Configuring SSH

Always use SSH, telnet is gone.

Configuring SSH includes configuring a domain name (ip domain-name WORD), generate rsa key (crypto key generate rsa), specify only ssh for vty connection (transport input ssh), specify where to find username and password list (login WORD. This could be local, if you use local, you will want to create username and password in the router)

First you have to configure a domain name for your router with the command (enter this command at the global configuration level)

ip domain-name WORD

WORD: the domain name string.

Then you generate rsa key by the command

crypto key generate rsa [general-keys | usage-keys]

In the picture above, when you try to create an rsa key, there will be two parameters

1. General-keys. By default Cisco routers use the same key for all encryption (SSH, HTTPS, …)


2. Usage-keys. Usage-keys create a unique key.

Bit range of an rsa key is 360bits – 2048bits. A minimum of 1024 is usually used. For old series router (2500, 2600 series), generating an rsa key could take a long time (10 – 15 minutes).

You can configure some ssh options through the command (from the global configuration level)

ip ssh time-out NUMBER

NUMBER: in sec, 1-120 secs.

ip ssh authentication retries NUMBER

NUMBER: 0-5 retries

Password Construction

Password is one important aspect in computer security. A Password is usually used to enter user-level accounts, email accounts, web accounts, etc. With the "Remember Password" feature available in some applications, it is important to have a strong password. First there will be a list of bad password characteristics, then there will be a list of that a good password like.

Bad password characterisitcs:

• Password with less than 8 characters.


• Password that is using words that can be found in dictionaries.


• Generic word passwords, such as one of your family member's name, your friend's name, computer jargon and etc.


• Birth date, address or phone number password.


• Password with word pattern, such as qwerty, 123321, aabbcc, and etc.


• Words spelled backwards, such as drowssap.


• Password with a famous people name, your idol or something.


• Words prepended or appended with a number, such as password1, 2password.

Strong password characteristics:

• Contains number, punctuation and letter (0-9, !@#$%^&*(),./).


• Contains small and capital letters.


• Longer than 8 characters.


• Is not a word in any language or jargon.


• Not based on any private information like your birthday, family name, etc.

There are ways to form an easy to remember strong password, you can create an acronym from a phrase. Never write your password anywhere, do not talk about it with anyone. It's usually a bad idea to use the "Remember Password" feature as available in some web browsers. Saved passwords can be viewed by other people if they have access to your computer. In Firefox (Windows version), you can go to Tools > Options... > Security > Saved Passwords and click Show Passwords to see pairs of username and password saved for certain website.

For an organization, you can ask your emplyees to never use tha same password they use in internal for their public account (public email or social network account for example). Change your and your employee's password periodically, somwhere between three to six months is an acceptable interval, but this depends on your organization's policy. Monitor your employee password, you can periodically try to break their password using an available software that can be used to brute force someone password, if on of your employee password can be guessed, ask him to change his password.

URL Filtering

The internet has been a unified place to access almost any information needed. But, some internet contents are not appropriate to be seen at work, it's just at the wrong time and at the wrong place. Gambling and adult sites are examples of this. But there are some sites that fall into "gray area". Sports leagues, auction, and social networking sites can reduce employees productivity. The first step of URL Filtering is to make a policy of which sites are allowed and which are denied. The policy must also put a decision to the "gray area" site.

How URL Filtering works?

URL Filtering works by making a list of restricted sites. After it is created, all HTTP request will be checked against the list. If the URL is in the list, the request is blocked and typically the employee will be given a warning screen that he/she is trying to access a restricted site. Maintaining the list can be done manually by the network administrator (this way is called black/white list), but the job can be given to a third party server. The company may subscript for the service and the list of restricted sites is maintain in a database on a third-party filtering server.

The advantages of the black/white list are:

• It provides a basic solution if a few specific URLs need to be exempted.


• It allows the company to directly manage the URLs it considers to be out of policy.


• Existing network equipment can be leveraged.

While the advantages of using the third-parti filtering server are:

• It provides a comprehensive, scalable solution.


• Companies that specialize in appropriate web content manage the URL lists and provide updates.


• Existing network equipment can be leveraged.


• It covers millions of URLs (for the high-end services).

