Security ch 2

the last router between the internal network and an untrusted network such as the Internet

• -Functions as the first and last
• line of defense

• -Implements security actions based
• on the organization’s security policies

connects the protected network, or internal LAN, to the Internet.

Passes everything through to the firewall. A set of rules determines what traffic the router will allow or deny

The DMZ is set up between two routers. Most traffic filtering left to the firewall

Use various perimeter router implementations

• -Consider physical security,
• operating system security, and router hardening

-Secure administrative access

-Local versus remote router access

• Place router in a secured, locked
• room

• -Install an uninterruptible power
• supply

• -Use the latest stable version
• that meets network requirements

• -Keep a copy of the O/S and
• configuration file as a backup

-Secure administrative control

• -Disable unused ports and
• interfaces

-Disable unnecessary services

• Restrict device accessibility
• Log and account for all access
• Authenticate access
• Authorize actions
• Present legal notification
• Ensure the confidentiality of data

• Encrypt all traffic
• Establish a dedicated management network
• Configure a packet filter to allow only the identified administration hosts

central TACACS+ or RADIUS authentication server such as the Cisco Secure Access Control Server (ACS)

to privileged EXEC mode, it used MD5

virtual terminal vty (Telnet or SSH) sessions.

Enforce minimum password lengths.Disable unattended connections.Encrypt all passwords in the configuration file.

• 0 to 16 characters, min 10
• security passwords min-length length.

stays active and logged in for 10 minutes after the last session activity.

• 2 TO 3 MIN MAX
• exec-timeout

use service password-encryption command., it hashes them

• enable secret command
• it uses md5

• username name password password
• username name secret password- more secure md55

• Implement delays between successive login attempts.
• Enable login shutdown if DoS attacks are suspected.
• Generate system logging messages for login detection.

which is used to gain administrative access to a device, floods a device with thousands of username and password combinations.

login enhancements

• This command must be issued before any other login command can be used.
• This command can help provide DoS detection and prevention.

The router keeps count of the number of failed login attempts within an identified amount of time.

If the number of failed logins exceeds the configured threshold, all login attempts using Telnet, SSH, and HTTP are denied.

Command specifies an ACL is applied to the router when switched to Quiet-Mode and identifies hosts that are exempt from the Quiet-Mode failure time.If not configured, all login requests will be denied during the Quiet-Mode.

• Helps mitigate dictionary attacks
• This is an optional command. If not set, a default delay of one second is enforced after the login block-for command is configured.

message logging for failed login attempts.

present legal notification to potential intruders to inform them that they are not welcome on a network.

providing remote router administration with connections that support confidentiality and session integrity.

port 22

• Step 1: Configure the IP domain name
• Step 2: Generate one-way secret keys
• Step 3: Verify or create a local database entry
• Step 4: Enable VTY inbound SSH sessions

more secure SSH version 2 (SSHv2).

Diffie-Hellman key exchange and the strong integrity-checking message authentication code (MAC).

default is 120 sec

• ip ssh authentication-retries integer
• default 3 attempts

• using the privileged EXEC mode ssh command.
• using a publicly and commercially available SSH client running on a host.

• RSA key is not set on this router
• RSA key is set on this router

allowed to connect to the device and what that person should be able to do with it.

• User EXEC mode (privilege level 1) - Provides the lowest EXEC mode user privileges and allows only user-level commands available at the router> prompt.
• Privileged EXEC mode (privilege level 15) - Includes all enable-level commands at the router# prompt.

• Level 0: Predefined for user-level access privileges
• Level 1: The default level for login with the router prompt router>
• Levels 2 –14: May be customized for user-level privileges
• Level 15: Reserved for the enable mode privileges (enable command). Users can change configurations and view configuration files.

• privilege levels
• role based CLI access

• enable secret level level password.
• username name privilege level secret password.

No access control to specific interfaces, ports, logical interfaces, and slots on a router.Commands available at lower privilege levels are always executable at higher levels.Commands specifically set on a higher privilege level are not available for lower privileged users.Assigning a command with multiple keywords to a specific privilege level also assigns all commands associated with the first keywords to the same privilege level. An example is the show ip route command.

•Controls which commands are available to specific roles

• -Security: Defines the set of CLI
• commands that is accessible by a particular user by controlling user access to
• configure specific ports, logical interfaces, and slots on a router

• -Availability: Prevents
• unintentional execution of CLI commands by unauthorized personnel

• -Operational Efficiency: Users only see the CLI commands applicable to
• the ports and CLI to which they have access

• Root view
• CLI view
• Superview

has all of the access privileges as a user who has level 15 privileges.

