How To Protect Your Cisco Device (Router, Switch)

Network security is a completely changing area; new devices like IDS (Intrusion Detection systems), IPS (Intrusion Prevention systems), and Honeypots are modifying the way people think about security. Companies are spending thousands of dollars on new security devices, but forgetting the basic, the first line of defense: the border router.
Although a lot of people may think that routers don’t need to be protect, they are completely wrong. A lot of secure problems appear all time against this kind of device and most of them are vulnerable.

Some information about some common security problems found on Cisco Routers, can be read on the text “Exploiting Cisco Routers”, available at: http://www.securityfocus.com/infocus/1734

In this article, I will give you 8 steps, easy to follow, to minimize your Cisco router exposure by turning off some unused services, applying some access control and applying some security options available on that.

1. Control Access to device
2. Restrict telnet access to it
3. Block Spoof/Malicious packets
4. Restrict SNMP
5. Encrypt all passwords
6. Disable all unused services
7. Add some security options
8. Log everything

Control Access to your device

The first thing to do is apply some rules to restrict all external access to some ports of the router. You can block all ports, but it is not always necessary. These commands bellow will protect your router against some reconnaissance attacks and, obviously, will restrict access to these ports:

Where $yourDeviceIP is your device IP and x0/0 is your external interface. We will always use this convention in this article.

Restrict telnet access to it

Telnet is not a very safe protocol to use, but if you really need to use it (you should always use ssh) you might want to restrict all access to it (remember that all your traffic will be unencrypted). The best way to accomplish that is using a standard access-list and the access-class command.

Where 192.168.1.1 is the IP address allowed to telnet the device

Block Spoof/Malicious packets

You must never allow loopback/reserved IP address from the Internet reach your external interface and you can reject broadcast and multicast addresses too.

 

Restrict SNMP

SNMP must always be restrict, unless you want some malicious person getting a lot of
information from your network.

and if you are not going to use SNMP at all, disable it:

Encrypt all passwords

A very important thing to do is protect all your passwords using the powerful algorithm
as possible. The password from exec mode, that grants privileged access to the IOS system, can be set using a MD5 hash, which is the strongest option available on the Cisco IOS.

All other passwords, you can encrypt using the Vigenere cipher that is not very strong, but can help. To do that, you can use the service password-encryption command that encrypts all passwords present in you system.

Disable all unused services

• Disable Echo, Chargen and discard
  • no service udp-small-servers
  • no service tcp-small-servers
• Disable finger
  • no service finger
• Disable the httpd interface
  • no ip http server
• Disable ntp (if you are not using it)
  • ntp disable

Add some security options

• Disable source routing
  • no ip source-route
• Disable Proxy Arp
  • no ip proxy-arp
• Disable ICMP redirects
  • interface s0/0 (your external interface)
  • no ip redirects
• Disable Multicast route Caching
  • interface s0/0 (your external interface)
  • no ip mroute-cache
• Disable CDP
  • no cdp run
• Disable direct broadcast (protect against Smurf attacks)
  • no ip directed-broadcast

Log everything

You must log everything on an outside Log Server so that you will be able to see everything from all your systems and always analyze the logs.

where 192.168.1.10 is the ip of your log server (configured as a Syslog server)

Conclusion

With these simple steps you can add a lot of security to your router, protecting it against a lot of possible attacks, increasing your network security. Only as an example, you can see the nmap result before and after applying these options:

Before:

After:

Now you have more secure Cisco device located in your infrastructure. I hope this article will be beneficial for you. Thank you for reading this article.

Referenced: Daniel B. Cid