With Cisco, you can use subscription-based Cisco IOS content filtering. This feature is first integrated in IOS 12.2(15)T and offered through third-party companies, Websense, SmartFilter (N2H2), and also Trend Micro (since IOS 12.4(15)XZ and 12.4(20)T). To configure Cisco URL Filtering, first you have to register at one of those companies.The summary steps of configuring URL Filtering with Trend Micro are:

• Configure Class Maps for Local URL Filtering


• Configure Class Maps for Trend Micro URL Filtering


• Configure Parameter Maps for Trend Micro URL Filtering


• Configure URL Filtering Policies


• Attach a URL Filtering Policy

You can see Cisco documentation to get examples.

PIX

some PIX series 501, 515, 535, 506e
Firewall Services Module (FWSM)
PIX firewall doesn't run IOS

most PIX come with only two interface, but some could be expanded to have more interfaces. interfaces in PIX must have physical name, logilcal name and priority (security level). priority can be set to a value between 0-100. an interface from lower priority cannot send packets to interface with higher priority.

default physical name:
E0
E1
default logical name:
E0 -> outside
E1 -> inside
default priority
E0 -> 0
E1 -> 100

DMZ (demilitiarized zone) is a concept that is an area/segment in your network that is accessible through your inner network and also the internet (usually server that should be accessible from the internet reside in this area). but the DMZ couldn't access your inner network (DMZ's priority is set lower than inside interface).
DMZ priority can be set to be higher than the outside interface. to make the server in the DMZ be accessible from outside you can use NAT.

Failover, a pair of PIX can work together to give a redundancy. How this work is as much the same with HSRP. each PIX in a failover pair must have the exact same configuration. changes you make to the active PIX will be synchronized to the standby PIX. while changes to the standby PIX will not be synchronized to the active PIX. however you won't be prevented from making any changes to the standby PIX.
on a hardware PIX, there will be a failover port for connecting this device with its failover pair.

PIX also support logging. in configuring the logging process you may want to configure the destination of the log (the monitor, sys server) and the level of the logging (each level give different level of detail)

Network Address Translation

RFC 1918 defines private IP addresses. private IP addresses are a reserverd block of numbers that can be used by onyone. these addresses can be used only in private networks and are not to routed in the internet. this way, onyone can use private IP addresses for his internal needs, without worrying the same address will be used by someone else. since packets containing private ip addresses are not to be routed in public networks (internet). blocks of reserved number used for private ip addresses are:

• Class A. 10.0.0.0 - 10.255.255.255. prefix length /8
  
• Class B. 172.16.0.0 - 172.31.255.255. prefix length /12
  
• Class C. 192.168.0.0 - 192.168.255.255. prefix length /16
  

unlike private ip addresses, public ip address must be registered with a Regional Internet Registry (RIR). Organizations can lease public addresses from an ISP. those RIRs are:

• ARIN, America
  
• RIPE, Europe
  
• APNIC, Asia
  
• LACNIC, South America
  
• AfricNIC, Africa
  

in the old days, a device that needs to access the internet must be assigned with a public IP address. since there are not enough public addresses, there's no way an organization will assign each of its devices a public address. Network Address Translation provides a mechanism to enable private ip address devices to access the internet with only using one public address.

a NAT-enabled router has a pool of public IP addresses. these addresses can be used by the inside hosts when they want to communicate with a host outside the network (at the internet). the router will maintain a translation table. this table contains the inside local address, inside global address, outside global address. the router will act as a forwarder for the inside host, it will alter the source address of the packet sent to the outside network to one of the public address that it has. when the router receives a packet destined for a particular public address, it looks up at the table and find the corresponding inside local address. this allow the router to forward the packet to the correct host at the inside network.

some NAT terminologies:

• inside local address. actual address of inside host, most likely a private address.
  
• inside global address. public address given to an inside host when it wants to communicate with outside network.
  
• outside global address. public address assigned to a host in the internet.
  
• outside local addess. private address assigned to a host on the outside network. in most cases this is the same as outside global address.
  

the "inside" of a NAT is not synonymous with private addresses as defined by RFC 1918. "non-routable" means that it's not routable on the internet.


Types of NAT
Static NAT. one-to-one mapping, a particular inside host will always be given the same public address. this mapping remain constant. this is usually usefull for hosts that need a consistent public address (might be enterprise servers or networking devices).

Dynamic NAT. first-come, first-served basis mapping. when an inside host wants to communicate with outside network, it will be assigned with one of the public address from the pool that is available (not used by any other host yet).

