2012 Cisco and/or its affiliates. All rights reserved.

1
Chapter 2:

Securing Network Devices


Cisco Network Academy presentation as
modified by Umesh Patel
2012 Cisco and/or its affiliates. All rights reserved. 2
Introduction (Slides 3 to 5)
Secure Router Administrative Access (Slides 7 to 17)
A login warning banner; Router Passwords; Password Encryption; Secure Virtual Login; an SSH
server on a router

Privilege levels and Role Views (Slides 19 to 26)
Configure router privilege levels; Create multiple role views and grant varying privileges ; Verify
and contrast views

IOS Resilience and Management Reporting (Slides 28 to 55)
Cisco IOS Resilience; Secure the Cisco IOS image and configuration files; Management and
Reporting Features; NTP; Syslog

Disabling Unused Cisco Router Network Services and Interfaces (Slides 57 to 71)
Configure Automated Security Features; Use the CCP Security Audit tool to identify
vulnerabilities and to lock down services; Lock down a router using AutoSecure and verify the
configuration; One-Step Lockdown using CCP

Chapter 2 Lab A: Securing the Router for Administrative Access (Slides 73 to 76)




2012 Cisco and/or its affiliates. All rights reserved. 3
Secure network devices
Secure Edge Router
2012 Cisco and/or its affiliates. All rights reserved. 4
Scenario 3
Scenario 2
Three types of implementations
Scenario 1:
The router protects the LAN.



Scenario 2:
The router screens traffic before a
firewall (PIX/ASA).


Scenario 3:
The zone directly connected to the
firewall is called a DMZ
Internet-accessible servers are
located in the DMZ
Most Important is to secure edge router
LAN 1
192.168.2.0
Router 1 (R1)
Internet
Scenario 1
LAN 1
192.168.2.0
R1
Internet
Firewall
LAN 1
192.168.2.0
R1
Internet
R2 Firewall
DMZ
2012 Cisco and/or its affiliates. All rights reserved. 5
Physical security:
Secure infrastructure equipment in a locked room that:
accessible only to authorised personnel; free of electrostatic or magnetic interference; has fire
suppression; has controls for temperature and humidity.
Install an uninterruptible power supply (UPS) and keep spare components available to reduce the
possibility of a DoS attack from power loss to the building.
Operating system
Configure the router with the maximum amount of memory possible;
Use the latest stable version of the operating system that meets the feature requirements of
the network.
Keep a secure copy of the router operating system image and router
configuration file as a backup
Router hardening
Secure administrative control
Disable unnecessary services
Disable unused ports and interfaces



2012 Cisco and/or its affiliates. All rights reserved. 6
Questions?

Next: Secure Router Administrative Access
(Slides 7 to 17)


Part 2 of Lab: Control Administrative Access for Routers:
Configure a login warning banner; Configure and encrypt all
passwords; enhanced username password security ; enhanced
virtual login security; an SSH server on a router

2012 Cisco and/or its affiliates. All rights reserved. 7
Applies to all router but specially, the Edge Router
Administrative access is for management purpose and so is important to
secure
Implementation
Provide Legal Notification
Authenticate access
Restrict device accessibility both locally and remotely
Remote access must be secured with encrypted traffic
Otherwise, allow only local access
Log and account for all access for auditing purposes
Authorise actions
Restrict the actions and views permitted by any particular user, group, or service
Ensure the confidentiality of data
Protect locally stored sensitive data from viewing and copying.
Consider the vulnerability of data in transit over a communication channel to sniffing,
session hijacking, and man-in-the-middle (MITM) attacks.

2012 Cisco and/or its affiliates. All rights reserved. 8
Banner messages :
warn would-be intruders that they are not welcome on your network
important, especially from a legal perspective
Intruders have been known to win court cases because they did not encounter
appropriate warning messages.
Content should be reviewed by legal counsel before being implemented.
Never use the word welcome or any other familiar or similar greeting that may be
misconstrued as an invitation to use the network.
Configuring Banner Messages
what is proper use of the system
the system is being monitored
privacy should not be expected when using this system

Router(config)# banner {exec | incoming | login | motd | slip-ppp} d message d


2012 Cisco and/or its affiliates. All rights reserved. 9
Avoid passwords based on dictionary words, sequences, birth date etc
Passwords must be complete and may include ?
Implement a policy to change passwords frequently
Local rules can make passwords even safer
Strong Passwords ?
Passphrases
Use a sentence, quote from a book, or song lyric that you can easily remember as the
basis of the strong password or pass phrase
Examples ?
Deliberately misspell a password.
The longer, the better --- Enforce minimum password length
Secure router access with encrypted (MD5 Hashing) passwords
Use password management
Disable unattended connections
At Last:
What can attackers do to crack passwords?
Apply same to determine password strength.





