Cisco Ios Suneet
- 1. CISCO IOS HARDENINGPresented By :- Shweta MehtaSuneet Malik
- 3. IntroductionCisco IOS SoftwareInternetwork Operating systemUsed on Cisco Routers and switchesPackage integrated with multitasking OSCharacteristics CLI(Command Line Interface)HardeningProcess of securing a system by reducing vulnerabilities
- 4. Three Planes of a NetworkManagement Plane
- 6. Data Plane
- 7. Each plane provide different functionality
- 9. Management Plane FortificationImplement general management plane hardening.
- 10. Use strong password and secure them strongly.
- 11. Use the login password retry lockout feature.
- 12. Monitor the memory and CPU load of network devices.
- 13. Disable unneeded services Contd..Secure interactive management sessions.Limit which IP addresses may establish management sessions to the network devices.- Access classes - Management Plane protection. - Control plane policing.Use warning banners for malicious users.Use secure protocols.
- 14. Contd..Limit access to network with infrastructure access control List iACLs.Permit connections that are required for routing protocols and network management.Explicitly deny all other IP traffic to any network device.Permit all transit traffic that crosses the network and is not destined for infrastructure devices.
- 15. Contd..Permit tcp host 192.168.1.2 host 192.168.1.1 eq 179
- 16. Permit tcp host 192.168.1.2 eq 179 host 192.168.1.1
- 17. Permit tcp host 192.168.1.3 any eq 22
- 18. Deny ip any 192.168.1.0 0.255.255.255
- 19. Use Authentication ,Authorization and accounting (AAA).
- 20. Fortify SNMP.
- 21. Utilize logging best practices.
- 22. Utilize configuration management features of CISCO IOS Software.NEXT STEP ????CONTOL PLANE
- 23. CONTROL PLANE
- 24. Control Plane FortificationImplement general control plane hardening. - Disable ICMP Redirect processing. - Disable ICMP unreachable generation. - Disable proxy ARP. - If you use NTP ,explicitly configure a trusted time source and use proper authentication.Limit CPU impact of control plane traffic - Implement iACLs - Implement receive ACLs(rACLs) - Use CoPP.
- 25. Contd..Secure BGP- Implement TTL Based security protection generalized TTL based security mechanism(GTSM),also known as BGP TTL security hack (BTCH). - Implement BGP peer authentication with message digest five (MD 5)Configure a maximum number of BGP prefixes that can be stored by a router in memory.
- 26. Filter BGP prefixes with BGP autonomous system (AS) path access list and prefix list.Contd..Secure IGPs
- 27. Use routing protocol authentication with MD5 , the passive interface command and routing filtering - Configure routing protocol to limit resource consumption.Secure first hop Redundancy protocols(FHRPs) - Gateway load balancing protocol - Hot standby router protocol(HSRB) - Virtual router redundancy protocol.
- 28. NEXT STEP ????DATA PLANE
- 29. DATA PLANE
- 30. Data Plane FortificationImplement general data plane hardening
- 31. Use IP options selective drop feature.
- 32. Disable IP source routing.
- 34. Disable or limit IP directed broadcast.Contd..Implement anti spoofing protections to prevent the many attacks that rely on source address spoofing.
- 35. Unicast reverse path forwarding(URPF).
- 36. IP source guard.
- 37. Dynamic ARP Inspection (DAI).
- 38. Port security.
- 39. Access control lists.Contd.. Prevent spoofed addresses from entering the N/W .
- 40. Prevent the origination of packets containing spoofed source addrerss.
- 41. Filter transit traffic specifically ICPM packets , IP fragments and packets containing IP options with transit ACLs (tACLs).Contd.. Filter packets containing IP options where they are not needed.
- 42. Minimize CPU intensive features such as ACL logging and IP fragmentation.
- 43. Limit the generation of ICMP unreachable and Time exceeded messages.Contd..Identify and trace attacks
- 44. Cisco IOS netFlow.
- 46. Use VLAN maps and port ACLs
- 47. Use private VLANsNEXT STEP ????QUERIES!!!
- 48. THANK YOU…
Editor's Notes
- #6: Management plane is the plane that receives and send the traffic that is used to access, configure and manage a device as well as monitor its operation and network on which it is deployed .The management plane is made up of protocols that support operational need of the network .The management plane includes interactive access to network devices using secure shell(SSH) or Telnet statistics collection using SNMP.
- #12: Control plane functions consist of protocols and processes Control Plane consist of Protocols.