Professional Documents
Culture Documents
Cisco
Index (I)
Introduccin
General Situation
Routers Security Policy Purpose of a router Basic Router Functional Architecture
Index (II)
Protecting the Router Itself
Attacks on Routers Managing the Router
SNMP SSH
Index (III)
Filtering
ACL ACR
Introduction
Introduction
Purpose of a router Directing packets, roting protocols Filtering:ACL Modifing packets headers: NAT, PAT. Hardware CPU, Memory:
RAM, NVRAM, Flash, and ROM (PROM, EEPROM) ROM, NVRAM.
Introduction
Network Network 00
Network Network 11
...
Interface 0
Interface 1
...
Interface n
Routing Fabric
CPU
Conf
Router
Consola
Security Policy
Security Policy
Router Security Layers
Physical access Electrical Access Administrative Access Software Access Routing Protocolos Management Protocols Access to the networks that the router Serves
Static Configuration Who is authorized to log into the router Roles Password Policy Log policy Porcedures and limits of use
Management
Backbone
Border (EDCs)
LAN_Cliente
Punto Central
EDCs EDCs
FW
AAA:
Logging and Accounting: Tacacs+ Auditing Authorizing
Implementing: E-Policy
Cisco
Login
Console
Central# config t Enter configuration commands, one per line. End with CNTL/Z. Central(config)# line con 0 Central(config-line)# transport input none Central(config-line)# login local Central(config-line)# exec-timeout 5 0 Central(config-line)# exit Central(config)#
VTYs and Remote Administration Privileges, 16 levels Diferents Accounts service password-encryption
! SNMP, Radius, TACACS+, NTP, PEER auth. Keys.
Remote Access
1. 2.
3. 4.
5.
No Remote: administration is performed on the console only. Remote Internal only with AAA: administration can be performed on the router from a trusted internal network only, and AAA is used for access control. Remote Internal only: administration can be performed on the router from the internal network only. Remote External with AAA: administration can be performed with both internal and external connections and uses AAA for access control. Remote External: administration can be performed with both internal and external connections.
AAA
Authentication With SSH or IPsec Authorization Command by command. All not allowed is denied. Acounting Forensic Analisys Keep the running configuration and startup
Services
[source-wildcard] [log]
access-list list-number {deny | permit} protocol
Defense
Spoofing
ACL
Defense
LandAttack
East(config)# access-list 100 deny ip host 14.1.1.20 host 14.1.1.20 log East(config)# access-list 100 permit ip any any East(config)# interface eth0/0 East(config-if)# description External interface to 14.1.0.0/16 East(config-if)# ip address 14.1.1.20 255.255.0.0 East(config-if)# ip access-group 100 in East(config-if)# exit
Smurf
East(config)# access-list 110 deny ip any host 14.2.6.255 log East(config)# access-list 110 deny ip any host 14.2.6.0 log East(config)# interface interface eth0/0 East(config-if)# ip access-group 110 in East(config-if)# exit
Defense
DDOS
! the TRINOO DDoS systems access-list 170 deny tcp any any eq 27665 log access-list 170 deny udp any any eq 31335 log access-list 170 deny udp any any eq 27444 log ! the Stacheldraht DDoS system access-list 170 deny tcp any any eq 16660 log access-list 170 deny tcp any any eq 65000 log ! the TrinityV3 system access-list 170 deny tcp any any eq 33270 log access-list 170 deny tcp any any eq 39168 log ! the Subseven DDoS system and some variants access-list 170 deny tcp any any range 6711 6712 log access-list 170 deny tcp any any eq 6776 log access-list 170 deny tcp any any eq 6669 log access-list 170 deny tcp any any eq 2222 log access-list 170 deny tcp any any eq 7000 log
token-bit-rate burst-normal-size burst-excess-size conform-action action exceed-action action north(config)# no access-list 160 north(config)# access-list 160 deny tcp any any established north(config)# access-list 160 permit tcp any any syn north(config)# interface eth0/0 north(config-if)# rate-limit input access-group 160 64000 8000 8000 conform-action transmit exceed-action drop north(config-if)# end
This was needed to support 12.3's "auto-secure" feature Exec timeout is now a maximum value for all lines (con 0, aux 0), not an exact value. This allows the rules to accommodate settings that are shorter/more restrictive without flagging an error
References
Books, RFCs, Links
References
Books
Albritton, J. Cisco IOS Essentials, McGraw-Hill, 1999. Ballew, S.M., Managing IP Networks with Cisco Routers, OReilly Associates, 1997. Chappell, L. Introduction to Cisco Router Configuration , Cisco Press, 1998. Chappell, L. (ed.) Advanced Cisco Router Configuration , Cisco Press, 1999. Perlman, R., Interconnections: Bridges and Routers, McGraw-Hill, 1992. Sacket, G., Cisco Router Handbook, McGraw-Hill, 1999. Held, G. and Hundley, K., Cisco Security Architectures, McGraw-Hill, 1999. Tannenbaum, A., Computer Networks, 2nd edition , Prentice-Hall, 1998.
Papers
Internetworking Technology Overview, Cisco Systems, 1999.http://www.cisco.com/univer cd/cc/td/doc/cisintwk/ito_doc/ OSI Layer 3, Cisco Systems Brochure, Cisco Systems, 1997.http://www.cisco.com/warp/p ublic/535/2.html TCP/IP, Cisco Product Overview, Cisco Systems, 1997.http://www.cisco.com/warp/p ublic/535/4.html
References
RFCs
Postel, J., User Datagram Protocol (UDP), RFC 768, 1980. Postel, J., Internet Protocol (IP), RFC 791, 1981. Postel, J., Transmission Control Protocol (TCP), RFC 793, 1981. Postel, J. and Braden, R., Requirements for Internet Gateways, RFC 1009, 1987. Socolofsky, T. and Kale, C., A TCP/IP Tutorial, RFC 1180, 1991. Malkin, G. and Parker T.L., Internet Users Glossary, RFC 1392, 1993. Rekhter, Y. and Li, T., An Architecture of IP Address Allocation with CIDR, RFC 1518, 1993. Fuller, V., Li, T., Varadhan K., and Yu, J., Classless Inter-Domain Routing (CIDR): an Address Assignment and Aggregation Strategy, RFC 1519, 1993.
Fin
Rafael Vida, 2004 Cisco-FIST@mixmail.com