Cisco securing device - Revision history

Pio2pio: /* Switching off unnecessary */

2014-02-28T12:57:25Z

Switching off unnecessary

← Older revision		Revision as of 14:57, 28 February 2014
Line 29:		Line 29:
	no ip http server		no ip http server
	no ip http secure-server		no ip http secure-server
			! The TCP and UDP small servers are enabled by default on Cisco IOS Software Version 11.2 and earlier. They are disabled by default on Cisco IOS Software Versions 11.3 and later.
	no service tcp-small-servers		no service tcp-small-servers
	no service udp-small-servers		no service udp-small-servers

2013-12-13T21:55:24Z

References

← Older revision		Revision as of 23:55, 13 December 2013
Line 316:		Line 316:
	*[http://rolande.wordpress.com/2007/04/14/best-practices-for-inbound-access-lists/ Best Practices for Inbound Cisco Access Lists] 2007		*[http://rolande.wordpress.com/2007/04/14/best-practices-for-inbound-access-lists/ Best Practices for Inbound Cisco Access Lists] 2007
	*[http://routerjockey.com/2011/09/06/best-practices-and-securing-cisco-ios/ Best Practices and Securing Cisco IOS] 2011		*[http://routerjockey.com/2011/09/06/best-practices-and-securing-cisco-ios/ Best Practices and Securing Cisco IOS] 2011
			*[http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml Cisco Guide to Harden Cisco IOS Devices] 2011, nice good list explained
	*[http://www.dslreports.com/faq/7766 How do I secure a Cisco router from the Internet?] 2009		*[http://www.dslreports.com/faq/7766 How do I secure a Cisco router from the Internet?] 2009
	*[http://www.cisco.com/web/~~about~~/security/intelligence/dns-bcp.html DNS Best Practices, Network Protections, and Attack Identification]		*[http://www.cisco.com/web/abou0t/security/intelligence/dns-bcp.html DNS Best Practices, Network Protections, and Attack Identification]
	*[https://onvox.net/tag/acl ststeful filtering]		*[https://onvox.net/tag/acl ststeful filtering]

	[[Category:cisco]]		[[Category:cisco]]

2013-12-08T09:40:59Z

How to apply

@@ Line 87: / Line 87: @@
   ip access-group 90 in
   exit
 == Apply MAC address filtering to Access Point using TFTP ==
 This method is the most secure way to apply multiple ACL lines. This method is nice because the ACL doesn't get updated until after the TFTP is complete, so it should be safe even if the change will interrupt network connectivity. Another safety measure is to schedule a reload. Please follow these steps:

2013-12-07T15:35:45Z

Example working reflective ACL allowing only ssh and inside originated traffic

← Older revision		Revision as of 17:35, 7 December 2013
Line 248:		Line 248:
	deny ip any any log		deny ip any any log
	!		!
	! Block all except ssh		! Block all except dns(udp53) and ssh(tcp22)
	!		!
	ip access-list extended INTERNET-IN		ip access-list extended INTERNET-IN
	~~evaluate REMEMBER~~		! permit udp any eq 53 any
	permit tcp any any eq 22		permit udp any eq domain any
	deny ip any any log		permit tcp any any eq 22
			evaluate REMEMBER
			deny ip any any log
	!		!
	! Apply access lists to Internet-edge intreface		! Apply access lists to Internet-edge intreface
Line 260:		Line 262:
	ip access-group INTERNET-IN in		ip access-group INTERNET-IN in
	ip access-group INTERNET-OUT out		ip access-group INTERNET-OUT out

			Just a note, not existing ACL applied to an interface have no affect on the traffic - all is allowed.

	=== CBAC ===		=== CBAC ===

2013-12-07T12:25:07Z

References

← Older revision		Revision as of 14:25, 7 December 2013
Line 298:		Line 298:
	*[http://www.dslreports.com/faq/7766 How do I secure a Cisco router from the Internet?] 2009		*[http://www.dslreports.com/faq/7766 How do I secure a Cisco router from the Internet?] 2009
	*[http://www.cisco.com/web/about/security/intelligence/dns-bcp.html DNS Best Practices, Network Protections, and Attack Identification]		*[http://www.cisco.com/web/about/security/intelligence/dns-bcp.html DNS Best Practices, Network Protections, and Attack Identification]
			*[https://onvox.net/tag/acl ststeful filtering]

	[[Category:cisco]]		[[Category:cisco]]

2013-12-07T12:24:52Z

CBAC

← Older revision		Revision as of 14:24, 7 December 2013
Line 264:		Line 264:
	CBAC - Context Based Access Control is the next generation of stateful filtering, superseding the reflective access lists. We are going to use inspection rules to remember kind of traffic (aka legacy reflective ACL)		CBAC - Context Based Access Control is the next generation of stateful filtering, superseding the reflective access lists. We are going to use inspection rules to remember kind of traffic (aka legacy reflective ACL)

	~~WIP~~..~~..18:40....~~		This feature is available only with security or data&security technology feature enabled. Please refer to Cisco Feature Toolkit.

	*[https://onvox.net/tag/acl ststeful filtering]

	= Safety cushion by scheduled reload =		= Safety cushion by scheduled reload =

2013-12-07T12:22:59Z

Reflexive ACL

← Older revision		Revision as of 14:22, 7 December 2013
Line 237:		Line 237:

	Even all incoming traffic on Dialer1 interface is denied we EVALUATE access-list REMEMBER for remembered traffic that left out network. Therefore all traffic originated form our network will be permitted.		Even all incoming traffic on Dialer1 interface is denied we EVALUATE access-list REMEMBER for remembered traffic that left out network. Therefore all traffic originated form our network will be permitted.

			=== Example working reflective ACL allowing only ssh and inside originated traffic ===
			!
			! Remember all traffic orginated from inside
			!
			ip access-list extended INTERNET-OUT
			permit tcp any any reflect REMEMBER timeout 300
			permit udp any any reflect REMEMBER timeout 300
			permit icmp any any reflect REMEMBER timeout 300
			deny ip any any log
			!
			! Block all except ssh
			!
			ip access-list extended INTERNET-IN
			evaluate REMEMBER
			permit tcp any any eq 22
			deny ip any any log
			!
			! Apply access lists to Internet-edge intreface
			!
			interface Dialer0
			ip access-group INTERNET-IN in
			ip access-group INTERNET-OUT out

	=== CBAC ===		=== CBAC ===

2013-12-06T07:11:24Z

CBAC

← Older revision		Revision as of 09:11, 6 December 2013
Line 242:		Line 242:

	WIP....18:40....		WIP....18:40....

			*[https://onvox.net/tag/acl ststeful filtering]

	= Safety cushion by scheduled reload =		= Safety cushion by scheduled reload =

2013-12-05T01:03:51Z

CBAC

← Older revision		Revision as of 03:03, 5 December 2013
Line 239:		Line 239:

	=== CBAC ===		=== CBAC ===
	CBAC - Context Based Access Control is the next generation of stateful filtering, superseding the reflective access lists.		CBAC - Context Based Access Control is the next generation of stateful filtering, superseding the reflective access lists. We are going to use inspection rules to remember kind of traffic (aka legacy reflective ACL)

	WIP....18:40....		WIP....18:40....

2013-12-04T01:50:46Z

Safety cushion by scheduled reload

@@ Line 199: / Line 199: @@
 Then you can apply ACL <tt>Only-GoogleServers</tt> in the standard manner.
 == Stateful Filtering ==
@@ Line 269: / Line 242: @@
 WIP....18:40....
 = References =