Router security

Seite 1

1) Management plane:

a) SSH:

hostname R1

ip domain-name 1ExamAMonth.com

!

crypto key generate rsa modulus 2014

!

username kevin privilege 15 secret cisco

!

access-list 1 permit 10.1.1.0 0.0.0.255

access-list 1 deny any log

!

line vty 0 15

access-class 1 in

login local

transport input ssh

!

2) Control plane

a) Unicast reverse path forwarding

-The way that uRPF works is to check the source IP address of a packet arriving on an interface and

determine whether that IP address is reachable, based on the router’s Forwarding Information Base

(FIB) used by Cisco Express Forwarding (CEF)

- CEF must be enabled on a router to use uRPF.

-

3 modes:

a) strict mode: ">

With strict mode operation, a router not only checks to make sure that the source

IP address of an arriving packet is reachable, based on the router’s FIB, but the packet must

also be arriving on the same interface the router would use to send traffic back to that IP

address.

b) Loose mode: ">

With loose mode operation, a router only verifies that the source IP address of a

packet is reachable, based on the router’s FIB.

c) vrf mode:

configuration:

By default, a router with uRPF configured would drop a packet whose source IP address was only

reachable by a default route; however, uRPF supports an allow-default option that accepts a default

route as a valid way to get back to a source IP address.

#ip verify unicast source reachable-via {rx | any} [allow-default] [allow-selfping] [

# show cef interface to check if uRPF is enabled or not.