HALNY PRODUCT SECURITY

Dasan OLT devices and switches are L2/L2+/L3 devices. These devices are manageable and should be securely configured at the installation site to reduce the possibility of unauthorized access to the Dasan device. This means that the default configuration of a Dasan OLT or switch does not filter traffic. It is the administrator’s responsibility to deploy the device in the network so that only authorized access to the device is permitted.

A. Initial startup

Please note that during the initial startup, a Dasan OLT or switch has an active console port. In addition, the devices may have a management address assigned to the MGMT interface, such as 192.168.100.1/24; whether the interface is active depends on the device and software version.
Most Dasan OLT devices and switches do not have a default password, so a password must be set immediately for the default “admin” account. The exceptions are the DZS V1-16XC/V1-16XC-E and DNS V6016XC devices, which have a default password. However, this password is not unique to each device and must therefore be changed immediately.

B. Fibrain recommendations for configuring a Dasan OLT or switch:

1. 1. Securing administrative access
      
      • • Change the default usernames, passwords, IP addresses, and manufacturer settings.
      • • Change the default SSH service ports.
      • • Use individual administrator accounts instead of a single shared account.
      • • Enforce strong passwords and account lockout after several failed login attempts.
      • • Use centralized AAA authentication, such as RADIUS or TACACS+.
      • • Create a local emergency account for use if the AAA server is unavailable, and protect it with a strong password.
      • • Assign permissions according to the principle of least privilege.
      • • Regularly remove inactive and unnecessary accounts; they are easiest to manage through an AAA server.
      • • Enable logging of all login attempts and configuration changes.
      • • Use an external syslog server for event logging.
      • • Add a password to Global Config.
   2. Restricting access to the management interface
      
      • • Manage the switch exclusively via SSH, preferably SSHv2.
      • • Disable Telnet, HTTP, and other unencrypted protocols.
      • • Use ACLs to restrict administrative access to specific IP addresses or subnets.
      • • Create a separate management VLAN isolated from the customer network.
      • • The OLT management VLAN should be separated from the ONT management VLAN.
      • • Do not expose the management interface directly to the Internet.
      • • Use a separate out-of-band (OOB) management network.
      • • Provide remote access through a VPN, proxy server, or bastion host.
      • • Disable device management from unauthorized user VLANs by removing IP addressing from the interfaces.
   3. Disabling unused services
      Disable all services that are not required, including:
      
      • • Telnet,
      • • HTTP,
      • • FTP and TFTP,
      • • unused SNMP versions,
      • • NETCONF,
      • • automatic neighbor discovery mechanisms on user ports,
      • • unnecessary DHCP or DNS servers,
      • • unnecessary routing protocols.
   4. Secure SNMP configuration
      
      • • Use SNMPv3 with authentication and encryption.
      • • Disable SNMPv1 and SNMPv2c.
      • • Do not use default community strings such as public and private.
      • • Restrict SNMP access so that connections are permitted only from trusted addresses.
      • • Grant monitoring systems read-only access unless write access is required.
      • • Restrict the SNMP view to only the required OID branches.
      • • Send SNMP traps only to trusted monitoring servers.
   5. Securing physical ports
      
      • • Disable all unused ports.
      • • Place unused ports in a separate, unused VLAN.
      • • Disable communication between clients on access ports.
      • • Restrict access to telecommunications cabinets and console ports.
      • • Protect the console port with a password and automatic session logout.
      • • Allow only the required VLANs on each port.
      • • Explicitly configure each port as either access or trunk.
   6. Protection against Layer 2 attacks
      Enable the following mechanisms on the devices:
      
      • • DHCP Snooping,
      • • ARP Inspection,
      • • MAC Flood Guard,
      • • PPPoE Snooping,
      • • Loop Detect,
      • • Storm Control for broadcast, multicast, and DLF traffic,
      • • IGMP Snooping,
      • • IGMP filtering,
      • • unknown multicast filtering,
      • • Flood Guard,
      • • BPDU Guard on edge ports,
      • • STP protocol controls; user ports should have edge/PortFast mode enabled together with BPDU Guard.
   7. Secure VLAN configuration
      
