The most detailed Cisco Route Security Configuration in history (1)

Many network administrators ignore security settings when they first use a Cisco router. This article describes how to configure network security when using a Cisco router.

1. Security Configuration of the "Access Control" of the vro

1. strictly control the administrator who can access the vro. Record Filing is required for any maintenance.

2. do not access the vro remotely. Even if you need to access the vro remotely, we recommend that you use the access control list and high-intensity password control.

3. Strictly control access to CON ports. Specific measures include:

A. If the chassis can be opened, the physical lines connected to the CON port can be cut off.

B. You can change the default connection attribute, for example, modifying the baud rate (96000 by default, or changing it to another one ).

C. Use the access control list to control access to the CON port.

For example, Router (Config) # Access-list 1 permit 192.168.0.1

 
 

  
  
Router(Config)#line con 0  
  
  
Router(Config-line)#Transport input none  
  
  
Router(Config-line)#Login local  
  
  
Router(Config-line)#Exec-timeoute 5 0  
  
  
Router(Config-line)#access-class 1 in  
  
  
Router(Config-line)#end 
 
 

D. Set a strong password for the CON port.

4. Disable the AUX port if it is not used. It is disabled by default. Prohibited:

 
 

  
  
Router(Config)#line aux 0  
  
  
Router(Config-line)#transport input none  
  
  
Router(Config-line)#no exec 
 
 

5. We recommend that you use a permission grading policy. For example:

 
 

  
  
Router(Config)#username BluShin privilege 10 G00dPa55w0rd  
  
  
Router(Config)#privilege EXEC level 10 telnet  
  
  
Router(Config)#privilege EXEC level 10 show ip access-list 
 
 

6. Set a strong password for privileged mode access. Do not use enable password to set the password. Use the enable secret command. And enable Service password-encryption.

7. control access to VTY. Disable remote access. If necessary, you must set a strong password. Because VTY is encrypted during network transmission, strict control is required. For example, set a strong password, control the number of concurrent connections, strictly control the access address using the access list, and set user access control using AAA.

8. We recommend that you use FTP instead of TFTP for IOS upgrade and backup and configuration file backup. For example:

 
 

  
  
Router(Config)#ip ftp username BluShin  
  
  
Router(Config)#ip ftp password 4tppa55w0rd  
  
  
Router#copy startup-config ftp: 
 
 

9. Upgrade and patch IOS software in a timely manner.