering session. Before enabling it, you apply prefix filtering to only accept their /22 prefix, not any /24 they might accidentally or maliciously announce. You also enable BGP TTL security (GTSM) to prevent spoofed BGP packets from far away.
In a real ISP, these tasks happen daily. The exam tests whether you know the exact commands, the order of operations (ACL applied before CoPP? Actually, CoPP is applied after ACL, but the ACL is typically applied on interfaces), and the rationale behind each step.
The 350-501 exam tests Service Provider Security in a dedicated section that covers control plane protection, BGP security, and management plane protection. You will see around 10-15 questions on these topics. They are not just theory—they test your configuration knowledge and troubleshooting skills.
Key concepts the exam loves to test:
CoPP (Control Plane Policing): You must know the difference between 'police' and 'drop'. The exam expects you to know that CoPP uses a policy-map applied under 'control-plane' configuration mode. They may give you a scenario where a router's CPU is high, and ask which command to use: 'show policy-map control-plane' to verify. They may also ask about the 'class-map' matching criteria—for example, matching BGP traffic using 'match protocol bgp'.
Infrastructure ACLs (iACLs): The exam tests your ability to identify which traffic should be permitted or denied in an iACL. A typical trap: they might say 'an ACL applied to an interface blocks all inbound traffic to the router'. The correct answer is that an iACL is applied to the interface, not the control plane, and it filters traffic destined to the router's own IP addresses.
BGP security mechanisms: You must know RPKI, BGP prefix filtering, and max-prefix (to limit the number of routes a neighbour can send). The exam may present a scenario where a neighbour is sending too many routes, and ask what to configure: 'neighbor x.x.x.x maximum-prefix 1000'. They also test the difference between TTL security (GTSM) and MD5 authentication. MD5 authenticates the BGP session itself; GTSM prevents spoofed packets by checking TTL value.
Management plane protection: Questions on SSH versus Telnet, ACLs for management access, and AAA authentication. Expect a question like 'which protocol should you use to securely manage a router?' Answer: SSH. Also know that 'login block-for' is a feature that locks out access after a number of failed attempts.
Traps they set:
They may ask about 'control plane protection' and list 'ACL' as an option. Be careful: an ACL applied to an interface protects the data plane and the router's control plane (indirectly), but CoPP is applied directly to the control plane. The exam wants you to distinguish between the two.
They might ask 'which configuration reduces control plane load?' Options could include 'ACL', 'CoPP', and 'qos'. The best answer is CoPP because it directly polices control plane traffic.
For BGP, they often test 'prefix-list' versus 'route-map'. The exam expects you to know that a prefix-list matches only prefix and length, while a route-map can match and modify attributes.
Memorise these command patterns: - 'control-plane' + 'service-policy input <policy-name>' - 'ip access-list extended <name>' + 'deny ip any <management-subnet>' - 'neighbor <ip> maximum-prefix <number>' - 'neighbor <ip> password <string>' (MD5)"
A router has three planes: management (config and monitoring), control (routing protocols), and data (forwarding traffic).
Control Plane Policing (CoPP) protects the router's CPU by rate-limiting traffic destined to the control plane.
An infrastructure ACL (iACL) is applied to interfaces to block unwanted traffic directed at the router itself.
BGP prefix filtering and maximum-prefix limits prevent route leaks and hijacking from misconfigured or malicious neighbours.
RPKI validates that a BGP route announcement comes from the legitimate owner of the IP prefix, if the network has configured enforcement.
Management plane protection uses SSH, AAA authentication, and login block-for to secure remote access to routers.
These come up on the exam all the time. Here's how to tell them apart.