Primary Defense
2012 Cisco and/or its affiliates. All rights reserved. 10
Access ports passwords
console port (local access), auxiliary and Virtual Terminal
Connections (remote access)
A locally configured password for privileged and other access
If attackers are able to penetrate this first layer of defense,
using an enable secret password prevents them from being
able to alter the configuration of the device.
Passwords for the users
can be managed locally on router or using centralised servers

2012 Cisco and/or its affiliates. All rights reserved. 11
A locally configured password for
privileged and other access

A password to secure console
port, auxiliary port and virtual
terminal connections

Enforce minimum password
length: security passwords min-
length length

Disable unattended connections:
exec-timeout minutes seconds

Encrypt config file passwords
R1(config)# enable secret cisco

R1(config)# line vty 0 4 | line aux 0 |
line con 0
R1(config-line)# password cisco
R1(config-line)# login
Router(config)# security passwords min-
length 10

Router(config)# line console 0
Router(config-line)# exec-timeout 3 30

Router(config)# service password-
encryption
2012 Cisco and/or its affiliates. All rights reserved. 12
Passwords for users and securing those in Local Database.


plaintext password.
username name password {[0] password |
7 hidden-password}

Encrypted password: Use MD5 hashing
username name secret {[0] password |
encrypted-secret}

R1(config)# username JR-
ADMIN password cisco12345


R1(config)# username
ADMIN secret cisco54321

R1(config)# line con 0
R1(config-line)# login local
2012 Cisco and/or its affiliates. All rights reserved. 13
Strong password does not prevent a device from being targeted for attack
Virtual connections are still vulnerable to DoS attacks
DoS attacks flood a device with so many connection requests (using
difference username and password combinations) that the device might
not provide normal login service to legitimate system administrators
login process should be configured with specific parameters:
Implement delays between successive login attempts
Enable login shutdown if DoS attacks are suspected.
Generate system logging messages for login detection
Block further connection after repeated failed request


2012 Cisco and/or its affiliates. All rights reserved. 14
Set up limited number of login
failures:
The PERMIT-ADMIN : exempt
administrative stations from
the disabled login if not
configured, all login requests
will be denied during the
Quiet-Mode.


Implement delays between
successive login attempts. (10
seconds)
Generate system logging
messages for login detection.
R1(config)# login block-for 120 attempts 5
within 60
R1(config)# ip access-list standard PERMIT-
ADMIN
R1(config-std-nacl)# remark Permit only
Administrative hosts
R1(config-std-nacl)# permit 192.168.10.10
R1(config-std-nacl)# exit
R1(config)# login quiet-mode access-class
PERMIT-ADMIN
R1(config)# login delay 10


R1(config)# login on-success log
R1(config)# login on-failure log
2012 Cisco and/or its affiliates. All rights reserved. 15
Telnet:
Traditional method for remote access on routers use TCP port 23
Traffic is forwarded in plaintext
Hackers can capture packets using a protocol analyser such as Wireshark

SSH
has replaced Telnet as the recommended practice
Supports confidentiality and session integrity to remote connections
Functionality is similar to an outbound Telnet connection, except that the
connection is encrypted and operates on port 22
With authentication and encryption, SSH allows for secure communication
over a non-secure network.




2012 Cisco and/or its affiliates. All rights reserved. 16
Steps to complete prior to start configuration
Only the Cisco IOS cryptographic images containing the IPsec feature set support
SSH : Release 12.1(1)T image or later
Ensure that each of the target routers
has a unique host name
is using the correct domain name of the network
configured for local authentication or AAA services for username and password
authentication
Steps to configure SSH
Configure the IP domain name.
Generate one-way secret RSA (Rivest, Shamir, and Adleman (RSA) algorithm) keys to
encrypt the SSH traffic
Create a local database username entry if not created
Enable VTY inbound SSH sessions.

2012 Cisco and/or its affiliates. All rights reserved. 17
Configure the IP domain name.
Generate one-way secret RSA
keys

Create a local database
username entry.
Enable VTY inbound SSH
sessions.


Configure optional features:
Version, Number of
Authentication retries and SSH
timeout
R1(config)# ip domain-name span.com
R1(config)# crypto key generate rsa general-
keys modulus 1024

R1(config)# username Bob secret cisco

R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh

R1(config)# ip ssh version 2
R1(config)# ip ssh authentication-retries 2
R1(config)# ip ssh time-out 60
2012 Cisco and/or its affiliates. All rights reserved. 18
Questions?


