Network Hardening — BGP security + micro-segmentation (the job's second pillar)

The posting says "harden connections and network security" and "network policies and micro segmentation." Structure your answers in layers, edge → fabric → cluster → host. Showing layered thinking IS the answer.

1. BGP session security (say these cold)

  • GTSM / TTL security (RFC 5082): eBGP peers must arrive with TTL=255 (directly connected). Kills spoofed remote BGP packets dead. Cheap, always on.
  • TCP MD5 (RFC 2385) or TCP-AO (RFC 5925, modern replacement): authenticate every TCP segment of the session. MD5 is legacy but ubiquitous; AO is the current answer for new builds.
  • max-prefix per peer + shutdown/restart: a misbehaving peer can't flood your RIB. Pair with a warning threshold and alerting.
  • Prefix filters BOTH directions (never "allow all"): OUT = only what you originate; IN = only what the peer legitimately sends. Route-maps/prefix-lists with explicit deny-all tail.
  • AS_PATH filters: deny routes with your own ASN, private ASNs at the edge, and transit-looking paths.
  • Well-known communities: NO_EXPORT/NO_ADVERTISE to stop accidental transit/leaks.
  • RPKI ROV (RFC 6811) at the Internet edge: drop ROUTE INVALID origins (hijack protection). Internal fabric = less relevant, but say you'd apply it at the perimeter.
  • BCP 38 / RFC 2827 ingress filtering: drop spoofed source addresses at every edge — the fabric-level anti-DDoS baseline. RTBH (RFC 5635) for volumetric attacks.
  • Control-plane protection (CoPP): rate-limit traffic to the router CPU so a flood can't starve BGP keepalives → hold timer expiry → flap. This is the sneaky one interviewers love.
  • Session hygiene: update-source loopbacks, dedicated management plane, disable unused address-families, logging + SNMP alerting on session state changes, peer-specific passwords rotated on rotation schedule.
  • BFD on critical sessions: fail fast, not after 3× hold timers.

30-second script: "Every BGP session gets TTL-security, TCP-AO or MD5, max-prefix, and bidirectional prefix filters with an explicit deny-all. Edge gets RPKI and BCP 38. Fabric runs CoPP so BGP can't be starved. Then I alert on every session-state change so we know about flaps before users do."

2. Perimeter & physical (they said firewall rules, NSGs, perimeter connectivity)

  • Zone-based firewalling: separate user/DC/server/mgmt zones; default-deny between zones; explicit allow with justification.
  • Permit ONLY TCP/179 between BGP peers + BFD ports; block everything else to router management from user VLANs.
  • Management out-of-band (serial/console + dedicated mgmt network), TACACS+/RADIUS auth on network gear, change logging.
  • Port security / 802.1X on access ports, disable unused switchports, DHCP snooping + ARP inspection on user VLANs.
  • DNS hygiene: split-horizon internal DNS, DNSSEC where practical, watch DNS for C2 exfil.

3. Cluster micro-segmentation (OpenShift specifics)

  • Model: namespace-per-app or per-tier; NetworkPolicy default-deny in every namespace ("deny all, allow what's required" — ingress AND egress).
  • Allow by label selectors (app: web → app: api) not by IP. IPs are ephemeral in K8s.
  • EgressFirewall (OpenShift) for L3/L4 egress ACLs per namespace — pin down what apps can reach (this is how you stop a compromised pod phoning home to a random IP).
  • OVN-K compiles policies to OVN ACLs — enforcement at the flow level, stateful, no iptables sprawl.
  • RBAC + SCCs: restricted-v2 SCC (no privileged, no host networking unless justified), least-privilege service accounts, no cluster-admin for humans (SSO via LDAP/Entra — your resume matches).
  • Secrets: no plaintext env vars; use OpenShift secrets + External Secrets Operator; encrypt etcd (encryption at rest) + TLS everywhere via internal service CA.
  • FIPS mode on RHCOS, RHACS (Advanced Cluster Security) for image scanning/runtime policies, audit logs shipped (their Splunk/Dynatrace experience maps — you've done this).
  • Quotas/LimitRanges so one runaway app can't starve the node.

4. Host & OS hardening (RHEL — they said patching, performance tuning)

  • CIS Benchmark for RHEL + the OpenShift cluster; automate with Ansible (your 90%-automation story is a direct match).
  • SELinux enforcing — never permissive in prod. (Saying "SELinux enforcing, and I troubleshoot with sealert instead of disabling it" = instant credibility.)
  • firewalld default-deny zones, only required services.
  • Kernel sysctls: rp_filter=1 (anti-spoofing at the host — matches BCP 38), tcp_syncookies=1, icmp_ignore_bogus_error_responses, ASLR.
  • sshd: key-only auth, no root login, MFA (PIV/TOTP), fail2ban or equivalent.
  • Automated patching: Ansible/Satellite for RHEL, NinjaOne/SCCM for Windows endpoints; PCI-style vulnerability program (your Nessus story).
  • AIDE/file integrity + auditd; central logging; NTP/chrono everywhere (Kerberos in the AD hybrid will punish clock skew — say this, it shows you've done hybrid).

5. Windows side (they still have AD — speak to it)

  • Keep AD for identity: LDAP bind for OCP auth, least-privilege service accounts with long random passwords in a vault, Kerberos AES not RC4.
  • GPO hardening: LAPS for local admin passwords, disable SMBv1/NTLMv1, Credential Guard, tiered admin model.
  • During migration: audit which Windows services the Linux apps still call (SMB shares, SQL, AD auth) — those become the hardening backlog as Windows shrinks.

6. NinjaOne RMM (from the recruiter brief — be honest, be ready)

  • What it is: cloud RMM platform — agent-based inventory, patching (OS + third-party), remote control, scripting/automation, alerting, endpoint security posture. NinjaOne has Linux agent support too.
  • If you haven't run it: say exactly that, then map your real experience: "I ran SCCM/WSUS + AD/GPO for the Windows estate and Ansible for 1,000+ Linux servers. Same RMM model — agent inventory, patch cycles, automation, remote remediation. I'd map our patch window and drift reports onto NinjaOne day one."
  • Never claim NinjaOne production experience you don't have. One follow-up question kills that.

7. Layered defense summary (closing answer for any "how do you harden" question)

"Edge: RPKI, BCP 38, zone firewalls, RTBH. Fabric: GTSM, TCP-AO, filters, max-prefix, CoPP. Cluster: default-deny NetworkPolicies, EgressFirewall, RBAC/SCC, encrypted etcd, signed images. Hosts: SELinux enforcing, CIS baselines, automated patching. And monitoring/alerting on all of it — hardening without visibility is theater."