Cisco^® CCNA Security Exam Notes : Security On Cisco Routers

To configure the console password and secret password follow below instructions

Step 1 : Enter global configuration mode

R1>enable
R1#configure terminal

Step 2 : Set the enable password to "certexam"

R1(config)#enable password certexam

Step 3: Set the enable secret to "certtest"

R1(config)#enable secret certtest

Step 4 : Set the console password to "certtest" for line console 0

R1(config)#line console 0
R1(config-line)#login
R1(config-line)#password certtest

To set the vty password for lines 0 to 4 follow below instructions

Step 1 : Enter global configuration mode

R1>enable
R1#configure terminal

Step 2 : Set the telnet access password to "certexam" for line vty 0-4, this will enable remote users to telnet into vty ports 0-4

R1(config)#line vty 0 4
R1(config-line)#login
R1(config-line)#password certexam

The following are the IOS based security features:

• Stateful inspection - Performs stateful inspection using Context Based Access Control (CBAC).
• Virtual Private Networks (VPN) - Provides tunnels for virtual private communication.
• Intruder Prevention System (IPS) - Cisco IOS may be configured to detect an attacker and prevent him from proceeding further, and report the same.
• VPN Routing and Forwarding - aware Firewall - A VRF-aware firewall maintains a separate routing and forwarding table for each VPN,

Most of the Integrated Services Routers contain one or more USB drives, which may be used for digital signatures, IOS image updates, and backing up configuration files.

Integrated Services Modules support various modules to facilitate faster response times, and off-load work from the router's processor and memory. These include the following:

• Cisco HWIC-AP: An IEEE 802.11 wireless module supporting a variety of wireless standards.
• Cisco IDS Network Module: Includes a hard drive containing multiple signatures of well-known attacks. Used to detect and subsequently prevent malicious traffic.
• Cisco Content Engine: Includes a hard drive for caching web content.
• Cisco Network Analysis Module (NAM): Provides a detailed analysis of traffic flow.
• AIM-VPN - Several models available, used for VPN processing and relieves router processor off VPN processing load.

There are several methods that Cisco recommends for securing management plane. These include the following:

• Passwords - At the very least, network admins can secure the network devices using hard to guess passwords.
• User Authentication using AAA - One disadvantage of using just passwords is that it is not possible to know who had accessed a network device. By using username and password combination, admins can keep track of who had logged in. The user authentication services may be provided by AAA (Authentication, Authorization, and Accounting) server.
• Role Based Access Control (RBAC) - Role-based access control (RBAC) is a method of regulating access to computer or network devices based on the roles of individual users within an enterprise. In this context, access is the ability of an individual user to perform a specific task, such as view, create, or modify a file. you can control this through AAA and custom privilege levels/parser views.
• Encrypted management protocols - You can use secure protocols, such as https (instead of http), and ssh for securely communicating to the network device.
• Secure system files - By securing IOS images, and configuration files, you make it difficult to delete or modify those files by the attacker.
• Logging - Logging ensures that events are recorded for future analysis. Different types of logging include a) commands logging, b) system events logging, c) error messages logging, etc.
• Network Time Protocol (NTP) - NTP enables to maintain proper time stamps and keep all devices in time sync. It makes logging messages more trust worthy.

The following two commands are used to secure boot image, and boot configuration on an IOS router:

Router1(config)#secure boot-image

! Secure the startup-config

Router1(config)#secure boot-config

[flash:.runcfg-20111234-230123.ar]

The following command may be used to verify the boots set:
! Verify the bootset

Router1(config)# do show secure bootset

Displays the status of configuration resilience and the primary bootset filename

Previous   Contents   Next