Next: Router Privilege Levels and Role based
views (Slides 19 to 26)


Privilege levels and Configure router privilege levels (not in Lab)
Part 3 of Lab: Configure Administrative Roles :
Create multiple role views and grant varying privileges
Verify and contrast views

2012 Cisco and/or its affiliates. All rights reserved. 19
So far, we discussed How to secure router for local and remote
administrative access
Now
Question 1: Who will need to access router?
Answer 1 : Staff working with the IT department.
Question 2.: Should everyone in an IT department have the same level of access to
the network infrastructure (routers, switches, AP, )?
Answer 2: NO
Solution?
Configure :
Privilege levels
Role-Based CLI
2012 Cisco and/or its affiliates. All rights reserved. 20
Predefined settings with two levels of access
Level 0: for user-level access privileges
Seldom used, includes: disable, enable, exit, help, and logout.
Level 1(User EXEC mode):
A user cannot make any changes or view the running configuration file.
Level 15 (Privileged EXEC mode):
For Administrators : to configure and monitor every part of the router
Users can view and change all aspects of the configuration
Customised Levels 2 14: for user-level privileges
For those administrators who need only to monitor, not configure, the router
Provides some flexibility
Provides router level access

2012 Cisco and/or its affiliates. All rights reserved. 21
A USER : with normal Level 1
access.
A SUPPORT: with Level 1 and
ping command access.


A JR-ADMIN : with the same
privileges as the SUPPORT
account plus access to the reload
command.

An ADMIN : which has all of the
regular privileged EXEC
commands
R1(config)# username USER privilege 1
secret cisco
R1(config)# privilege exec level 5 ping
R1(config)# enable secret level 5 cisco5
R1(config)# username SUPPORT privilege 5
secret cisco5
R1(config)# privilege exec level 10 reload
R1(config)# enable secret level 10 cisco10
R1(config)# username JR-ADMIN privilege
10 secret cisco10

R1(config)# username ADMIN privilege 15
secret cisco123
2012 Cisco and/or its affiliates. All rights reserved. 22
Still, some organisations might not find them suitable
No access control to specific interfaces, ports, logical interfaces, and slots
on a router.
Commands available at lower privilege levels are always executable at
higher levels.
Commands specifically set on a higher privilege level are not available for
lower privileged users.
Assigning a command with multiple keywords to a specific privilege level
also assigns all commands associated with the first keywords to the same
privilege level
An example is the show ip route command.
if an administrator needs to create a user account that has access to most
but not all commands, privilege exec statements must be configured for
every command that must be executed at a privilege level lower than 15
Solution: Role-Based CLI Access


2012 Cisco and/or its affiliates. All rights reserved. 23
Views: are a set of commands that are accepted from a particular view
Root View:
is required to define (including create and update) Views and Super views
User will have same access privileges as has level-15 privileges in root view
Other views will have only those commands available which are added by root view user


View #1

View #2 View #3

View #4 View #5 View #6
show ip route show run int fa0/0
show
interfaces
Root View
2012 Cisco and/or its affiliates. All rights reserved. 24
AAA must be enabled first
enter the root view
Create and modify a view (FIRST) or super
view from root view
using Router(config)# parser view view-
name
Set a password and add commands to a
view
Router(config-view)# secret encrypted-
password
Router(config-view)#commands parser-
mode {include | include-exclusive |
exclude} [all] [interface interface-name |
command]
R1(config)# aaa new-model
R1# enable view
R1(config)# parser view FIRST



R1(config-view)# secret firstpass
R1(config-view)# command exec
include show version
R1(config-view)# command exec
include configure terminal
R1(config-view)# command exec
include all show ip
2012 Cisco and/or its affiliates. All rights reserved. 25
Commands cannot be configured for a super view
Commands can be configured to CLI views.
Users who are logged in to a super view can access all of the commands that are
configured for any of the CLI views that are part of the super view.
Each super view has a password that is used to switch between super views or
from a CLI view to a super view
If a super view is deleted, CLI views associated with that super view are not
deleted

View #2
command exec
View #3
command exec
View #1
command exec
Superview #1
View #4
command exec
View #5
command exec
View #6
command exec
Superview #2
CLI Views
Root View
View #2
command exec
View #3
command exec
View #1
command exec
View #4
command exec
View #5
command exec
View #6
command exec
View #4
command exec
2012 Cisco and/or its affiliates. All rights reserved. 26
Create three views SHOWVIEW, VERIFYVIEW
and REBOOTVIEW and add respective
commands
Create a super view and enter view
configuration mode
Router(config)#parser view view-name super
view
Sets a password immediately after creating a
view (otherwise an error message will
appear)
Router(config-view)#secret encrypted-
password
Add a CLI view to a super view (Multiple
views may be added and Views may be
shared between super views :
Router(config-view)#view view-name
R1(config)# parser view SHOWVIEW
R1(config-view)# secret cisco
R1(config-view)# commands exec include show version
R1(config)# parser view VERIFYVIEW
R1(config-view)# secret cisco5
R1(config-view)# commands exec include ping
R1(config)# parser view SUPPORT super view
R1(config-view)# secret cisco1
R1(config-view)# view SHOWVIEW
R1(config-view)# view VERIFYVIEW
R1(config-view)# exit
R1(config)# parser view JR-ADMIN super view
R1(config-view)# secret cisco2
R1(config-view)# view SHOWVIEW
R1(config-view)# view VERIFYVIEW
R1(config-view)# view REBOOTVIEW
R1(config-view)# exit
2012 Cisco and/or its affiliates. All rights reserved. 27
Questions?

