Security Configuration of vro Access Control

1. strictly control the administrator who can access the vro. Record Filing is required for any maintenance.
2. do not access the vro remotely. Even if you need to access the vro remotely, we recommend that you use the access control list and high-intensity password control.
3. Strictly control access to CON ports. Specific measures include:
A. if you can open the chassis, you can cut off the physical line connected to the CON port.
B. You can change the default connection property. For example, you can change the baud rate (96000 by default) to another one ).
C. Use the access control list to control access to the CON port. For example:

Router(Config)#Access-list 1 permit 192.168.0.1 Router(Config)#line con 0 Router(Config-line)#Transport input none Router(Config-line)#Login local Router(Config-line)#Exec-timeoute 5 0 Router(Config-line)#access-class 1 in Router(Config-line)#end

D. Set a strong password for the CON port.
4. disable this port if you do not use the AUX port. It is disabled by default. Prohibited:

Router(Config)#line aux 0 Router(Config-line)#transport input none Router(Config-line)#no exec

5. We recommend that you use a permission classification policy. For example:

Router(Config)#username BluShin privilege 10 G00dPa55w0rd Router(Config)#privilege EXEC level 10 telnet Router(Config)#privilege EXEC level 10 show ip access-list

6. Set a strong password for privileged mode access. Do not use enable password to set the password. Use the enable secret command. And enable Service password-encryption.
7. control access to VTY. Disable remote access. If necessary, you must set a strong password. Because VTY is encrypted during network transmission, strict control is required. For example, set a strong password, control the number of concurrent connections, strictly control the access address using the access list, and set user access control using AAA.
8. We recommend that you use FTP instead of TFTP for IOS upgrade and backup and configuration file backup. For example:

Router(Config)#ip ftp username BluShin Router(Config)#ip ftp password 4tppa55w0rd Router#copy startup-config ftp:

9. Upgrade and patch IOS software in a timely manner.