Cisco IOS Auto Secure
Cisco AutoSecure disables the unnecessary global services previously discussed in this chapter. It also enables certain services that help further secure global services that are often necessary. In addition, Cisco AutoSecure hardens administrative access by enabling appropriate security-related logging features. It is recommended in most environments because it implements a range of best practices that help secure any organization. It also reduces the time required to configure each item by hand.
NOTE Cisco AutoSecure was introduced in Cisco IOS Software Version 12.3 and in subsequent 12.3T releases for the Cisco 800, 1700, 2600, 3600, 3700, 7200, and 7500 Series Routers.
Cisco AutoSecure has two modes of operation:
• Interactive: Users select their own options for services and other security-related features.
• Noninteractive: This mode automatically enables a set of Cisco recommended security features and disables unnecessary services.
TIP The Interactive mode enables you to have more control over the router security features that you want to enable. However, if you need to quickly secure a router without much human intervention, the noninteractive mode is appropriate.
You can also specify what part of the AutoSecure suite of commands and features you would like to configure. The following example shows the options of the auto secure command.
myrouter#auto secure ?
firewall forwarding full login management no-interact ntp ssh tcp-intercept <cr>
AutoSecure Firewall
Secure Forwarding Plane
Interactive full session of AutoSecure
AutoSecure Login
Secure Management Plane
Non-interactive session of AutoSecure
AutoSecure NTP
AutoSecure SSH
AutoSecure TCP Intercept
In the next example, the auto secure command is invoked with no options; therefore, the complete suite of configuration options is presented to the user.
myrouter#auto secure
— AutoSecure Configuration — *** AutoSecure configuration enhances the security of the router, but it will not make it absolutely resistant to all security attacks ***
AutoSecure will modify the configuration of your device.
All configuration changes will be shown. For a detailed explanation of how the configuration changes enhance security and any possible side effects, please refer to Cisco.com for
AutoSecure documentation.
At any prompt you may enter '?' for help.
Use ctrl-c to abort this session at any prompt.
Gathering information about the router for AutoSecure
Is this router connected to internet? [no]: yes
Enter the number of interfaces facing the internet [1]: 1
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 unassigned YES NVRAM administratively down down
FastEthernet0/1 unassigned YES NVRAM administratively down down
Enter the interface name that is facing the internet: FastEthernet0/0
Securing Management plane services...
Disabling service finger
Disabling service pad
Disabling udp & tcp small servers
Enabling service password encryption
Enabling service tcp-keepalives-in
Enabling service tcp-keepalives-out
Disabling the cdp protocol
Disabling the bootp server
Disabling the http server
Disabling the finger service
Disabling source routing
Disabling gratuitous arp
Here is a sample Security Banner to be shown at every access to device. Modify it to suit your enterprise requirements. Authorized Access only
This system is the property of So-&-So-Enterprise. UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED. You must have explicit permission to access this device. All activities performed on this device are logged. Any violations of access policy will result in disciplinary action. Enter the security banner {Put the banner between k and k, where k is any character}: - UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED. You must have explicit permission to access this device. All activities performed on this device are logged. Any violations of access policy will result in disciplinary action.
Enable secret is either not configured or is the same as enable password Enter the new enable secret:1qaz@WSX Confirm the enable secret :1qaz@WSX Enter the new enable password:2wsx!QAZ Confirm the enable password:2wsx!QAZ Configuration of local user database Enter the username: admin Enter the password:1qaz@WSX Confirm the password:1qaz@WSX Configuring AAA local authentication Configuring Console, Aux and VTY lines for local authentication, exec-timeout, and transport Securing device against Login Attacks Configure the following parameters Blocking Period when Login Attack detected: 15 Maximum Login failures with the device: 3
Maximum time period for crossing the failed login attempts: 60 Configure SSH server? [yes]: yes Enter the domain-name: cisco.com
Configuring interface specific AutoSecure services Disabling the following ip services on all interfaces: no ip redirects no ip proxy-arp no ip unreachables no ip directed-broadcast no ip mask-reply Disabling mop on Ethernet interfaces Securing Forwarding plane services...
Enabling CEF (This might impact the memory requirements for your platform) Enabling unicast rpf on all interfaces connected to internet
Configure CBAC Firewall feature? [yes/no]: yes This is the configuration generated: no service finger no service pad no service udp-small-servers no service tcp-small-servers service password-encryption service tcp-keepalives-in service tcp-keepalives-out no cdp run no ip bootp server no ip http server no ip finger no ip source-route no ip gratuitous-arps no ip identd banner motd "C UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED. You must have explicit permission to access this device. All activities performed on this device are logged. Any violations of access policy will result in disciplinary action.
"C
security passwords min-length 6
security authentication failure rate 10 log enable secret 5 $1$gGZi$aoXeicM9JVVMfi0K6lFl50
enable password 7 14141B180F0B7B79777C66 username admin password 7 030752180500701E1D aaa new-model aaa authentication login local_auth local line con 0
login authentication local_auth exec-timeout 5 0 transport output telnet line aux 0 login authentication local_auth exec-timeout 10 0 transport output telnet line vty 0 4 login authentication local_auth transport input telnet line tty 1 login authentication local_auth exec-timeout 15 0 line tty 192 login authentication local_auth exec-timeout 15 0 login block-for 15 attempts 3 within 60 ip domain-name cisco.com crypto key generate rsa general-keys modulus 1024
ip ssh time-out 60
ip ssh authentication-retries 2
line vty 0 4
transport input ssh telnet service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone logging facility local2 logging trap debugging service sequence-numbers logging console critical logging buffered interface FastEthernet0/0 no ip redirects no ip proxy-arp no ip unreachables no ip directed-broadcast no ip mask-reply no mop enabled interface FastEthernet0/1 no ip redirects no ip proxy-arp no ip unreachables no ip directed-broadcast no ip mask-reply no mop enabled ip cef access-list 100 permit udp any any eq bootpc interface FastEthernet0/0
ip verify unicast source reachable-via rx allow-default 100 ip inspect audit-trail ip inspect dns-timeout 7 ip inspect tcp idle-time 14400 ip inspect udp idle-time 1800
ip inspect name autosec_inspect cuseeme timeout 3600 ip inspect name autosec_inspect ftp timeout 3600 ip inspect name autosec_inspect http timeout 3600 ip inspect name autosec_inspect rcmd timeout 3600 ip inspect name autosec_inspect realaudio timeout 3600 ip inspect name autosec_inspect smtp timeout 3600 ip inspect name autosec_inspect tftp timeout 30 ip inspect name autosec_inspect udp timeout 15 ip inspect name autosec_inspect tcp timeout 3600 ip access-list extended autosec_firewall_acl permit udp any any eq bootpc deny ip any any interface FastEthernet0/0 ip inspect autosec_inspect out ip access-group autosec_firewall_acl in
Apply this configuration to running-config? [yes]:yes
In the previous example, the router has the interface (FastEthernet0/0) that is connected to the Internet. The AutoSecure utility applies predefined commands based on best practices for Internet-edge routers. The router then guides the user on enabling other features, such as defining a banner, configuring passwords and administrative accounts, and enabling Cisco IOS Firewall set or Context-Based Access Control (CBAC).
Continue reading here: Net Flow
Was this article helpful?