Next: IOS Resilience and Management Reporting
(Slides 28 to 55)


Part 4 of Lab: Configure Cisco IOS Resilience and Management Reporting
--Cisco IOS Resilience
--Secure the Cisco IOS image and configuration files; Management and Reporting
Features
--Configure a router as a synchronized time source for other devices using NTP
--Configure Syslog support on a router; Install a Syslog server on a PC and enable it;
--Configure trap reporting on a router using SNMP (In Lab only)
--Make changes to the router and monitor syslog results on the PC (In Lab only)

2012 Cisco and/or its affiliates. All rights reserved. 28
So far,
secured router with encrypted passwords for both local and remote access
control user access using privilege levels and role-based CLI
Still, hacker can access router and able to:
change and/or Erase: configuration and the operating system
this will lead to availability threat
Solution: secure the primary bootset (Configuration file and the running IOS image)
By using Secure Copy (SCP)
configuration and image files can be copied securely to another device
provides a secure and authenticated method for copying files between devices
relies on Secure Shell (SSH)
The Cisco IOS Resilient Configuration feature:
enables a router to secure the running image and maintain a working copy of the configuration
secures the smallest working set of files to preserve persistent storage space
speeds up the recovery process
files are stored locally and are not included in any directory listing on the drive.
feature can be disabled through a console session
2012 Cisco and/or its affiliates. All rights reserved. 29
********************** enable Cisco IOS image resilience**************************
**Secure the Cisco IOS image and archive a copy of the running configuration***
******* store a secure copy of the primary bootset in persistent storage*********

R1(config)# secure boot-image
R1(config)#
%IOS_RESILIENCE-5-IMAGE_RESIL_ACTIVE: Successfully secured running image

R1(config)# secure boot-config
R1(config)#
%IOS_RESILIENCE-5-CONFIG_RESIL_ACTIVE: Successfully secured config archive
[flash:.runcfg-20101017-020040.ar]
****Verify*********************
R1# show secure bootset

IOS resilience router id JMX0704L5GH

IOS image resilience version 12.3 activated at 08:16:51 UTC Sun Jun 16 2005
Secure archive slot0:c3745-js2-mz type is image (elf) []
file size is 25469248 bytes, run size is 25634900 bytes
Runnable image, entry point 0x80008000, run from ram

IOS configuration resilience version 12.3 activated at 08:17:02 UTC Sun Jun 16
2002
Secure archive slot0:.runcfg-20020616-081702.ar type is config configuration
archive size 1059 bytes
2012 Cisco and/or its affiliates. All rights reserved. 30

Cisco IOS image resilience is now enabled and it hides the file from dir
and show commands.
The file cannot be viewed, copied, modified, or removed using EXEC mode
commands.
It can be viewed in ROMMON mode. When turned on for the first time, the running
image is secured

It take a snapshot of the router running configuration and securely
archives it in persistent storage (flash).
Archived running config file name is based on the date and time archived by the
secure boot-config command.

2012 Cisco and/or its affiliates. All rights reserved. 31
Recovery procedure for a compromised router
***************** 1. to verify the existence of the archive***********************
R1# show secure bootset

IOS resilience router id JMX0704L5GH

IOS image resilience version 12.3 activated at 08:16:51 UTC Sun Jun 16 2005
Secure archive slot0:c3745-js2-mz type is image (elf) []
file size is 25469248 bytes, run size is 25634900 bytes
Runnable image, entry point 0x80008000, run from ram

IOS configuration resilience version 12.3 activated at 08:17:02 UTC Sun Jun 16
2002
Secure archive slot0:.runcfg-20020616-081702.ar type is config configuration
archive size 1059 bytes
******************OR Verify Archive in ROMMON mode***************************
Reload the router and enter ROMMON mode
Use the dir and boot commands to list the contents of the device with secure bootset
******************************************************************************************************************************************************
Router will search for startup configuration
If NOT available then prompts for interactive configuration input
Decline to enter an interactive configuration session
recover the secured startup configuration
**************************************************************************
rommon 1 > dir slot0:
rommon 2 > boot slot0:c3745-js2-mz
....
Router(config)# secure boot-config restore slot0:RESCUE-CFG
Router# copy slot0:RESCUE-CFG running-config


2012 Cisco and/or its affiliates. All rights reserved. 32
Router# dir flash:
Directory of flash:/

1 -rw- 23587052 Jan 9 2010 17:16:58 +00:00 c181x-advipservicesk9-mz.124-24.T.bin
2 -rw- 600 Sep 26 2010 07:28:12 +00:00 vlan.dat

