Configure a router to block the virus propagation path in the LAN

Principle of virus blocking on vro

Can routers, as key devices in the network, block virus infections? The vro acts as the channel for cross-network access to the internal PC. If we limit these ports, it can prevent viruses from entering through the Internet through the vro, and also prevent internal viruses from spreading out the virus through the vro.

When a vro is switched to the Internet as a NAT address, the firewall is configured to restrict all packets on the dangerous target port, in this way, the router that initiates an attack on the Intranet from the Internet blocks the virus attack packets and cannot access the Intranet.

In addition, if the internal PC is infected with a virus, the attack packets of the virus cannot be transmitted to the external network through the router. It should be noted that preventing virus propagation through routers is based on the LAN subnet division. If there is no specific subnet virus infection, it cannot be blocked, because the network transmission of PCs in the same network segment is not forwarded through the router. Fortunately, large local networks are divided into subnets, and subnets are directly isolated through routers/switches.

Router setting virus blocking measure 1

(1) Service Optimization

The number of services enabled by the vro must be as small as possible. Only the required services must be enabled to disable unnecessary services. This not only saves memory, but also improves security. To ensure the simplicity of the router and prevent memory consumption, You can first disable the router's Fast Packet forwarding mechanism and disable the interface's Fast Packet forwarding mechanism, using a normal packet forwarding mechanism will prevent the router from insufficient memory due to fast forwarding. Second, optimize the memory allocation, disable the fast forwarding, and check whether the static route has been correctly configured.

(2) route security

No matter how hard the network manager is to prevent, the bastion host is often broken from the inside. If the physical security of the vro is not guaranteed, it is nothing else. In addition, the IOS security of Cisco routers cannot be ignored. Therefore, we must back up and upgrade Cisco routers. Second, the security of routing logs is also very important, and backup policies should be made.

As long as you know the characteristics of the virus, you can use the cisco router's own functions to cut off the Black Hand, to the maximum extent possible, the virus is rejected. Of course, this is only a policy applied without other protection. To protect network security, a variety of security products can be used. The responsibility of network management is also an important factor. The virus blocking measures are not only described above. For more information, see: Configuring a router to block the virus propagation path in the LAN.

1. Router POS access technology and Solutions
2. Configuration method of router log information record
3. For beginners, refer to the CISCO router tutorial.
4. How to Set rootkit on a vro Intranet
5. Describes vro settings to ensure security
6. Soft route application skills: build cross-network access Bridges