NAT overload, also called Port Address Translation (PAT). maps multiple private addresses to a single public address or a few addresses. a PAT-enabled assigns a source port number to TCP/IP sessions opened by inside hosts. the router also ensures that every hosts use a different source port number. when reply messages come from the internet, the router will check the destination port of the messages and do a look up at the table to forward the message to the correct host at the inside network.

NAT overload assigns a next-available port if the port chosen by an inside host is already used by another host. if an inside host opens a session with outside network and choose port 1221 as it source port, NAT router will try not to alter the source port of inside local address, however if 1221 is already used by another host, NAT router will use the next available port (in this case 1222, if not used yet) for the inside global address of this session. it will choose a port number starting from appropriate port group 0-511, 512-1023, 1024-65535. if every ports has been used and there's more than one public ip addess, NAT router will use the next public address.


Configuring Static NAT
static NAT allows connections initiated by external devices to inside hosts. for example you may want to map an inside global address to your web server inside local address. the steps for configuring static NAT are:

• step 1. establish a static translation between an inside local address and an inside global address.
  

ip nat inside source static local-ip global-ip

local-ip: inside local address of a specific device
global-ip: public address available for the local device

• step 2. specify the inside interface.
  

interface type number

ip nat inside

type: the type of the interface [FastEthernet | Serial]
number: interface number

• step 3. specify the outside interface
  

interface type number

ip nat outside

type: the type of the interface [FastEthernet | Serial]
number: interface number

Configuring Dynamic NAT
dynamic NAT translates private addresses to public addresses from a pool. the steps are:

• step 1. Define a pool of global addresses to be allocated as needed.
  

ip nat pool name start-ip end-ip {netmask netmask-number|prefix-length pref-length}

name: word. name of the pool
start-ip: lowest public address to be available in the pool
end-ip: highest public addess to be available in the pool
netmask-number: subnet mask of the public addresses
pref-length: prefix length of the public addresses

• step 2. create a standard access-list permitting the addresses to be translated.
  

access-list acl-number permit source [ source-wildcard ]

acl-number: a number that identifies the the standard acl
source: private address/network to be permitted
source-wildcard: wildcard of the source permitted (see ACL)

• step 3. establish dynamic translation between private addresses and public addresses
  

ip nat inside source list acl-number pool name

acl-number: the number of ACL which permits private addresses to be translated
name: name of the pool that contains public addresses

• step 4. specify the inside interface.
  

interface type number

ip nat inside

type: the type of the interface [FastEthernet | Serial]
number: interface number

• step 5. specify the outside interface
  

interface type number

ip nat outside

type: the type of the interface [FastEthernet | Serial]
number: interface number

Configuring NAT overload
there are two ways to configure overloaded NAT. it depends on how many public address is given by the ISP. if only one address is given, the steps are:

• step 1. create a standard access-list permitting the addresses to be translated.
  

access-list acl-number permit source [ source-wildcard ]

acl-number: a number that identifies the the standard acl
source: private address/network to be permitted
source-wildcard: wildcard of the source permitted (see ACL)

• -step 2. establish overload translation.
  

ip nat inside source list acl-number interface interface-type/number overload

acl-number: the number of ACL which permits private addresses to be translated
interface-type/number: specify the interface that is assigned the public address (typically, address given by the ISP)

the "overload" keywords enables the addition of the source port number to the translation.

• step 3. specify the inside interface.
  

interface type number
ip nat inside

type: the type of the interface [FastEthernet | Serial]
number: interface number

• step 4. specify the outside interface
  

interface type number
ip nat outside

type: the type of the interface [FastEthernet | Serial]
number: interface number

to configure overloaded NAT with more than one public ip address:

• step 1. create a standard access-list permitting the addresses to be translated.
  

access-list acl-number permit source [ source-wildcard ]

acl-number: a number that identifies the standard acl
source: private address/network to be permitted
source-wildcard: wildcard of the source permitted (see ACL)

• step 2. Specify the global addresses as a pool.
  

ip nat pool name start-ip end-ip {netmask netmask-number|prefix-length pref-length}

name: word. name of the pool
start-ip: lowest public address to be available in the pool
end-ip: highest public addess to be available in the pool
netmask-number: subnet mask of the public addresses
pref-length: prefix length of the public addresses

