Locking Down a Router with Cisco Auto Secure
router#
auto secure
• Cisco AutoSecure will modify the configuration of your device.
• Cisco AutoSecure configuration enhances the security of the router, but it will not make it absolutely resistant to all security attacks.
Router#auto secure
Is this router connected to internet? [no]:y
Enter the number of interfaces facing internet [1]:1
Enter the interface name that is facing internet:FastEthernet0/0
Securing Management plane services..
Disabling service finger Disabling service pad Disabling udp & tcp small servers Enabling service password encryption Enabling service tcp-keepalives-in Enabling service tcp-keepalives-out Disabling the cdp protocol
Cisco AutoSecure is a Cisco IOS feature that lets you more easily configure security features on your router, so that your network is better protected. Cisco AutoSecure can be configured from the privileged EXEC mode using the auto secure command in one of these two modes:
■ Interactive mode prompts the user with options to enable and disable services and other security features. Cisco AutoSecure defaults to this mode.
■ Noninteractive mode automatically executes the Cisco AutoSecure command with the recommended Cisco default settings. This mode is enabled with the no-interact command option.
The figure shows an abstracted example of the first three steps of an interactive Cisco AutoSecure configuration.
© 2006 Cisco Systems, Inc. Securing the Perimeter 2-119
1. Choose
Configure.
2. Choose Security Audit.
3. Click One-step Lockdown.
4. In the Cisco SDM Warning dialog box, click Yes.
5. Deliver commands to the router.
SDM will run a series of predefined c configuration. Once finished, SDM will present you with a list of recommended actions, which you may choose to apply. Or, you may directly perform one step router lock-down by using the below option.
Use Case Scenario
SDM will run a series of predefined c configuration. Once finished, SDM will present you with a list of recommended actions, which you may choose to apply. Or, you may directly perform one step router lock-down by using the below option.
01:01:19 UTC Thu Mar 02 2006
Cisco SDM implements almost all of the configurations that Cisco AutoSecure offers with the One-Step Lockdown feature. This feature is found in the Configure mode on the Security Audit page.
2-120 Securing Cisco Network Devices (SND) v2.0 © 2006 Cisco Systems, Inc.
Locking Down a Router with Cisco SDM (Cont.)
One-Step Lockdown tests your router configuration for any potential security problems and automatically makes any necessary configuration changes to correct any problems found. The conditions checked for and, if needed, corrected are as follows:
■ Disable finger service
■ Disable PAD service
■ Disable TCP small servers service
■ Disable UDP small servers service
■ Disable IP BOOTP server service
■ Disable IP identification service
■ Disable IP source route
■ Enable password encryption service
■ Enable TCP keepalives for inbound Telnet sessions
■ Enable TCP Keepalives for outbound Telnet sessions
■ Enable sequence numbers and time stamps on debugs
■ Disable IP gratuitous ARPs
■ Set minimum password length to less than 6 characters
■ Set authentication failure rate to less than 3 retries
■ Set TCP synwait time
■ Enable logging
© 2006 Cisco Systems, Inc. Securing the Perimeter 2-121
■ Set enable secret password
■ Disable SNMP
■ Set scheduler interval
■ Set scheduler allocate
■ Enable Telnet settings
■ Enable NetFlow switching
■ Disable IP redirects
■ Disable IP proxy ARP
■ Disable IP directed broadcast
■ Disable MOP service
■ Disable IP unreachables
■ Disable IP mask reply
■ Disable IP unreachables on null interface
■ Enable Unicast Reverse Path Forwarding (RPF) on outside interfaces
■ Enable firewall on all of the outside interfaces
■ Set access class on HTTP server service
■ Set access class on vty lines
■ Enable SSH for access to the router
■ Enable Authentication, Authorization, and Accounting (AAA)
2-122 Securing Cisco Network Devices (SND) v2.0 © 2006 Cisco Systems, Inc.
Continue reading here: Inband management guidelines
Was this article helpful?