      • • Do not use the default VLAN for management.
      • • Use an allowed VLAN list on every trunk.
      • • Do not use native VLANs.
      • • Remove the default VLAN from ports.
      • • Do not use VLAN 1 for administrative or user traffic.
      • • Separate each service into its own VLAN, including Internet access, television, servers, telephony, monitoring, and administration.
      • • Control traffic between VLANs using ACLs, a router, or a firewall.
      • • Do not add unnecessary L3 interfaces to VLANs, as this may result in uncontrolled routing.
   8. Securing routing and Layer 3 functions
      
      • • Enable only the routing protocols that are required.
      • • Allow routing adjacencies to be established only on the appropriate interfaces.
      • • Configure user interfaces as passive for routing protocols.
      • • Filter advertised and received routes.
      • • Use ACLs between networks with different trust levels.
      • • Block source address spoofing.
      • • Do not allow users to access device management addresses.
      • • Consider using uRPF or similar packet source validation mechanisms.
   9. User and device access control
      
      • • Use 802.1X authentication.
      • • Create a quarantine VLAN for unrecognized or non-compliant devices.
      • • Restrict communication between endpoint devices when it is not required.
   10. Updates and system security
       
       • • Regularly update the switch firmware.
       • • Review the manufacturer’s security patches before deployment.
       • • Download system images only from official sources.
       • • Verify software checksums or digital signatures.
       • • Regularly check whether the model in use is still supported by the manufacturer.
   11. Logging and monitoring
       
       • • Send logs to a central syslog server.
       • • Synchronize time using authenticated NTP.
       • • Log the following:
           
           • • successful and failed login attempts,
           • • configuration changes,
           • • port status changes,
           • • STP topology changes,
           • • authentication errors,
           • • routing adjacency changes.
       • • Configure alerts for high-risk events.
       • • Monitor CPU usage, memory usage, bandwidth, and the number of errors on ports.
       • • Regularly analyze logs.
   12. Configuration security
       
       • • Regularly back up the configuration.
       • • Store backups in an encrypted, access-controlled repository.
       • • Restrict access to configuration files because they may contain passwords and keys.
       • • Use encrypted protocols such as SCP or SFTP to transfer configuration files.
       • • Maintain configuration versioning.
       • • Compare the current configuration against an approved baseline.
       • • Test the configuration restoration procedure.
       • • Save the configuration after approved changes.
       • • Remove old accounts, addresses, and unused ACL rules from the configuration.
   13. Protection against DoS attacks
       
       • • Limit the number of packets directed to the device CPU.
       • • Apply rate limiting to ICMP, ARP, DHCP, and management protocol traffic.
       • • Enable Storm Control.
       • • Limit the number of new management sessions.
       • • Block malformed packets and traffic from reserved addresses.
       • • Monitor sudden increases in CPU load and in the number of ARP or MAC entries.
   14. Administrative session policy
       
       • • Set a short session inactivity timeout.
       • • Limit the number of concurrent sessions.
       • • Do not include information about the device model, system, location, or purpose in the banner.
       • • Require reauthentication for privileged operations.
       • • Regularly rotate keys, certificates, and passwords.
   15. Audits and testing
       
       • • Regularly review the configuration.
       • • Verify compliance with the adopted security baseline.
       • • Perform vulnerability scans with appropriate caution.
       • • Test ACL operation.
       • • Verify that unused ports remain disabled.
       • • Control who has physical and logical access to the device.
       • • Document exceptions to the security policy together with their justification.
       • • Periodically test emergency procedures and configuration recovery.

C. Minimum security measures

The following can be considered the absolute minimum:

1. 1. SSHv2 instead of Telnet.
   2. Individual administrator accounts and AAA.
   3. An ACL restricting administrative access.
   4. A separate management VLAN.
   5. SNMPv3 instead of SNMPv1/v2c.
   6. Disabling unused ports and services.
   7. Port Security, BPDU Guard, and Storm Control.
   8. DHCP Snooping, Dynamic ARP Inspection, and PPPoE Snooping.
   9. Central syslog and NTP synchronization.
   10. Regular updates and configuration backups.
   11. Filtering traffic between VLANs.
   12. Removing unnecessary L3 addresses from VLANs.
   13. Physical protection of the device and console port.default oALN