Network security-device security reinforcement

 

Network equipment is also an important device in the network boundary. It is the main road to the entire data center and cannot cause any loss. In the past two days, the Nexus network equipment was reinforced with simple security measures, the main operations are summarized as follows:

1. Create a read-only account on nexus, for example, to view configuration and other information. Because nexus has a good and easy-to-operate RBAC control mechanism, this is a better implementation.

A. Create a role named maintain and determine the executable command.

N7k (config) # rolename maintain

N7k (config) # rule1 permit command show running-config

N7k (config) # rule2 permit command show MAC address-table

N7k (config) # rule3 permit command show access-lists

B. Create an account that belongs to maintain. maintainonly

N7k (config) # usernamemaintainonly secret 0 xxxxxx role maintain

C. Log On With maintainonly. Check it.

N7k #? ...... I tried it with a question mark and there is no show command.

End go to EXEC mode

Exit exit from Command Interpreter

N7k # Show run ...... This is acceptable for direct execution here.

! Command: Show running-config

! Time: Thu Sep 4 :35:522014

Version 6.1 (2)

Switchname n7k

.

.

. N7k # Show int ...... The interface is not allowed to be viewed. The actual permissiondenied.

% Permission deniedfor the role

2. Add a bannermotd warning message to the vswitch. Unauthorized users are not allowed to log on to the device.

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/48/6D/wKioL1QH_xrylcx0AAE5oZVVVdk387.jpg "Title =" banner.png "alt =" wkiol1qh_xrylcx0aae5ozvvvdk387.jpg "/>

3. Change the device to SSH Login

Feather SSH

No feather Telnet

4. Add access-class access control to vty and set the idle logon timeout time to 10 min.

Create an ACL:

IP access-listlogin_auth

1 permit IP 172.10.10.0/24 any

Then, the call is under vty.

Line vty

Access-class login_auth in

Exec-Timeout 10

5. Enable root protection on some necessary interfaces

Spanning-tree guard Root

6. enable some other security protection features

No ip redirects

No IP unreachables

No IP proxy-ARP

 

So much to summarize, and continue next time.

This article from the "the brightest star in the night sky" blog, please be sure to keep this source http://wangxl.blog.51cto.com/621714/1548708

Network security-device security reinforcement