Cisco Router Security

Securing Device Access

• Securing a network perimeter is important
• Configure secure administrative access to Cisco routers
• Enhance security for virtual logins
• Configure an SSH daemon for secure remote management

Edge Router Security

• Security approaches for edge routers include single router, defense in depth, and DMZ
  • Single Router: A simple approach using one router to connect the network to the Internet.
  • Defense in Depth: Multiple layers of security including firewalls.
  • DMZ: Uses a firewall to protect the internal network, while providing controlled external access to specific resources.
• Areas of focus for router security
  • Physical Security
  • Router Operating System and Configuration File Security
  • Router Hardening

Secure Administrative Access

• Restricting device accessibility is crucial
• All access attempts should be logged
• Access authentication is needed
• Authorize user actions
• Present a legal notification
• Ensure the confidentiality of data by encrypting when possible

Local and Remote Access

• Local access involves direct connection to the router
• Remote access can be achieved using Telnet/SSH or Modem and Aux Port

Strong Passwords

• Use a password length of 10 or more characters
• Include a mix of uppercase and lowercase letters, numbers, symbols, and spaces in passwords
• Avoid using easily obtainable personal information for passwords
• Intentionally misspell words in your passwords
• Change passwords frequently
• Never leave passwords in plain view
• Weak passwords, such as dictionary words are easily cracked

Increasing Access Security

• Increase password security by setting a minimum password length and enabling password encryption

Secret Password Algorithms

• Best practice is to configure all secret passwords as type 8 or type 9
• Use the enable algorithm-type command to enter an unencrypted password
• Use the username name algorithm-type command to specify type 9 encryption for usernames

Securing Line Access

• Secure line access prevents unauthorized entry into the network devices

Login Enhancements

• Implementing delays between successive login attempts adds a layer of security
• Enable login shutdown if DoS attacks are suspected
• Generate system-logging messages for login detection
• Can implement delays and shutdowns from the "line" configuration page
  • login block-for seconds attempts tries within seconds
  • login delay 3

Logging Failed Attempts

• Generate login syslog messages to monitor failed access attempts
• Use commands like login on-success log, login on-failure log, and security authentication failure rate threshold-rate log

Configuring SSH

• SSH can be enabled and used with a Cisco router as either an SSH server or client for secure remote management.
• As a client, a router can use SSH to connect to another SSH-enabled route where it can accept SSH client connections as a server
• Clients such as PuTTY, OpenSSH, or TeraTerm, can connect via SSH

Administrative Roles

• Configure administrative privilege levels to control command availability
• Configure role-based CLI access to control command availability

Privilege Levels

• Level 0 is predefined for user-level access privileges
• Level 1 is default for login with the router prompt
• Levels 2-14 can be customized for user-level privileges
• Level 15 is reserved for enable mode privileges
• Lower levels are the user EXEC mode (privilege level 1) and privileged EXEC mode (privilege level 15)
• Command syntax: privilege mode {level level | reset) command

Configuring and Assigning Privilege Levels

• Different commands can be configured for different levels of users

Limitations of Privilege Levels

• There is no access control for specific interfaces, ports, logical interfaces, and slots on a router
• Commands available at lower privilege levels are always executable at higher privilege levels
• Commands specifically set at higher privilege levels are not available for lower privilege users
• Assigning a command with multiple keywords allows access to all commands that use those

Role-Based CLI Access

• Security operator privileges can include configurations such as AAA, show commands, firewall, IDS/IPS, and NetFlow
• WAN engineer privileges would configure routing, configure interfaces and issue show commands
• Superviews contain Views but not commands, Two Superviews can use the same View. For example, both Superview 1 and Superview 2 can have CLI View 4 placed inside.

Monitoring and Management

• Use the Cisco IOS resilient configuration feature to secure the Cisco IOS image and configuration files.
• Secure SNMPv3 access using ACL and NTP to enable accurate timestamping between all devices.
• Compare in-band and out-of band management access.

Cisco IOS Resilient Configuration Feature

• Copy of running configuration that was in the router when the feature was first enabled
• Secures working set of files to preserve persistent storage space
• Automatically detects image or configuration version mismatch
• It can be disabled only through a console session and is only available for systems that support a PCMCIA Advanced Technology Attachment (ATA) flash interface.

Enabling the IOS Image Resilience Feature

• This is for systems that need to ensure they can go back to a stable config

Syslog

• Standard logging
• Security logs

Syslog Operation

• Syslog data is routed to
  • Console Line
  • Logging Buffer
  • Terminal Line
  • Syslog Server

Syslog Message

• Messages can have different Levels 0-7 where 0 is the highest:
  • 0 Emergencies: System unusable
  • 1 Alerts: Immediate action needed
  • 2 Critical: Critical conditions exist
  • 3 Errors: Error conditions exist
  • 4 Warnings: Warning conditions exist
  • 5 Notifications: Normal but significant condition
  • 6 Informational: Informational messages only
  • 7 Debugging: Debugging messages

Configuring System Logging

• Set logging host
• Select trap level if needed
• source-interface if needed
• Enable logging

Introduction to SNMP

• SNMP is used to send alerts
• SNMP agents on managed devices communicate with the SNMP Manager

Configuring SNMP Access

• SNMP is used to send alerts

NTP

• NTP is used to keep the systems in sync

NTP Authentication

• Can be authentic
• Add authentication keys as needed

Using Automated Security Features

• Utilize security audit tools to determine IOS-based router vulnerabilities and AutoSecure for security on IOS-based routers

Discovery Protocols CDP and LLDP

• Use discovery protocols to identify any vulnerabilities

Settings for Protocols and Services

• Additional device security measures
  • Disable unnecessary services and interfaces
  • Disable and restrict commonly configured management services
  • Disable probes and scans; ensure terminal access security
  • Disable gratuitous and proxy ARPs
  • Disable IP-directed broadcasts

Cisco AutoSecure

• AutoSecure helps to greatly reduce the attack vector on Cisco routers

Using the auto secure Command

• Auto Secure helps to greatly reduce the attack vector on Cisco routers
• During operation
  • Auto secure command is entered.
  • Wizard gathers information about the outside interfaces
  • AutoSecure secures the management plane by disabling unnecessary services
  • AutoSecure prompts for a banner
  • AutoSecure prompts for passwords and enables password and login features
  • Interfaces and Forwarding plane are secured

Securing the Control Plane

• Configure routing protocol authentication
• Explain the function of Control Plane Policing

Routing Protocol Spoofing

• Consequences of protocol spoofing: - Redirect traffic to create routing loops - Redirect traffic so it can be monitored on an insecure link - Redirect traffic to discard it

OSPF MD5 Routing Protocol Authentication

• Enhanced security with authentication keys

OSPF SHA Routing Protocol Authentication

• Enhanced security with authentication keys

Network Device Operations

• Management, Control, Data connections all need security considerations

Control and Management Plane Vulnerabilities

• Data plane and devices can potentially target AAA, Syslog, SNMP, OSPF

CoPP Operation

• Control Plane Policing restricts traffic to different planes of the network device