Improving Security on Cisco Routers

Improving Security on Cisco Routers


Contents
Introduction
Password Management
enable secret
service password-encryption (and its limitations)
Controlling Interactive Access
Console Ports
General Interactive Access
Controlling TTYs
Controlling VTYs and Ensuring VTY availability
Warning Banners
Commonly Configured Management Services
SNMP
HTTP
Management and Interactive Access via the Internet (and Other Untrusted Networks)
Packet Sniffers
Other Internet Access Dangers
Logging
Saving Log Information
Recording Access List Violations
Securing IP routing
Anti-spoofing
Anti-spoofing with access lists
Anti-spoofing with RPF checks
Controlling Directed Broadcasts
Path Integrity
IP Source Routing
ICMP Redirects
Routing Protocol Filtering and Authentication
Flood Management
Transit Floods
Router Self-Protection
Switching Modes and Cisco Express Forwarding
Scheduler Configuration
Last-Resort Routing to the Null Device
Possibly Unnecessary Services
TCP and UDP "Small Services"
Finger
NTP
CDP
Staying Up To Date
Further Reading
Referred to in This Document
Archives, Links, and General Security Resources
Command List