128237568 bytes total (104644608 bytes free)
Router# dir nvram:
Directory of nvram:/

189 -rw- 1396 startup-config
190 ---- 24 private-config
191 -rw- 1396 underlying-config
1 -rw- 0 ifIndex-table
2 -rw- 593 IOS-Self-Sig#3401.cer
3 ---- 32 persistent-data

<output omitted>
Verify the IOS resiliency configuration.
****************************************************************************
R1# show secure bootset
IOS resilience router id FHK110913UQ

IOS image resilience version 12.4 activated at 02:00:30 UTC Sun Oct 17 2010
Secure archive flash:c181x-advipservicesk9-mz.124-24.T.bin type is image (elf) []
file size is 23587052 bytes, run size is 23752654 bytes
Runnable image, entry point 0x80012000, run from ram

IOS configuration resilience version 12.4 activated at 02:00:41 UTC Sun Oct 17 2010
Secure archive flash:.runcfg-20101017-020040.ar type is config
configuration archive size 1544 bytes
2012 Cisco and/or its affiliates. All rights reserved. 33
Verify flash to ensure that IOS image file is now hidden.
R1# dir flash:
Directory of flash:/

2 -rw- 600 Sep 26 2010 07:28:12 +00:00 vlan.dat

128237568 bytes total (104636416 bytes free)
2012 Cisco and/or its affiliates. All rights reserved. 34
Verify the configuration by erasing the startup-config and reloading the
router.


R1# erase startup-config
Erasing the nvram filesystem will remove all configuration files! Continue?
[confirm]
[OK]
Erase of nvram: complete
R1# show startup-config
startup-config is not present
R1# reload

System configuration has been modified. Save? [yes/no]: n
Proceed with reload? [confirm]
...
Router> enable
Router# show secure bootset
%IOS image and configuration resilience is not active
2012 Cisco and/or its affiliates. All rights reserved. 35
Extract the backup startup config file from the secure archive and save
it to flash.
Replace the current running configuration with the archive.
Router# config t
Router(config)# secure boot-config restore flash: archived-config
ios resilience: configuration successfully restored as flash: archived-config
Router(config)# ^C
Router# configure replace flash: archived-config
This will apply all necessary additions and deletions
to replace the current running configuration with the
contents of the specified configuration file, which is
assumed to be a complete configuration, not a partial
configuration. Enter Y if you are sure you want to proceed. ? [no]: y
Total number of passes: 1
Rollback Done

R1# copy run start
2012 Cisco and/or its affiliates. All rights reserved. 36
To test that the secure boot image feature works, format flash.
R1# format flash:
Format operation may take a while. Continue? [confirm]
Format operation will destroy all data in "flash:". Continue? [confirm]
Writing Monlib sectors...
Monlib write complete

Format: All system sectors written. OK...

Format: Total sectors in formatted partition: 250848
Format: Total bytes in formatted partition: 128434176
Format: Operation completed successfully.

Format of flash: complete
R1#
2012 Cisco and/or its affiliates. All rights reserved. 37
Verify that flash is erased and reload the router.
R1# dir
Directory of flash:/

No files in directory

128237568 bytes total (104640512 bytes free)
Router# reload
Proceed with reload? [confirm]

*Oct 17 02:37:37.127: %SYS-5-RELOAD: Reload requested by console. Reload Reason
: Reload Command.
2012 Cisco and/or its affiliates. All rights reserved. 38
The router boots up using the secured IOS image.
...
cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706

Cisco IOS Software, C181X Software (C181X-ADVIPSERVICESK9-M), Version 12.4(24)T,
RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Thu 26-Feb-09 03:22 by prod_rel_team
...
R1> enable
Password:
2012 Cisco and/or its affiliates. All rights reserved. 39
2012 Cisco and/or its affiliates. All rights reserved. 40
2012 Cisco and/or its affiliates. All rights reserved. 41
2012 Cisco and/or its affiliates. All rights reserved. 42
2012 Cisco and/or its affiliates. All rights reserved. 43
software-based system clock :
can be set from a number of sources
can be used to distribute the current time through various mechanisms to other systems
An NTP network usually obtains the time from an authoritative time source,
such as a radio clock or an atomic clock.
NTP then distributes this time across the network.
NTP is extremely efficient; no more than one packet per minute is necessary to
synchronise two machines to within 1 mSec of one another.
Cisco devices support specifications for NTP v3 (RFC 1305).
NTP v4 is under development but NTP v3 is the Internet standard.
NTP services are enabled on all interfaces by default.
Router can be configured with either a peer or a server association
NTP clients are typically configured with a server association (meaning that
only this system will synchronise to the other system, and not vice versa)