• step 3. establish overload translation
  

ip nat inside source list acl-number pool name overload

acl-number: the number of ACL which permits private addresses to be translated
name: name of the pool that contains public addresses

• step 4. specify the inside interface.
  

interface type number
ip nat inside

type: the type of the interface [FastEthernet | Serial]
number: interface number

• step 5. specify the outside interface
  

interface type number
ip nat outside

type: the type of the interface [FastEthernet | Serial]
number: interface number

by default translation will time out after 24 hours, you can change the timers with the command "ip nat translation timeout timeout-seconds".

you can see the NAT you've configured using the command "show run". to verify NAT operations use the command "show ip nat translations [verbose]". the command "show ip nat statistics" displays information about total number of active translations, NAT configuration parameters, total addresses in the pool, and allocated addresses from the pool.

you can debug NAT operations using the command "debug ip nat".


Port Forwarding
port forwarding enables external users (from outside network) to initiate a connection to inside hosts. Port Forwarding does this by translating received messages destined to a specified port, to a particular host and destination port number at inside network.

for example, you have a web server in you inside network of which ip address is 192.168.1.252, if you want to enable external users to access your web server you can configure port forwarding HTTP traffic from your border router to the web server. you can specify traffic received at the WAN interface destined to port 80 (HTTP works at port 80), to be forwarded to inside interface with destination address 192.168.1.252 and destination port is 80. in this case, the external port and the internal port are the same. you can change the external port and the internal port to something else. if you change the external port, the external users must know the specific port number you use.

VPN

Tunneling enable users to access private networks from public networks. tunneling encapsulates an entire packet within another packet and sends the new composite packet over a network. three classes of tunneling protocol:

• Carrier protocol. the protocol over which the information is travelling (Frame-relay, ATM, MPLS)
  
• Encapsulating protocol. the protocol that wraps around the original data (GRE, L2F, L2TP)
  
• Passenger protocol. the protocol over which the original data was sent over (IPv4, AppleTalk, IPv6, IPX)
  

Tunneling works as the original data is wrapped by the encapsulating protocol, then as leaving the VPN gateway ("tunnel interfaces"), the data will be encapsulated by the carrier protocol with the source and destination adress are the "tunnel interface"s address, when the data arrived at the other end of the VPN gateway, the original data will be extracted and sent over the destination.

for the message to be private, it must be encrypted. VPN encryption rules include an algorithm and a key. the message will be encrypted using the combination of the algorithm and the key. the result is a cipher text, that's very difficult if not impossible to be decrypted without the correct key. there are two kinds of encryption algorithm, symmetric algorithm which uses the same key for the encryption and decryption process, and asymmetric algorithm that uses different keys for the encryption and decryption process. some common used encryption algorithm are:

• Data Encryption Standard (DES). a symmetric key encryption. developed by IBM, uses 56-bit key giving high-performance encryption.
  
• Triple DES (3DES). developed from DES. a symmetric key cryptosystem. it encrypts a message with one key, decrypts it with another key and finally encrypts it with another different key. this provides more strength than DES.
  
• Advanced Encryption Standard (AES). developed by the National Institute of Standards and Technology. replacing DES. it offers more strength than DES and more efficient than 3DES. it offers using three different key-lengths: 128, 192 and 256 bit keys.
  
• Rivest, Shamir, and Adleman (RSA). named as its founders. this is an asymmetric cryptosystem. it uses a key bit length of 512, 768, 1024 or larger.
  

a Hash is a string generated from a text. it's generated using algorithms that there will be no two different texts that will produce the same hash value. the hash is smaller than the text. it can be used to guarantee that a message hasn't been modified. the sender can generate a hash of the message and send it along with the message to the receiver. the receiver then receive the message and will generate a hash value from the message again. the result then will be matched with the hash value sent by the sender. if both hashes are the same, then the message hasn't been changed/modified.

a keyed hashed message authentication code (HMAC) is a data integrity algorithm that guarantees the integrity of the message. a HMAC has two parameters: a message input and a secret key known only to the sender and the receiver of the message. two commons HMAC algorithm are:

• Message Digest 5 (MD5), uses 128-bit shared key. the 128-bit key is combined through the message and produces a 128-bit hash. the hash is appended with the message and sent to the destination.
  
