Essential security commands for CISCO router Initialization

Essential security commands for CISCO router initialization 1. Security Settings for vro Access Control 1. Strict control over the administrator who can access the vro. Record Filing is required for all maintenance tasks. Www.2cto.com 2. do not access the vro remotely. Even if you need to access the vro remotely, we recommend that you use the access control list and high-intensity password control. 3. Strictly control access to CON ports. Specific measures include: A. If the chassis can be opened, physical lines connected to the CON port can be cut off. B. You can change the default connection attribute, for example, modify the baud rate (96000 by default, and change it to another one ). C. Use the access control list to control access to the CON port. For example, Router (Config) # Access-list 1 permit 192.168.0.1Router (Config) # line con 0 Router (Config-line) # Transport input noneRouter (Config-line) # Login localRouter (Config-line) # Exec-timeoute 5 0 Router (Config-line) # access-class 1 inRouter (Config-line) # endD. set a strong password for the CON port. Www.2cto.com 4. disable this port if you do not use the AUX port. It is disabled by default. Disable a permission classification policy, for example, Router (Config) # line aux 0 Router (Config-line) # transport input noneRouter (Config-line) # no exec 5. For example, Router (Config) # username BluShin privilege 10 G00dPa55w0rdRouter (Config) # privilege EXEC level 10 telnetRouter (Config) # privilege EXEC level 10 show ip access-list 6. set a strong password for privileged mode access. Do not use enable password to set the password. Use the enable secret command. And enable Service password-encryption. 7. control access to VTY. Disable remote access. If necessary, you must set a strong password. Because VTY is encrypted during network transmission, strict control is required. For example, set a strong password, control the number of concurrent connections, strictly control the access address using the access list, and set user access control using AAA. 8. We recommend that you use FTP instead of TFTP for IOS upgrade and backup, and backup of configuration files. For example, Router (Config) # ip ftp username BluShinRouter (Config) # ip ftp password 4tppa55w0rdRouter # copy startup-config ftp: 9. promptly upgrade and patch IOS software. Ii. vro Network Service Security Settings 1. disable CDP (Cisco Discovery Protocol ). For example, Router (Config) # no cdp run Router (Config-if) # no cdp enable www.2cto.com 2. Disable other TCP and UDP Small services. Router (Config) # no service tcp-small-serversRouter (Config) # no service udp-samll-servers 3. Disable the Finger service. Router (Config) # no ip fingerRouter (Config) # no service finger 4. We recommend that you disable the HTTP service. Router (Config) # no ip http server if the HTTP service is enabled, you need to set security settings for it: Set the user name and password, and use the access list for control. For example, Router (Config) # username BluShin privilege 10 G00dPa55w0rd Router (Config) # ip http auth local Router (Config) # no access-list 10 Router (Config) # access-list 10 permit 192.168.0.1 Router (Config) # access-list 10 deny any Router (Config) # ip http access-class 10 Router (Config) # ip http serverRouter (Config) # exit 5. disable the BOOTp service. Router (Config) # no ip bootp server prohibits starting from the network and automatically downloading the initial setting file from the network. Router (Config) # no boot network Router (Config) # no servic config 6. Disable IP Source Routing. Router (Config) # no ip source-route 7. We recommend that you disable it if you do not need the ARP-Proxy service. The Router is enabled by default. Router (Config) # no ip proxy-arp Router (Config-if) # no ip proxy-arp 8. Explicitly prohibit IP Directed Broadcast. Router (Config) # no ip directed-broadcast 9. Disable IP Classless. Router (Config) # no ip classless 10. Disable icmp ip Unreachables, Redirects, and Mask Replies. Router (Config-if) # no ip unreacheablesRouter (Config-if) # no ip redirectsRouter (Config-if) # no ip mask-reply www.2cto.com 11. We recommend that you disable the SNMP protocol service. You must delete some default SNMP settings when disabling the service. Or you need to filter the access list. For example, Router (Config) # no snmp-server community public RoRouter (Config) # no snmp-server community admin RWRouter (Config) # no access-list 70 Router (Config) # access-list 70 deny anyRouter (Config) # snmp-server community MoreHardPublic Ro 70 Router (Config) # no snmp-server enable trapsRouter (Config) # no snmp-server system-shutdownRouter (Config) # no snmp-server trap-anthRouter (Config) # no snmp-serverRouter (Con Fig) # end 12. Disable WINS and DNS services if not necessary. Router (Config) # no ip domain-lookup if needed, you need to set: Router (Config) # hostname Router (Config) # ip name-server 202.102.134.96 13. explicitly prohibit unused ports. Router (Config) # interface eth0/3 Router (Config) # shutdown