Cisco Router Security

Securing Device Access

• Securing the network perimeter is a key component
• Configuring secure administrative access to Cisco routers is crucial
• Enhanced security for virtual logins improves overall security
• Configuring an SSH daemon enables secure remote management

Edge Router Security

• Single Router Approach: A basic setup using one router to connect the LAN to the Internet
• Defense in Depth Approach: Employs multiple layers of security, including firewalls and multiple routers
• DMZ Approach: Uses a demilitarized zone to isolate public-facing servers from the internal network
• Router security involves physical security, securing the router operating system and config files, and router hardening

Secure Administrative Access

• Tasks include restricting device accessibility, logging all access, authentication, and authorization
• Present legal notification and ensure data confidentiality

Local and Remote Access

• Local Access: Direct connection to the router, typically using a console cable
• Remote Access via Telnet/SSH: Enables access over a network connection
• Remote Access via Modem: Allows connections through an auxiliary port

Strong Passwords

• Passwords should exceed 10 characters and use a mix of upper/lowercase letters, numbers, symbols and spaces
• Should not be easily identifiable and be changed often
• Never write passwords down in plain sight
• secret is a Weak Password because it is a Simple dictionary password
• b67n42d39c is a Strong Password because it Combines alphanumeric characters
• smith is a Weak Password because it is a Mother’s maiden name
• 12^h u4@1p7 is a Strong Password because it Combines alphanumeric characters,symbols, and includes a space
• toyota is a Weak Password because it is a Make of car
• bob1967 is a Weak Password because it is a Name and birthday of user
• Blueleaf23 is a Weak Password because it is Simple words and numbers

Increasing Access Security

• It is possible to enforce a minimum password length of 10 characters
• Enable password encryption
• Configure login timeouts

Secret Password Algorithms

• Use either type 8 or type 9 password encryption
• The enable algorithm-type command along with the username algorithm-type command is to specify encryption

Securing Line Access

• Commands can be configured on a router, specifically for console, AUX, and VTY lines
• Using a username database in conjunction with SSH for virtual terminal lines

Enhancing Login Security

• Delays between login attempts can slow down brute-force attacks
• Login shutdown can be enabled if DoS attacks are suspected
• System-logging messages can be configured for login detection

Login Enhancements

• The command syntax "login block-for seconds attempts tries within seconds" is how to set the lockout
• The command syntax "login delay seconds" sets a delay between login attempts

Logging Failed Attempts

• Login Syslog Messages can be generated

SSH Configuration

• Configuration of domain-name, key generation, SSH version, username and related terminal configs
• SSH can be enabled on a Cisco router to function as an SSH server or client
• A client can connect through programs like PuTTY, OpenSSH, or TeraTerm

Assigning Administrative Roles

• Administrative privilege levels can control command availability
• Role-based CLI access can also control command availability

Privilege Levels

• Level 0 is for user-level access, Level 1 is the default for router login, levels 2-14 are customizable, and Level 15 is for enable mode
• User EXEC mode (level 1): User-level commands at the router> prompt
• Privileged EXEC mode (level 15): Enable-level commands at the router# prompt

Privilege Level Syntax

• privilege mode {level level | reset} command

Limitations of Privilege Levels

• No access control is possible to specific interfaces, ports, logical interfaces, and slots on a router
• Lower privilege levels are executable at higher privilege levels
• Setting Commands at higher privilege levels does not make them available for lower privilege users

Role-Based CLI Access

• Security operator privileges: includes configuring AAA, firewall, IDS/IPS, and NetFlow
• WAN engineer privileges: includes configuring routing and interfaces

Role Based Views

• Superviews are a combination of CLI views

Monitoring and Managing Devices

• Use the Cisco IOS resilient configuration feature
• Compare in-band and out-of band management access
• Configure syslog to log system events
• Configure secure SNMPv3 access using ACL
• Configure NTP to enable accurate timestamping

Cisco IOS Resilient Configuration Feature

• Ensures the configuration file in the primary bootset mirrors the router's running configuration when the feature was enabled
• Secures the smallest set of files to save storage space and automatically detects any image or configuration version mismatch
• Local storage is used for securing files, which avoids scalability issues associated with TFTP servers
• Can only be disabled through a console session

Enabling IOS Image Resilience Feature

• With use of the secure boot-image command

Syslog

• Syslog is an operation that sends messages to a Syslog server
• Used for network security

Syslog Message

• Level 0 (emergencies): System is unusable
• Level 1 (alerts): Immediate action is needed
• Level 2 (critical): Critical conditions exist
• Level 3 (errors): Error conditions exist
• Level 4 (warnings): Warning conditions exist
• Level 5 (notifications): Normal but significant condition
• Level 6 (informational): Informational messages only
• Level 7 (debugging): Debugging messages

Message Breakdown

• The sequence number is the first item
• The timestamp displays if service timestamps log is configured
• The next items denote the source, cause, or level of system, mnemonic, and message

Configuring System Logging

• Step 1: logging host [hostname | ip-address]
• Step 2 (optional): logging trap level
• Step 3: logging source-interface interface-type interface-number
• Step 4: logging on

NTP

• Accuracy across a network ensures synchronized operations

NTP Server Config

• Configuration with the ntp master 1 command

NTP Authentication Config

• Can be configured with using: ntp authenticate, ntp authentication-key, and ntp trusted-key

Using Automated Security Features

• Use security audit tools to determine IOS-based router vulnerabilities while using AutoSecure to enable security on IOS-based routers

Discovery protocols

• Protocols like CDP and LLDP help uncover potential vulnerabilities

Settings For Protocols and Services

• Additional recommendations to ensure a device is secure: disable unnecessary services and interfaces and restrict commonly configured management services
• disable probes and scans and gratuitous aRPs and IP directed broadcasts

Cisco Auto Secure Parameters

• no-interact: Prevents interactive configuration prompts
• full: Prompts for all interactive questions
• forwarding: Secures only the forwarding plane
• management: Secures only the management plane
• ntp, login, ssh, firewall, tcp-intercept: Specifies configuration of each specific feature

Operation of Auto Secure

• AutoSecure command is entered and the wizard gathers info about the outside interfaces
• AutoSecure secures the management plane by disabling unnecessary services
• AutoSecure prompts for a banner and for passwords which then enables password and login features

Securing the Control Plane

• The function of securing control plane involves configuring both routing protocol authentications in conjunction Control Plane Policing to prevent spoofing

Routing Protocol Spoofing

• Consequences can be that traffic is re-directed creating routing loops
• Can be monitored on an insecure link
• Can be re-directed to discard it

Authentication

• This can be implemented on OSPF using both MD5 and SHA algorithms

OSPF MD5 Routing Protocol Authentication

• Configuration required on both interfaces of the routers

OSPF SHA Routing Protocol Authentication

• Step 1: Specify an SHA authentication key chain.
• Step 2: Assign the authentication key chain to the desired interfaces.

CoPP

• Control plane policing protects allows various levels for monitoring on interfaces