• Secure Hash Algorithm 1 (SHA-1), uses 160-bit shared key. the 160-bit key is combined through the message and produces a 160-bit hash. the hash is appended with the message and sent to the destination.
  

both ends on VPNs connectin must be authenticated. so that a secure connection and communication can be made. two peer authentication in VPNs are:

• Pre-Shared Key (PSK), a secret key shared between the two parties. a PSK is entered manually at each party and is used to authenticate the peer. it uses symmetric key cryptosystem. the key shared is combined with other information to form the authentication key.
  
• RSA signature, exchange digital certificates to authenticate the peers. local device (local end) derives a hash and encrypts it with its private key. the encrypted hash (digital signature) is sent along with the message. the remote end will decrypt the hash using the public key of the local end. if the decrypted hash matched the recomputed hash, the signature is genuine.
  

Internet is a public network and it reaches almost everwhere in the world. the fact that internet is a worldwide network, makes internet an option for oranizations and corporations to connect their teleworkers with the organization's private network. but the fact that it is a public network, makes it fragile to security risks. with VPN technology, organizations can create a private network from the internet and can safely transfer their private data over the internet from branches and remote teleworkers. instead of using a dedicated layer 2 connection, such as a leased line, a VPN uses virtual connections that are routed over the internet.

the benefits of using VPN are:

• cost saving. unlike a leased line which requires an expensive cost to establish a connection between sites. VPN uses the public network Internet, which is cheaper.
  
• security. VPN encrypts and authenticates its data. protecting the data from unauthorized access.
  
• scalability. anyone, anywhere within an ISP area can connect to the VPN. organizations can add new users, big or small organizations without adding significant infrastructure.
  

Types of VPN:

• site-to-site VPN. a site-to-site VPN is used to connect between company intranets or a company intranet with a business partner extranet. for example it can connect a branch with the headquarter office. a site-to-site VPN uses a VPN gateway at each site to send and receive TCP/IP traffic. a VPN gateway in a site-to-site VPN could be a router, PIX firewall appliance or an Adaptive Security Appliance (ASA). the VPN gateway is responsible for encrypting outgoing traffic and decrypting incoming traffic.
  
• remote access VPN. remote access VPNs are used to connect mobile users and teleworkers as well as extranet consumer-to-business. since most teleworkers have access to the internet, they can establish a remot VPN connection to the company. each host typically has a VPN client software. this software will encrypts/decrypts incoming/outgoing traffic. at the company site, a VPN gateway which could be a PIX firewall, a router, an ASA or a VPN concentrator will do the encrypts and decrypts tasks.
  

a VPN creates a virtually private network which must maintain confidentiality and security. it must protect data against sniffing activity, sender authentication and message integrity.
typically a VPN would require the following components:

• a network with servers and workstations.
  
• an access to the internet.
  
• VPN gateway capable devices, such as routers, firewalls, VPN concentrators and ASAs. at the endpoints that establish and manage VPN connections.
  
• appropriate software to create and manage VPN tunnels.
  

Most VPN can do both

• Encapsulation. also called as tunneling, this enables data to be transferred between private networks over a shared public network.
  
• Encryption. codes data to another format using a secret key. decryption decodes the encrypted data to its original format.
  

Keypoints of security in VPNs are:

• data confidentiality. guarantees that data are not stolen as they travel across a shared networks. VPNs achieve this using encapsulation and encryption.
  
• data integrity. guarantees that the data received by the receiver are the same as the data sent by the sender. this means that data are not modified. VPNs usually use hashes to ensure data integrity. a hash is like a seal that guarantees that no one has read the content of the message.
  
• authentication. this guarantees that only authorized users may participate in the private network. unauthorized users must not be given access to the private network. VPNs achieve this by using passwords, digital certificates or other authenticate mechanisms.
  

IPsec is a protocol suite for securing communications in IP networks. there are two frameworks for IPsec:

• Authentication Header (AH), provides authentication and integrity. use this when confidentiality (ecnryption) is not needed or permitted. this makes AH weaker, that's why AH is often used along with ESP.
  
• Encapsulation Security Payload (ESP), provides authentication, integrity and confidentiality (encryption). although encryption and and authentication are optional, at a minimum, one of them must be selected.
  

we can choose and implement standards for encrytion, authentication and key exchange

IPsec Framework Choices

IPsec Protocol - ESP, AH, ESP + AH
Encryption - DES, 3DES, AES
Authentication - MD5, SHA
DH - DH1, DH2, DH5

DH allows two parties to establish a shared secret key used for the encryption and hash algorithm.