2012 Cisco and/or its affiliates. All rights reserved. 44
configure a router as the authoritative time source
(Server) : Router(config)#ntp master
configure a router as an NTP client
Create an association to a server : meaning
that only this system will synchronise to the
other system, and not vice versa
Router(config)# ntp server {ip-address |
hostname} [version number] [key keyid]
[source interface] [prefer]
Configure the router to listen to NTP
broadcast packets on an interface-by-
interface basis.
Router(config-if)#ntp broadcast client
secure authentication for security purpose
Enable the authentication feature:
Router(config)#ntp authentication
Define the authentication key:
Router(config)#ntp authentication-key key-
number md5 value
Define which key is to be trusted: Router(config)#ntp
trusted-key key-number
R1(config)# ntp master 5
R1(config)# ntp authentication-key 1 md5 R1-SECRET
R1(config)# ntp peer 209.165.200.225 key 1

R2(config)# ntp authentication-key 1 md5 R1-SECRET
R2(config)# ntp authentication-key 2 md5 R2-SECRET
R2(config)# ntp trusted-key 1

R2(config)# ntp server 209.165.201.1
R2(config)# interface Fastethernet0/0
R2(config-if)# ntp broadcast

R3(config)# ntp authentication-key 1 md5 R2-SECRET
R3(config)# ntp trusted-key 1
R3(config)# interface Fastethernet0/1
R3(config-if)# ntp broadcast client
2012 Cisco and/or its affiliates. All rights reserved. 45
For a large enterprise with hundreds of devices, monitoring, managing,
logging and processing log messages can be challenging
Several considerations for secure management:
configuration change management
automated logging
reporting of information from identified devices
Use of tools such as SNMP
When logging and managing information, the information flow between
management hosts and the managed devices can take two paths:
Out-of-band (OOB) - Information flows on a dedicated management network on which no
production traffic resides.
In-band - Information flows across an enterprise production network, the Internet, or both
using regular data channels.



2012 Cisco and/or its affiliates. All rights reserved. 46
Information flow between management hosts and the managed devices
can take two paths.


Out of Band (OOB):
Information flows within a
network on which no
production traffic resides.
In-Band:
Information flows across the
enterprise production
network or the Internet (or
both).
2012 Cisco and/or its affiliates. All rights reserved. 47
OOB management is appropriate for large enterprise networks and not
always desirable. Some questions that must be considered when
designing an in-band management solution:
Which management protocols does each device support?
Does the management channel need to be active at all times?
Is SNMP necessary?
Which are the most important logs?
How are important messages separated from routine notifications?
How do you prevent tampering with logs?
How do you make sure time stamps match?
What log data is needed in criminal investigations?
How do you deal with the volume of log messages?
How do you manage all the devices?
How can you track changes when attacks or network failures occur?

2012 Cisco and/or its affiliates. All rights reserved. 48
In-Band Management Guidelines
Apply only to devices needing to be managed or monitored.
Use IPsec, SSH or SSL instead of Telnet when possible
Decide whether the management channel needs to be open at all times.
Keep clocks on hosts and network devices synchronised.
Record changes and archive configuration

OOB Management Guidelines
Provide highest level of security and mitigate the risk of passing insecure
management protocols over the production network.
Keep clocks on hosts and network devices synchronised.
Record changes and archive configurations.

2012 Cisco and/or its affiliates. All rights reserved. 49
Routers can
log information about configuration changes, ACL violations, interface status, and many
other types of events
can send log messages to one or more of the destinations such as Console; Terminal lines;
Memory buffer; SNMP Server; Syslog Server
use of logging destination affects system overhead
Router log messages :
fall into one of eight levels. The lower the level number, the higher the severity level.
contain three main parts :




Oct 29 10:00:01 EST: %SYS-5-CONFIG_I: Configured from console by vty0 (10.2.2.6)
Time Stamp
Log Message Name and
Severity Level
Message Text
Note: The log message name is not the same as a severity level name.
2012 Cisco and/or its affiliates. All rights reserved. 50

Logging to the console.

Logging to VTY.

Logging to a Syslog Server.

Logging to an internal buffer

Two Components of Syslog Systems
Syslog server:
A host that accepts and processes log messages from one or more syslog clients.
Syslog client:
A host that generates log messages and forwards them to a syslog server.
Routers, switches, PIXs, ASAs, APs, servers,