Each view must be assigned all commands associated with that view and there is no inheritance of commands from other views

• Allow a network
• administrator to assign users and groups of users multiple CLI views at once
• instead of having to assign a single CLI view per user with all commands
• associated to that one CLI view.

The configuration file in the primary bootset is a copy of the running configuration that was in the router when the feature was first enabled.The feature secures the smallest working set of files to preserve persistent storage space. No extra space is required to secure the primary Cisco IOS image file.The feature automatically detects image or configuration version mismatch.Only local storage is used for securing files, eliminating scalability maintenance challenges from storing multiple images and configurations on TFTP servers.The feature can be disabled only through a console session.

• Enables Cisco IOS image resilience. Prevents the IOS image from being deleted by a malicious
• user.

takes a snapshot of the routers running configuration and securley archives it in perstent storage

• Information flows on a
• dedicated management network on which no production traffic resides

• appropriate for large
• enterprise networks

Provide the highest level of security and mitigate the risk of passing insecure management protocols over the production network.

• •Configuration Change
• Management

• -Know the state of critical
• network devices

• -Know when the last modifications
• occurred

• -Ensure the right people have
• access when new management methodologies are adopted

• -Know how to handle tools and
• devices no longer used

• •Automated logging and
• reporting of information from identified devices to management hosts

• •Available applications and
• protocols like SNMP

Information flows across an enterprise production network, the Internet, or both using regular data channels.

• recommended in smaller networks providing a
• more cost-effective security deployment

Apply only to devices that need to be managed or monitored.Use IPsec, SSH, or SSL when possible.Decide whether the management channel needs to be open at all times.

in-band

• Timestamp
• Log message name and severity level
• Message text

• Syslog servers - Also known as log hosts, these systems accept and process log messages from syslog clients.
• Syslog clients - Routers or other types of equipment that generate and forward log messages to syslog servers.

• Read-only community strings - Provides read-only access to all objects in the MIB, except the community strings.
• Read-write community strings - Provides read-write access to all objects in the MIB, except the community strings.

Used to authenticate messages between a management station and an SNMPv1 or SNMPv2 engineRead-write community strings can get and set information in an agent.Set access is equivalent to having the enable password for a device.

• Message integrity - Ensures that a packet has not been tampered with in transit.
• Authentication - Determines that the message is from a valid source.
• Encryption - Scrambles the contents of a packet to prevent it from being seen by an unauthorized source.

• •Clocks on hosts and
• network devices must be maintained and synchronized to ensure that log messages
• are synchronized with one another

-Manually edit the date and time

-Configure Network Time Protocol

Authenticates the identity of a system to which NTP will synchronize

it should not be everywhere in the network. Edge devices are an example

• •To ensure a device is
• secure:

• -Disable unnecessary services and
• interfaces

• -Disable and restrict commonly
• configured management services, such as SNMP

• -Disable probes and scans, such as
• ICMP

-Ensure terminal access security

• -Disable gratuitous and proxy
• Address Resolution Protocol (ARP)

-Disable IP-directed broadcast

• Security Audit Wizard - a security audit feature provided through Cisco SDM. The Security Audit Wizard provides a list of vulnerabilities and then allows the administrator to choose which potential security-related configuration changes to implement on a router.
• Cisco AutoSecure - a security audit feature available through the Cisco IOS CLI. The autosecure command initiates a security audit and then allows for configuration changes. Based on the mode selected, configuration changes can be automatic or require network administrator input.
• One-Step Lockdown - a security audit feature provided through Cisco SDM. The
• One-Step Lockdown feature provides a list of vulnerabilities and then automatically makes all recommended security-related configuration changes.

• Compares router configuration against
• recommended settings:

•Shut down unneeded servers

•Disable unneeded services

• •Apply the firewall to the
• outside interfaces

•Disable or harden SNMP

• •Shut down unused
• interfaces

•Check password strength

•Enforce the use of ACLs

• Tests router configuration for any potential
• security problems and automatically makes the necessary configuration changes
• to correct any problems found

auto secure [no-interact]

• •Initiated from CLI and
• executes a script. The AutoSecure feature first makes recommendations for
• fixing security vulnerabilities, and then modifies the security configuration
• of the router.

• •Can lockdown the
• management plane functions and the forwarding plane services and functions of a
• router

• •Used to provide a baseline
• security policy on a new router

• Cisco
• AutoSecure
• also:

•Disables NTP

•Configures AAA

•Sets SPD values

•Enables TCP intercepts

•Configures anti-spoofing ACLs on

outside-facing interfaces

• SDM
• implements some the following features differently:

• •SNMP is disabled but will not
• configure SNMPv3

• •SSH is enabled and configured
• with images that support this feature.

• Secure
• Copy Protocol (SCP) is not enabled--unsecure FTP is