Control Plane Policing (CoPP)
Applied directly to the control plane (CPU) via policy-map
Can rate-limit and drop traffic based on protocol and class-map
Best for protecting against CPU overload from control plane traffic
Infrastructure ACL (iACL)
Applied to the interface (ingress or egress)
Only permits or denies traffic based on packet headers (source/destination IP, port)
Best for blocking unwanted traffic at the network edge before it reaches the router
BGP MD5 Authentication
Authenticates the entire BGP session using a shared secret
Prevents sessions from being spoofed or hijacked
Works over multiple hops (if configured)
BGP TTL Security Check (GTSM)
Checks TTL value of incoming BGP packets (expects 255 or 254)
Prevents spoofed packets from distant attackers
Only works between directly connected neighbours (single hop)
Prefix List
Matches only the prefix (network address) and its length
Cannot modify route attributes; only permit or deny
Simple and fast for filtering BGP routes
Route Map
Can match prefix, AS path, community, and many other attributes
Can set or modify route attributes (e.g., local preference, metric)
More powerful and flexible for complex policy decisions
Mistake
Control Plane Policing and an access control list applied to an interface do the same thing.
Correct
They are different tools for different layers. An ACL on an interface filters traffic that is transiting through the router or destined to it, before the traffic enters the control plane. CoPP is applied directly to the control plane and filters only traffic that is destined to the router's CPU, after it has already passed interface ACLs. CoPP is more specific and granular for protecting the CPU.
Both manage traffic, so beginners assume they are interchangeable. But the order of operation and the scope of filtering are distinct.
Mistake
BGP MD5 authentication prevents route hijacking.
Correct
MD5 authentication only ensures that the BGP session between two directly configured neighbours is genuine. It does nothing to verify whether the route content (the prefix and attributes) is legitimate. Route hijacking is prevented by mechanisms like prefix filtering, RPKI, and AS path validation.
The word 'authentication' sounds comprehensive. Beginners think 'protecting the session' equals 'protecting the routing information', but they are different security objectives.
Mistake
If you have CoPP configured, you do not need infrastructure ACLs.
Correct
Infrastructure ACLs provide a first line of defence at the interface level, filtering traffic before it reaches the control plane. CoPP is a second line of defence that polices traffic that has already arrived at the control plane. Both are necessary in a defence-in-depth strategy.
A common efficiency mindset: 'Why do I need two layers?' But they complement each other—ACLs block what they can, and CoPP catches what slips through.
Mistake
RPKI automatically prevents BGP hijacking in real time.
Correct
RPKI provides a validation mechanism (valid, invalid, unknown), but it does not automatically drop routes. The network operator must configure routers to use the RPKI data and enforce actions (e.g., drop invalid routes). Without configuration, RPKI is just an advisory database.
Beginners overestimate automation. RPKI is a tool, not a silver bullet—it requires active configuration and policy enforcement.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
An ACL filters traffic at the interface level, blocking or permitting packets before they reach the router's CPU. CoPP is applied directly to the control plane and polices traffic that has already been accepted by interface ACLs. CoPP is more granular for protecting the CPU.
First, create a class-map to match the traffic (e.g., 'class-map match-all BGP-TRAFFIC match protocol bgp'). Then create a policy-map (e.g., 'policy-map COPP-FILTER class BGP-TRAFFIC police 10000 2000 exceed-action drop'). Finally, enter control-plane config mode and apply 'service-policy input COPP-FILTER'.
No. RPKI provides a validation database (ROAs) that tells you if a route is valid, invalid, or unknown. You must configure your routers to take action based on that validation, such as dropping invalid routes. Even then, it does not stop hijacks where the hijacker uses a legitimately owned prefix.
An infrastructure ACL (iACL) is an extended ACL applied to the ingress of router interfaces that face customers or the internet. It blocks traffic that should never be destined to the router's own IP addresses, such as from private IP ranges or management subnets.
SSH encrypts the entire session, including passwords and configuration data. Telnet sends everything in plain text, so anyone on the network can capture credentials. For management plane security, SSH is mandatory.
No. CoPP only applies to traffic that is destined to the control plane of the router. Data plane traffic (transiting packets) is handled by interface ACLs, QoS, and hardware forwarding. CoPP protects the CPU, not the forwarding path.
You've finished Service Provider Security. Continue through the 350-501 study guide to build a complete picture of the exam.
Done with this chapter?