Most overhead
Least overhead
2012 Cisco and/or its affiliates. All rights reserved. 51
Highest Level
Lowest Level
By default, Severity level 7 (debugging) messages are sent to the router's
console port (line con0).
Note: Level varies by platform and IOS release.
2012 Cisco and/or its affiliates. All rights reserved. 52
Level and Name Definition Example
0 LOG_EMERG A panic condition normally broadcast to all users
Cisco IOS software could
not load
1 LOG_ALERT
A condition that should be corrected immediately, such as a
corrupted system database
Temperature too high
2 LOG_CRIT Critical conditions; for example, hard device errors
Unable to allocate
memory
3 LOG_ERR Errors Invalid memory size
4 LOG_WARNING Warning messages Crypto operation failed
5 LOG_NOTICE
Conditions that are not error conditions but should possibly be
addressed
Interface changed state,
up or down
6 LOG_INFO Informational messages Packet denied by ACL
7 LOG_DEBUG
Messages that contain information that is normally used only
when debugging
Packet type invalid
2012 Cisco and/or its affiliates. All rights reserved. 53
R3(config)# logging 10.2.2.6
R3(config)# logging trap informational
R3(config)# logging source-interface loopback 0
R3(config)# logging on
R3
Lo
0
threshold that when reached
triggers a log message

be adjusted to allow the
administrator to determine what
kinds of messages are sent to the
syslog server
2012 Cisco and/or its affiliates. All rights reserved. 54

Set the destination logging host: IP address or
the DNS name : Router(config)# logging
host [host-name | ip-address]
(Optional) Set the log severity (trap) level
Router(config)#logging trap level


(Optional) Set the source interface
Router(config)#logging source-interface
interface-type interface-number

Enable logging

R3(config)# logging 10.2.2.6


R3(config)# logging trap
informational | alerts |warnings
|notifications |errors |

R3(config)# logging source-
interface loopback 0


R3(config)# logging on
R3(config)# logging monitored |
buffered
2012 Cisco and/or its affiliates. All rights reserved. 55
most practical method for viewing logging events in real time
To enable monitor logging and view system messages over a VTY
session (line vty 0 - 4):
Router(config)# logging monitor [severity]

line configuration command
also affects the display of messages to the console
When enabled, messages will appear only after the user types a carriage return
Without the this command, console messages displayed can interfere with
command line entry.



2012 Cisco and/or its affiliates. All rights reserved. 56
Questions?

Next: Disabling Unused Cisco Router Network
Services and Interfaces (Slides 57 to 71)



Part 5: Configure Automated Security Features
Use the CCP Security Audit tool to identify vulnerabilities and to lock down services
Lock down a router using AutoSecure and verify the configuration
One-Step Lockdown using CCP
Contrast the AutoSecure configuration with CCP (In Lab only)


2012 Cisco and/or its affiliates. All rights reserved. 57

To Secure Network Devices:
determine the vulnerabilities that exist with the current configuration
use a security audit tool to performs checks on the security level of a configuration
Identify Vulnerabilities
modify the configuration to reduce or eliminate those vulnerabilities to secure the
device and the network.

Three tools available
Security Audit wizard - a security audit feature provided through CCP
Cisco AutoSecure - a security audit feature available through the Cisco IOS CLI
One-Step Lockdown - a security audit feature provided through CCP



2012 Cisco and/or its affiliates. All rights reserved. 58
Security Audit compares router configuration against recommended
settings.
Examples of the audit include:
Shut down unneeded servers.
Disable unneeded services.
Apply the firewall to the outside interfaces.
Disable or harden SNMP.
Shut down unused interfaces.
Check password strength.
Enforce the use of ACLs.
2012 Cisco and/or its affiliates. All rights reserved. 59
2012 Cisco and/or its affiliates. All rights reserved. 60
2012 Cisco and/or its affiliates. All rights reserved. 61
2012 Cisco and/or its affiliates. All rights reserved. 62
2012 Cisco and/or its affiliates. All rights reserved. 63
2012 Cisco and/or its affiliates. All rights reserved. 64
2012 Cisco and/or its affiliates. All rights reserved. 65
An automated method is needed to speed up the hardening process (to
disable unused router services and interfaces)
The AutoSecure feature was released in Cisco IOS Release 12.3.
AutoSecure is a single privileged EXEC program
allows elimination of many potential security threats quickly and easily.
helps to make you more efficient at securing Cisco routers.
two modes of operation:
Interactive mode: Prompts to choose the way you want to configure router services and
other security-related features.
Noninteractive mode: Configures security-related features on your router based on a set
of Cisco defaults.

2012 Cisco and/or its affiliates. All rights reserved. 66
Management plane services and functions:
Finger, PAD, UDP and TCP small servers, password encryption, TCP keepalives, CDP,
BOOTP, HTTP, source routing, gratuitous ARP, proxy ARP, ICMP (redirects, mask-
replies), directed broadcast, MOP, banner
password security and SSH access
Forwarding plane services and functions:
CEF, traffic filtering with ACLs
Firewall services and functions:
Cisco IOS Firewall inspection for common protocols
Login functions:
Password security
NTP protocol
SSH access
TCP Intercept services
2012 Cisco and/or its affiliates. All rights reserved. 67
If AutoSecure fails to complete its operation, the running configuration
may be corrupt:
In Cisco IOS Release 12.3(8)T and later releases a pre-AutoSecure configuration
snapshot is stored in the flash under filename pre_autosec.cfg.
Rollback reverts the router to the routers pre-autosecure configuration using the
configure replace flash:pre_autosec.cfg command.
If the router is using software prior to Cisco IOS Release 12.3(8)T, the running
configuration should be saved before running AutoSecure.
2012 Cisco and/or its affiliates. All rights reserved. 68
Cisco AutoSecure Interactive Steps:
Step 1 Identify outside interfaces.
Step 2 Secure the management plane.
Step 3 Create the security banner.
Step 4 Configure passwords, AAA, and SSH.
Step 5 Secure the forwarding plane.
Router#
auto secure [management | forwarding] [no-interact | full]
[ntp | login | ssh | firewall | tcp-intercept]

