Basic Security Services
Disable TCP and UDP Small Servers
By default, so-called TCP and UDP small servers are enabled. These are relatively simple protocol services required for standards compliance. However, hackers can abuse these services, so unless you have a compelling reason for their existence, disable them as follows RTA(config) no service tcp-small servers RTA(config) no service udp small-servers The TCP small servers are Echo, Discard, Chargen, and Daytime. The UDP small servers are Echo. Discard, and Chargen.
Logging Access List Activity
Sometimes it's useful to log the activity of traffic that is denied by an extended access list. This is especially true when you are using an access list for security and intentionally blocking conversations that shouldn't be happening. To log when packets match an access list rule, simply append the log keyword to the rule (logging is not available on standard access lists). For example, to log every time a packet is denied from sources matching 172.16.1.0 0.0.0.255, the access list might look...
Disable IP Source Routing
On occasion, it's used for troubleshooting. However, a hacker mighi attempt to communicate with one of your hosts by inserting himself or herself as an intermediary stop between two legitimate host addresses. Figure 6-11 illustrates the scheme. Figure 6-11 A Hacker Attacking with IP Source-Routing Figure 6-11 A Hacker Attacking with IP Source-Routing The hacker. II, pretends to be an intermediary hop in a source-routed path from Host B to Host A. H creates a...
Extended Access List Syntax
The syntax for extended access lists is access list access list-number den permit protocol source source-wildcard destination destination wildcard precedence precedence tos ros) That rule looks like quite a lot because you have more options, but it's really not much more than a standard access list. Consider the following example access-list 100 permit ip 172.16.1.0 0.0.0.255 192.168.25.0 0.0.0.31 where 100 is the access list number that for extended access lists must lie in the range 100-199,...
Authentication Authorization and Accounting
The networking industry has adopted three principles that address the basic needs of remotely accessible networks. They are authentication. authorization, and accounting (AAA or triple A). Authentication validates a user's identity. This is the heart of remote access security and grants a user access to the network based on an assurance that the system knows the person. Authentication is typically done with user login names and passwords. To improve the probability that a password is known only...
Access Lists for Combating Spoofing Attacks
IP address spoofing is an attack in which the hacker pretends to be a trusted computer by using an address within your range of acceptable internal addresses. Although spoofing is only one of many attacks practiced in the hacker world, it is one of the most popular and therefore should be on your list of attacks to thwart. This section describes some basic anti-spoofing filters that are useful for almost any router connected to an untrusted network for example, the Internet. The access list...
Creating an Access List
To create your access list, you start with a rule. You include in this initial rule (and subsequent rules if there are any) the number of the access list. To create a standard access list that permits traffic from host 172.16.1.1, for example, configure the following Enter configuration commands, one per line. End with CNTL Z. MyRouter(config) access-list 1 permit 172.16.1.1 0.0.0.0 MyRouter(config) exit where access-list 1 permit 172.16.1.1 0.0.0.0 adds a rule to access list 1 that permits...
Disable CDP on Public Links
Cisco Discovery Protocol (CDP) is a feature that gives you useful information about other Cisco devices (called neighbors) attached to a router. CDP information is helpful for determining the topology of a network and for troubleshooting. This information could also be useful to a hacker, however, so disabling it on interfaces that point to an untrusted network is a good idea. CDP packets travel only between neighboring Cisco devices they do not span multiple hops or roam around the network, so...
The Local Username Database
You have the option to configure a local security database in each router, containing usernames and passwords. This is useful when you have a small set of users and a few routers that don't warrant the convenience of a AAA server. The local database can also act as a backup for usernames and passwords if the AAA server is unavailable or unreachable. To use the local database as a backup to your AAA server, configure an authentication list with the local keyword following the radius or tacacs+...