Configuring SSH on a Router

How to enable SSH on a router
1. set router hostname

hostname R2

2. set a domain name
enter the following command at the global level to set the domain name to cisco.com

ip domain-name cisco.com

3. generate asymmetric keys
to generate a key that the router uses to encrypt its SSH management traffic, enter the command "crypto key generate rsa". you'll be asked to enter the size of the key modulus in range of 360 - 2048. for best practice, cisco recommends a minimum length of 1024. longer means more security. AFTER YOU GENERATE THE KEY, YOU WILL NOTICE THAT SSH HAS BEEN ENABLED.

4. configure local authentication and vty
to simplify the example, we will use local username (you can use third party authentication server such as TACACS+ or RADIUS) first you must create a local user. to create a username student with the encrypted password cisco, enter the command "username student secret cisco" at the global configuration level.  next enter the vty line configuration "line vty 0 4", enable login to look for local "login local", set the transport to ssh "transport input ssh".

5. configure SSH timeouts (optional)
this provides additional security. enter both command at global configuration level

ip ssh time-out 15

ip ssh authentication-retries 2

to connect to the router using SSH then you must connect to it with a SSH client (PuTTY, TeraTerm). you'll be prompted for username and password, enter the password and username you've configured. in the above example you enter the local created username (student with password cisco).

Securing Cisco Routers

Routers role in security

• advertise networks and filter who can use them
  
• provide access to network segment and subnetworks
  

Routers can be attacked in these puposes:

• compromising the access control can expose network configuration details, facilitating attacks against other network components.
  
• compromising the route tables can reduce performance, deny network communication services and expose sensitive data.
  
• misconfiguring a router traffic filter can expose internal network components to scans and attacks, making it easier for attackers to avoid detection.
  

Securing routers at the network perimeter is an important first step in securing a network.
some concerns securing a router:

• physical security
  
• update router IOS whenever possible
  
• backup router configuration and IOS
  
• harden the router to eliminate the potential abuse of unused ports and services
  

some steps securing a router
1. manage router security
use strong password, to avoid the expose of passwords use "enable secret" instead of "enable password". secret means the password is encrypted using md5 (type 5). while entering the global command "service password-encryption" will encrypt passwords with simple algorithm, which cisco called type 7. cisco recommends type 5 than type 7.

2. secure remote administrative access to routers
remote access to routers is preffered when there are so many routers and switches. security should be controlled for VTY, TTY (asynchronous access through modem) and AUX lines. ensure that connections through those lines require password.
You can PREVENT CONNECTION to any line by entering the command "login" and "no password".
VTY line can be configured to receive just connections that are using the specified protocol. use the command "transport input". for example to allow VTY connection using SSH only enter the command "transport input ssh".
cisco IOS device has a limit number of VTY lines, usually 5. this can be DoS attacked. to avoid this, you can configure one of the VTY line to be set just accept connection from a single, specific administrative workstation. this is achieved by using ACL and "ip access-class" command at the line configuration. other way is to set VTY timeouts using the "exec-timeout" command. this will close idle connections passed the time configured.
Other concern is to encrypt traffic of the remote connections. to achieve this use SSH instead of telnet. not all cisco images support SSH. cisco routers can act as a SSH client and server, by default both mode are enabled when SSH is enabled.

3. logging router activity
logging can give you records of what has happened to a router. a log can be saved to the router memory or to a log host. a log host is preferable because it provides a central place for logging. logging can be one of eight levels, with level 7 means the system is unstable and will include all router information. logs should be reviewed regularly, this will give you the sense of your usual network activity. you may also want to use the NTP to get the time of the events, this makes troubleshooting easier.

