Disable Unneeded Services
Turn off Domain Name System (DNS) lookups for the router with the following command. Although not security related, this is the first command to type on a fresh router before doing any other configuration
(assuming, of course, you don't need domain resolution for a feature you plan to use). Otherwise, be ca avoid input errors. Typing the command enadle instead of enable will result in a long timeout while the tries to find host "enadle" and communicate with it.
Router(config)#no ip domain-lookup
Disable small services such as echo, chargen, and discard, as well as the finger service. After Cisco IOS 11.3, these services are disabled by default, but it never hurts to have these commands as part of the s use to harden a device. These small services should almost always be turned off because they have no l use:
Router(config)#no service tcp-small-servers Router(config)#no service udp-small-servers Router(config)#no service finger
Disable bootp server with the following command if you aren't using it on your network (most don't):
Router(config)#no ip bootp server
Disable source routing and directed broadcast. These should be off by default on reasonably current rou make sure with the following commands:
Router(config-if)#no ip directed-broadcast Router(config)#no ip source-route
You can disable Proxy ARP in most situations, assuming your devices are routing aware:
Router(config-if)#no ip proxy-arp
ICMP redirects should be sent only to end systems that have multiple outbound routes from which to ch situations in which IP redirects are unnecessary, disable them with the following command:
Router(config-if)#no ip redirects
Continue reading here: Line Access
Was this article helpful?