Configure a router to block the virus propagation path in the LAN

Vro setting virus blocking measure 2

(1) Port reinforcement

The setting of the password is of course very important if you want to make sure that the wall of the router is solid. Generally, the network administrator can log on to the vro through the Console Aux and Ethernet ports of the vro and then configure the vro. This situation makes management easy, but illegal users can also access it through virtual machines. Therefore, adding a password to the corresponding port is a common configuration method. Taking the Aux port as an example, the command is as follows:

 
 

  
  
Router#configure terminal  
  
  
 
  
  
Enter configuration commands, one per line. End with CNTL/Z.  
  
  
 
  
  
Router(config)#line aux 0  
  
  
 
  
  
Router(config-line)#password test54ee  
  
  
 
  
  
Router(config-line)#login 
 
 

Obviously, the mixing of passwords should be enhanced during password configuration so that illegal intruders may not easily break into the door and launch attacks on the vro. Many administrators use the enable password command when setting the Super User password, which poses a major security risk. In view of this, we recommend that you use the enable secret command to encrypt the password. This encryption uses the MD5 hash algorithm, which is more secure than the previous configuration.

Router (config) # enable secret test54ee

(2) filter ICMP Packets

Malicious ping is a common attack method of LAN viruses. The virus randomly generates the ping Destination Address and forwards packets through the vro. Therefore, you need to create a NAT table for each ping ICMP packet in the vro. If the Administrator views the table in privileged user mode, if the user sees a large number of icmp nat sessions, he should be cautious about whether the table has been attacked (that is, DoS attacks ).

If the virus maliciously initiates an ICMP ping attack and tens of thousands of ping packets are sent within a few seconds, the NAT table occupies a large number of NAT Session connections. The existence time of the udp nat SESSlON is 5 seconds, and the SESSION time of the NAT connection is 24 hours, this vicious ping attack may occupy all the nat session values. The consequence is that normal network data packets cannot communicate normally because all the NAT SESSlON of the router is occupied by the NAT service. Therefore, we can filter out ICMP packets in the access list to ensure normal network services. We can use the following command to shield ICMP packets from external and internal sources.

 
 

  
  
Router(Config)#access-list 110 deny icmp any any echo log  
  
  
 
  
  
Router(Config)#access-list 110 deny icmp any any redirect log  
  
  
 
  
  
Router(Config)#access-list 110 deny icmp any any mask-request log  
  
  
 
  
  
Router(Config)#access-list 110 permit icmp any any  
  
  
 
  
  
Router(Config)#access-list 111 permit icmp any any echo  
  
  
 
  
  
Router(Config)#access-list 111 permit icmp any any Parameter-problem  
  
  
 
  
  
Router(Config)#access-list 111 permit icmp any any packet-too-big  
  
  
 
  
  
Router(Config)#access-list 111 permit icmp any any source-quench  
  
  
 
  
  
Router(Config)#access-list 111 deny icmp any any log 
 
 

(3) port filtering

Create an access list at the egress and ingress of the router to control access to viruses. These access control lists are based on ports (such as 135, 136, 445, and 4444. Generally, administrators can view the number of data packets to adjust their order and put the number of packets to the front to increase the speed.

 
 

  
  
Router(Config)#Access-list 110 deny tcp any any eq 135  
  
  
 
  
  
Router(Config)#Access-list 110 deny udp any any eq 135  
  
  
 
  
  
Router(Config)#Access-list 110 deny tcp any any eq 136  
  
  
 
  
  
Router(Config)#Access-list 110 deny udp any any eq 136  
  
  
 
  
  
Router(Config)#Access-list 110 deny tcp any any eq 445  
  
  
 
  
  
Router(Config)#Access-list 110 deny udp any any eq 445  
  
  
 
  
  
Router(Config)#Access-list 110 deny tcp any any eq 4444  
  
  
 
  
  
Router(Config)#Access-list 110 deny udp any any eq 4444 
 
 

Follow the preceding steps to apply the list to the corresponding port.

The virus blocking measures are not only described above. For more information, see: Configuring a router to block the virus propagation path in the LAN.

1. Router POS access technology and Solutions
2. Configuration method of router log information record
3. For beginners, refer to the CISCO router tutorial.
4. How to Set rootkit on a vro Intranet
5. Describes vro settings to ensure security
6. Soft route application skills: build cross-network access Bridges