4. sercure vulnerable router services and interfaces
Cisco routers support some network services. these services sometimes are good for nothing. General security practice for routers is to configure the router to only support needed traffic and services. You can entirely disabled a service on a router or restricting its access. if a particular portion of a network segment needs a service but the rest doesn\ not, the restriction features should be employed to limit the scope of the service. Some services that is recommended to be disabled are:

• TCP small servers
  
• UDP small servers
  
• CDP (if there are some IP phone, consideration should be taken before turning off this service)
  
• Finger
  
• HTTP server
  
• Proxy ARP
  
• IP Mask reply, etc..

commands needed to turn off a service usually started with the "no" command followed by the service name, for example:

no service tcp-small servers

no ip http server

no cdp run

some services that should be secured if needed are:

• SNMP, use versions 3. version 1 and 2 pass managemenet information and password in clear text
  
• NTP, to reject NTP message at a particular interface, use an access-list
  
• DNS, name queries are sent to broadcast address, fake name server could reply to a query. Explicitly specify the name server addresses using the command

ip name-server addresses

5. secure routing protocols
Routers are also at risk from attacks. Anyone with a packet sniffer can read information propagating between routers. Two kinds of attack in general:

• Disruption of peers
  
• Falsification of routing information
  

disruption of peers is less critical, because routing protocol can heal themselves, getting backup route. Falsification of routing information is done by giving false routing update to a router. this can be protected by authenticating routing protocol information. Authentication through MD5 consists of 3 key elements, the key (similar to a password), the data and the signature (result of the combination of the key and the data through MD5 algorythm). RIPv2, EIGRP, OSPF, IS-IS and BGP support various forms of MD5 authentication.

securing RIPv2 routing protocol
step 1. Prevent RIP routing update propagation. First set ALL INTERFACES in a router into passive mode. Then bring up only those interfaces that are required for sending and receiving RIP updates. Passive interface receives updates but does not send them.

passive-interface default

that command entered at the global level configuration will disable routing advertisements on all interfaces. to bring up a particular interface enter the command enter the command

no passive-interface serial0/0/0

that command will bring up interface serial0/0/0 to send routing updates.

step 2. Prevent Unauthorized Reception of RIP Updates. This can be done by setting up MD5 authentication to routing updates. To enable the encryption, first you must create a key for the md5 and then apply each interface participating in routing updates to send encrypted updates. The commands to create MD5 key are:

key chain RIP_KEY

key 1

key-string cisco

"key chain RIP_KEY", will create a key named RIP_KEY. we can create multiple key, but in the example "key 1" is used to create the key 1, "key-string cisco" tells that key 1 is contain a key string "cisco".

the commands to implement MD5 authentication on an interface are (entered at interface level configuration):

ip rip authentication mode md5

ip rip authentication key_chain RIP_KEY

the command "ip rip authentication mode md5" tells that rip will use md5 authentication while "ip rip authentication key_chain RIP_KEY" tells to use the RIP_KEY that has been created.
ONCE THIS AUTHENTICATION IS CONFIGURED ON A ROUTER THE REST PARTICIPATING ROUTERS MUST BE CONFIGURED WITH THE SAME CONFIGURATION AND KEY.

step 3. Verify the Operation of RIP Routing. this is done to check wether routing updates are propagated properly. This can be done with the "show ip route" command.


securing EIGRP routing protocol. the steps are similar to RIP steps (create key chain, apply authentication mode to interfaces). the difference is on the applying the authentication mode to an interface. the commands to configure md5 authentication in eigrp process 1 are:

key chain EIGRP_KEY

key 1

key-string cisco

interface s0/0/0

ip authentication mode eigrp 1 md5

ip authentication key-chaing eigrp 1 EIGRP_KEY

securing OSPF routing protocol. The logic of the steps is still the same with RIP and EIGRP. But the commands are different. the commands to configure md5 authentication on ospf process 10 area 0 are:

interface s0/0/0

ip ospf message-digest-key 1 md5 cisco

ip ospf authentication message-digest

router ospf 10

area 0 authentication message-digest

6. control and filter network traffic



Cisco provides an auto secure to enable you to use a single command to disable processes and services not needed. you can enter the command "auto secure" at privileged EXEC mode. this command has two modes, interactive mode and non-interactive mode. with interactive mode you'll be asked several question to enable or disable services and other security feature. Non-interactive mode will auto configure the router with the recommended Cisco default settings. default mode is interactive mode.

