Network Device Security

Securing Network Devices

• Focuses on securing network devices, covering device access, administrative roles, monitoring, automated security features, and control plane security.

Securing the Edge Router

• Edge routers need physical security, OS and config file security, and router hardening.
• Security approaches can be single router, defense in depth with firewalls, or DMZ (Demilitarized Zone) approach.

Secure Administrative Access

• Restrict device accessibility.
• Log and account for all access attempts.
• Both authenticate and authorize access.
• Present legal notification.
• Ensure data confidentiality.

Local and Remote Access

• Local access is from a PC via Serial connection to the router.
• Remote access uses Telnet/SSH or Modem and Aux Port.

Strong Passwords

• Guidelines for strong passwords include using a length of 10+ characters.
• A mix of uppercase and lowercase letters, numbers, symbols, and spaces should be used.
• Passwords which contain easily identifiable pieces of information, should be avoided.
• Misspell passwords deliberately (e.g., Smith = Smyth = 5mYth).
• Change passwords often.
• Do not write passwords down and leave them where they can be seen.

Increasing Access Security

• Minimum password lengths should be configured using the security passwords min-length command.
• The service password-encryption command encrypts passwords in the configuration.
• The exec-timeout command sets the inactivity timeout for terminal lines.

Secret Password Algorithms

• Configure all secret passwords using type 8 or type 9 passwords
• Use the enable algorithm-type command to enter an unencrypted password.
• Use the username name algorithm-type command to specify type 9 encryption.

Securing Line Access

• Secure console and aux lines by using the login local command and removing the password.
• Enable SSH and use a local database for authentication on VTY lines.

Enhancing the Login Process

• Implement delays between successive login attempts.
• Enable login shutdown if DoS attacks are suspected.
• Generate system-logging messages for login detection.

Enable Login Enhancements

• login block-for seconds attempts tries within seconds is the command syntax.
• login delay 3 sets a delay of 3 seconds between login attempts.

Logging Failed Attempts

• Login Syslog messages can be generated with commands such as, login on-success log [every login] and login on-failure log [every login].
• Can limit the rate with the command security authentication failure rate threshold-rate log
• The show login failures command shows failed login attempts.

Configuring SSH

• Assign a hostname and domain name.
• Generate RSA keys with crypto key generate rsa general-keys modulus 1024.
• Enable SSH ip ssh version 2.
• Create a local user account with secured password.
• Configure VTY lines to use local login and SSH transport with commands such as, login local and transport input ssh.

Connecting to an SSH-Enabled Router

• SSH can be enabled, and a Cisco router can be used either as an SSH server or an SSH client.
• As a client, the router can connect via SSH to another SSH-enabled router
• An SSH client can be used if it's running on a host, such as PuTTY, OpenSSH, or TeraTerm.

Configuring Privilege Levels

• Privilege levels can be configured to control command availability.
• Levels range from 0 (user) to 15 (enable).
• The privilege mode {level level | reset} command command is used to set privilege levels for specific commands.

Limitations of Privilege Levels

No access control to specific interfaces, ports, logical interfaces, and slots on a router

• Commands available at lower privilege levels are always executable at higher privilege levels
• Commands specifically set at higher privilege levels are not available for lower privilege users
• Assigning a command with multiple keywords allows access to all commands that use those

Role-Based CLI Access

• Helps configure AAA, issue show commands, configure the firewall etc.
• Helps configure routing and interfaces.

Role-Based Views

• Views help configure interfaces.
• Superviews contain Views but not commands, two Superviews can use the same View.

Securing Cisco IOS Image and Configuration Files

• The Cisco IOS resilient configuration feature can be used.
• Feature is only available for systems that support a PCMCIA Advanced Technology Attachment (ATA) flash interface.

Cisco IOS Resilient Configuration Feature

• Configuration is copied to the bootset.
• Secures files to preserve storage, does not require extra space.
• Automatically detects image or configuration version mismatch.
• Disabling the feature can only be performed through a console session.

Enabling the IOS Image Resilience Feature

• Use the command, secure boot-image command to secure the running image.
• Use the command, secure boot-config to secure the config archive.
• Use the command, show secure bootset to show the image resilience router.

Using Syslog for Network Security

• Syslog is capable of logging system events.

Introduction to Syslog

• A Syslog server is required, and Router and Switch can send system messages to the Syslog server.

Syslog Message

• Various security levels exist from “emergencies” to “debugging”.
• Syslog messages contain a sequence number, timestamp, facility code, severity level, mnemonic, and description.

Configuring System Logging

• logging host [hostname | ip-address] configures the Syslog server
• logging trap level sets the severity level to log.
• logging source-interface interface-type interface-number specifies the source interface for Syslog messages.
• logging on enables logging.

Introduction to SNMP

• Manages nodes through SNMP.

Using NTP

• Network Time Protocol (NTP) should be used for accurate timestamping between devices.

NTP Server

• Requires configuration with an NTP master.

NTP Authentication

• Requires authentication set.

Performing a Security Audit

• Security settings need to be verified for protocols and services.
• Unneccessary services/interfaces should be disabled.
• Management services must be disabled and restricted.
• Disable probes and scans and enable terminal access security.
• Disable Gratuitous and Proxy ARPs.
• Disable IP-directed broadcasts.

Locking Down a Router Using AutoSecure

• Auto Secure is for enhancing the security of the router.

Using the Cisco AutoSecure Feature

Important command parameters include: no-interact, full, forwarding, management, ntp, login, ssh, firewall and tcp-intercept.

Using the auto secure Command

• An auto secure command is entered.
• A wizard gathers information about the outside interfaces.
• Management and forwarding planes are secured.
• A banner is prompted for.
• Password and login features are prompted for.
• Interfaces are secured.

Routing Protocol Spoofing

• Spoofing will redirect traffic to create routing loops.
• Traffic redirects could allow monitoring on an insecure link.
• Traffic redirects could allow discard.

OSPF MD5 Routing Protocol Authentication

• Requires setup and configuration.

OSPF SHA Routing Protocol Authentication

• Requires interface set and number.

Control Plane Policing

• The goal of policing is to protect the control plane.