Enter text here

Enter text here

1. Securing Device Access

   • Edge Router Security Approaches
     • Single Router Approach
       • home office (SOHO)
     • Defense-in-Depth Approach
       • multiple layers of security
         • the edge router
         • the firewall
         • internal router
     • DMZ Approach
       • intermediate area, often called the demilitarized zone (DMZ)
     • Three Areas of Router Security
       • Physical Security
         • Place the router and physical devices that connect to it in a secure locked room
         • uninterruptible power supply (UPS) diesel backup power generator
       • Operating System Security
         • Configure the router with the maximum amount of memory possible
         • Use the latest, stable version of the operating system
         • Keep a secure copy of router operating system
       • Router Hardening
         • Secure administrative contro
         • Disable unused ports and interfaces
         • Disable unnecessary services.
   • main taks
     • Restrict device accessibility
     • Log and account for all access
     • Authenticate access
     • Authorize actions
     • Present legal notification
     • Ensure the confidentiality of data
   • Local access
     • Strong Passwords
     • Securing Line Access
   • remote acces
     • Encrypt all traffic
     • Establish a dedicated management network
     • Configure a packet filter
     • Configure and establish a VPN

2. Configuring Privilege Levels

   • Cisco IOS
     • User EXEC mode (privilege level 1)
     • Privileged EXEC mode (privilege level 15)
   • Limitations of Privilege Levels
     • No access control to specific interfaces, ports, logical interfaces, and slots on a router.
     • Commands available at lower privilege levels are always executable at higher levels.
     • Commands specifically set at a higher privilege level are not available for lower privileged users
     • Assigning a command with multiple keywords allows access to all commands that use those keywords.
   • types
     • Role-Based CLI Access
       • Security
       • Availability
       • Operational Efficiency
     • Role-Based Views
       • Root View
       • CLI View
       • Superview

3. Monitoring and Managing Devices

   • Cisco IOS Resilient Configuration Feature
     • Secure Copy
     • Recovering a Router Password
   • Type of Management Access
     • In-band
       • Information flows across an enterprise production network,
     • Out-of-band (OOB) -
       • Information flows on a dedicated management network on which no production traffic resides.
   • Syslog Systems
     • Syslog servers
     • Syslog clients
   • SNMP
     • SNMP manager
     • SNMP agents
     • Management Information Base
   • Network Time Protocol
     • ntp authenticate
     • ntp authentication-key
     • ntp trusted-key

4. Using Automated Security Features

   • Cisco routers are initially deployed with many services that are enabled by defaul
   • Cisco AutoSecure
     • include
       • Secure BOOTP, CDP, FTP, TFTP, PAD, UDP, and TCP small servers, MOP, ICMP (redirects, mask-replies), IP source routing, Finger, password encryption, TCP keepalives, gratuitous ARP, proxy ARP, and directed broadcast Legal notification using a banner Secure password and login functions Secure NTP Secure SSH access TCP intercept services
   • Routing Protocol Spoofing
     • improve
       • Redirecting traffic to create routing loops
       • Redirecting traffic so it can be monitored on an insecure link
       • Redirecting traffic to discard it

5. Network Device Operations

   • Data plane packets
   • Control plane packets
   • Management plane packet
   • CoPP Operation
     • allow administrators to manage the flow of traffic that is “punted” to the route processor