Network Security

Three types of vulnerability

• Technology vulnerability. vulnerability at the design of the technology (HTTP, FTP, ICMP vulnerability)
  
• Configuration vulnerability. easy guessed password, misconfiguration, lack of security default setting
  
• Policy vulnerability. lack of written policy, bad logical access control
  

Types of network attacks

• Reconnaissance. information gathering. precedes another type of attack.Internet Queries (nslookup, whois), ping sweeps (fscan, gscan), port scans (nmap, superscan), packet sniffers (wireshark)
  
• Access, getting access. usually involve running a hack, script, tool that exploits vulnerability. Password attacks, brute forcing (cain, l0phtcrack) Trust exploitation, compromise another system by a mean to compromise other system.Port redirection, a type of trust exploitation. using a software to alter traffic to access another system through a system that has been compromised (netcat) Man-in-the-middle,
  
• Denial of service. corrupt system, service with the purpose of crashing the system to deny user request. Syn-flood. TCP threeway handshake, attacker floods a server with syn TCP message, the server replies with a SYN-ACK message for each SYN message. the server will provides resources for each request. while the attacker never finish the threeway handshake mechanism, running out the resources of the server DDoS (SMURF, MyDoom, Trible flood network)
  
• Malicious scripts/softwares. worms, viruses, trojan horses.  damaging hosts / corrupting a system and replicate itself.
  

*****************
Physical security
*****************

• Hardware. lock access to physical equipment, disallow unauthorized access.
  
• Environment. temperature control, humidity
  
• Electrical. install UPS and generator in condition of power loss. avoid voltage spikes
  
• Maintenance. neat cabling and labeling.
  

Security should be the main concern whenever designing a network. a firewall alone is not enough. an integrated approach involving firewall, intrusion prevention and VPN.
the PIX has evolved to what is called Cisco Adaptive Security Appliance (ASA). Cisco ASA integrates firewall, void security, SSL and IPsec VPN, IPS and content security services.


**********************
Network Security Wheel
**********************
Step 1.  Secure
Create the security policy. some concerns:

• threat defense
  
• stateful inspection and packet filtering
  
• intrusion prevention system
  
• vulnerability patching
  
• disable unnecessary services
  
• VPN
  
• truns and identity, systems on the outside of the firewall should never be absolutely trusted by systems on the inside of a firewall.
  
• autehtication
  
• policy enforcement, ensure that users and end devices are in compliance with the corporate policy.
  

step 2. Monitor
active monitor by auditing log files even to the host level (some OS includes auditing functionality). passive monitor by using IDS devices, this requires less attention from network administrator.

step 3. Test
actively test the network. try to penetrate the network, using some tools (Nessus, Nmap).

step 4.  Improve
analyze the data colected during the monitoring and testing phases. and augment necessary improvement.

to keep the network as secure as possible, the cycle of the security wheel must be continually repeated.

AAA

AAA stands for Authentication (verifying user's identity), Authorization (limiting access to certain feature) and Auditing (recording actions taken by a user).

normal authentication examples enable secret, enabling password for line connection (console, vty)

normal authentication (non-AAA) is usually used in small environment or as backup to AAA

creating user locally in a device with the command username. if you want to add a user name joe with password cisco, the command would be like this

username joe password cisco

each user can be assigned different privilege level (1-15). higher number means more privilege.

AAA uses an external server to store user name and password

RADIUS and TACACS+ are two protocols used for authentication and authorization. both are widely used. cisco generally recommends TACACS+ over RADIUS as it's cisco proprietary. RADIUS couldn't limit the commands a user can execute


to configure RADIUS / TACACS+ authentication. first enter this command

aaa new-model

then specify the host located
example for tacacs server:

tacacs-server host 192.168.1.10 key password

example for radius server:

radius-server host 10.100.200.200 key password

radius-server host 10.100.200.201 key password

you can specify more than one server. they will be queried depends on the order (if the server is unavailable, the next server will be queried). key is the password for connecting to the server itself, if required.

then create method-lists as needed. method-list will specify how AAA should treat users. should it challenge users for password and where to look for the password. there are some method i don't cover here (local, tacacs+, radius, krb5, line, none). AAA can authenticate not only login but also ppp, ARAP, etc.. Here an example of method list:

aaa authentication login My-Method group tacacs+ local

My-Method is the name of the method list.

here there are two metods tacacs+ and local. should the tacacs+ guery failed (incorrect password is not concerned as a failure) the local password list will be used.
then apply the method list to interface / line as needed. here an example

line vty 0 4

login authentication My-Login

here, i'm applying the GAD-Login method list created earlier to VTY lines 0-4. this
will have the effect challenging telnet sessions to the router with whatever authentication methods exist in the GAD-Login method list.

*be carefull when configuring AAA for the first time. You can easily lock yourself out of the router by enabling AAA authentication without configuring any users.