2012 Cisco and/or its affiliates. All rights reserved. 69
CCP simplifies router and security configuration through smart wizards
that help to quickly and easily deploy, configure, and monitor a Cisco
router without requiring knowledge of the CLI.
CCP simplifies firewall and IOS software configuration
CCP contains a Security Audit wizard that performs a comprehensive
router security audit.
CCP uses security configurations recommended by Cisco Technical
Assistance Center (TAC) and the International Computer Security
Association (ICSA) as the basis for comparisons and default settings.
The Security Audit wizard assesses the vulnerability of the existing
router and provides quick compliance to best-practice security policies.
CCP can implement almost all of the configurations that AutoSecure
offers with the One-Step Lockdown feature
2012 Cisco and/or its affiliates. All rights reserved. 70
2012 Cisco and/or its affiliates. All rights reserved. 71
2012 Cisco and/or its affiliates. All rights reserved. 72
Questions?

Next:
Chapter 2 Lab A: Securing the Router for
Administrative Access
(Slides 73 to 76)






2012 Cisco and/or its affiliates. All rights reserved. 73
Background/Scenario
The router is a key component that controls the movement of data into
and out of the network and between devices within the network. It is
particularly important to protect network routers because the failure of
a routing device could make sections of the network or the entire
network inaccessible. Controlling access to routers and enabling
reporting on routers are critical to network security and should be part
of a comprehensive security policy.
Build a multi-router network and configure the routers and hosts. Use
various CLI and CCP tools to secure local and remote access to the
routers, analyze potential vulnerabilities, and take steps to mitigate
them. Enable management reporting to monitor router configuration
changes.

2012 Cisco and/or its affiliates. All rights reserved. 74
Students can omit the
switches and use crossover
cables between the PCs and
routers R1 and R3.
R1 and R3 are on separate
networks and communicate
through R2, which simulates a
connection to an ISP.
Students can work in teams of
two for router configuration,
one person configuring R1 and
the other R3.
2012 Cisco and/or its affiliates. All rights reserved. 75
Device

Interface IP Address Subnet Mask Default Gateway

Switch Port
R1 Fa0/1 192.168.1.1 255.255.255.0 N/A S1 Fa0/5
S0/0/0 (DCE) 10.1.1.1 255.255.255.252 N/A N/A
R2 S0/0/0 10.1.1.2 255.255.255.252 N/A N/A
S0/0/1 (DCE) 10.2.2.2 255.255.255.252 N/A N/A
R3 Fa0/1 192.168.3.1 255.255.255.0 N/A S3 Fa0/5
S0/0/1 10.2.2.1 255.255.255.252 N/A N/A
PC-A NIC 192.168.1.3 255.255.255.0 192.168.1.1 S1 Fa0/6
PC-C NIC 192.168.3.3 255.255.255.0 192.168.3.1 S3 Fa0/18
2012 Cisco and/or its affiliates. All rights reserved. 76
Part 1: Basic Network Device Configuration
Cable the network as shown in the topology Configure basic IP addressing for routers and PCs;
Configure static routing, including default routes; Verify connectivity between hosts and routers.

Part 2: Control Administrative Access for Routers
Configure and encrypt all passwords; Configure a login warning banner; Configure enhanced
username password security; Configure enhanced virtual login security; Configure an SSH server
on a router; Configure an SSH client and verify connectivity.

Part 3: Configure Administrative Roles
Create multiple role views and grant varying privileges; Verify and contrast views.

Part 4: Configure Cisco IOS Resilience and Management Reporting
Part 1:Secure the Cisco IOS image and configuration files;
Part 2: Configure a router as a synchronized time source for other devices using NTP; Configure Syslog
support on a router; Install a Syslog server on a PC and enable it; Configure trap reporting on a router using
SNMP; Make changes to the router and monitor syslog results on the PC.

Part 5: Configure Automated Security Features
Lock down a router using AutoSecure and verify the configuration; Use the CCP Security Audit tool
to identify vulnerabilities and to lock down services; Contrast the AutoSecure configuration with
CCP.

2012 Cisco and/or its affiliates. All rights reserved. 77