Other Hardening Options
In addition to the configuration discussed in this section, Chapter 6 contains a fair amount of informatio router and switch hardening, including:
• Antispoof filtering
• L2 security protections
• Routing protocol authentication
• Denial of service (DoS) mitigation (against and through the router)
After hardening a router, it is a good idea to scan it with your favorite port scanner. This ensures th you aren't running any services you thought you turned off. For instance, when testing in my lab fo this book, I realized I accidentally left the HTTP server running!
Example 5-1 is a dump of the router configuration used in testing the configurations in this section. Rem that commands that are defaults will not show up in the configuration.
Example 5-1. Hardened Router Example version 12.2
service timestamps debug uptime service timestamps log datetime msec localtime show-timezone service password-encryption !
hostname broken logging buffered 512000 debugging enable secret 5 $1$ec0k$PW/.SXz8klYAqNBaFJ6.Q0 !
clock timezone PST -8 clock summer-time PDT recurring aaa new-model !
aaa authentication login default group tacacs+ aaa authentication login no-tacacs line aaa accounting exec default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ ip subnet-zero no ip source-route !
no ip domain lookup ip domain name halo05.com !
no ip bootp server !
interface FastEthernet0/0 ip address 172.19.93.135 255.255.255.240 no ip redirects no ip proxy-arp
interface FastEthernet0/1 ip address 172.19.93.241 255.255.255.240 no ip redirects no ip proxy-arp ntp disable
ip classless no ip http server !
logging 172.19.93.140 access-list 96 permit 172.19.93.131 access-list 96 deny any log access-list 99 permit 172.19.93.131 access-list 99 deny any log no cdp run !
tacacs-server host 172.19.93.130 single-connection tacacs-server directed-request tacacs-server key 4n7xe0n!x# !
banner motd AC Unauthorized Use Prohibited
line con 0 exec-timeout 5 0 password 7 094D410B1622233358 login authentication no-tacacs line aux 0
no exec line vty 0 3 exec-timeout 5 0 password 7 070E2E4D412D2E2444 transport input ssh line vty 4
access-class 99 in exec-timeout 5 0 password 7 0822455E0A16 transport input ssh
ntp authentication-key 1 md5 13151601181B0B382F 7 ntp authenticate ntp trusted-key 1 ntp access-group peer 96 ntp server 172.19.93.131 key 1 !
Cisco IOS 12.3 added a new feature called AutoSecure to simplify the process of locking down a Ci: router. For more information, see the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123 1/ftatosec.htm.
Continue reading here: Rogue Device Detection
Was this article helpful?