This chapter includes the following topics:
Cisco IOS Software security and configuration
Catalyst 3550 security and configuration
Routers and Catalyst 3550 series switches are the predominant hardware components used in the CCIE Security lab exam. This chapter covers some of the basic security features that are available in Cisco IOS Software for routers and 3550 switches. The chapter is divided into two major parts:
Cisco IOS Software security
Catalyst 3550 security
The first part deals with the introduction and configuration of some of the basic router security features. The second part discusses configuration of basic security features on the 3550 switches. Although many more basic security features are available for routers and switches than those included in this chapter, here you concentrate on those features that are most likely to appear on the CCIE Security exam.
Cisco IOS Software Security
Routers are an important part of any network, and successful implementation of Cisco IOS Software security features increases router efficiency and, by association, the efficiency of the entire network. Cisco IOS Software includes a number of useful services. Unfortunately, many of them present a security concern. In this chapter, you find a short explanation of some of these services, their functionality, and how they can be misused by an attacker. Then you learn how to use the various Cisco IOS Software basic mechanisms that are designed to protect information.
Network Time Protocol Security
Network Time Protocol (NTP) is used for automatic time synchronization. Cisco networks use NTP to make timekeeping accurate and coordinated across the board. The use of NTP is highly recommended for security because having accurate time is important for intrusion and forensic analysis. NTP is typically deployed in a hierarchical fashion. All routers on the network should be made a part of the hierarchy, if possible. If an NTP hierarchy is not feasible, you should disable NTP. To prevent NTP from traversing the router altogether, apply an access list to an appropriate interface.
HTTP Server Security
To enable configuration and management of network devices remotely, Cisco IOS Software offers web-based Hypertext Transfer Protocol (HTTP) administration. Though the web-access features are quite common on Cisco routers, they facilitate not only a mechanism for monitoring and configuring but also for attacking a router. The HTTP traffic needs to be protected by securing the communication between the HTTP client and the HTTP server. Several security technologies are available for this task (HTTPS, SSL, SSH, and IPSec) which are discussed throughout this book. Of course, if web-based remote administration is not necessary, you should disable this feature.
Password Management
To control who can access the router command prompt, you can set various passwords for various access points to the router. You can configure the passwords for local console access or remote access via Telnet. This is done to prevent unauthorized changes to a router's behavior and also to protect information that can be learned by looking at the network statistics on a router. This chapter's password discussion concentrates on three types of passwords:
Enable password
Per-user passwords and privilege levels
Line passwords
Enable Password
Enable password secures the privileged EXEC mode of a router. At this level, an administrator can view and change anything on the router. That is why such access needs to be closely guarded.
Privilege Levels
Additional controls are available in Cisco IOS Software to limit administrative access with various privilege levels. You can define different privilege levels for different passwords that permit a certain subset of commands to be configured by a user. Once the password is entered, the user is able to operate at the corresponding level. Cisco IOS Software supports a total of 16 privilege levels, ranging from 0 to 15. The default levels are 1 and 15. Level 1 is basic (or nonprivileged), and 15 is the privileged EXEC mode that was discussed in the preceding section.
Line Passwords
For remote administration, you can access Cisco routers via Telnet. Telnet occurs over virtual terminal lines (vty). Most Cisco IOS Software versions have five virtual terminals—0 through 4—that support five simultaneous Telnet sessions. You should explicitly configure all the virtual terminals for security purposes. No password is configured on vty ports by default to deny all attempts to log in to a router remotely.
Access Lists
Cisco IOS Software uses access lists, also known as Access Control Lists (ACLs), as security filters to permit or deny specific traffic from entering or exiting parts of the network. Access lists are used heavily on Cisco routers for restricting access to a router's services and for filtering traffic passing through the router. The router looks at each packet and determines whether to forward or drop the packet, based on the conditions that are specified in the access lists.
Access lists can include the source and destination addresses of the traffic, the protocol type, and so on. Access lists contain a list of statements that are arranged in sequential order that establishes the matching criteria. Each packet is checked against the list in the same order that the statements are positioned. When a match is found, the router processes the packet accordingly and does not go through the remainder of the statements. Therefore, you need to call out specific conditions before the more general ones. For more on access lists, refer to Chapter 16, "Access Control Lists."
Secure Shell
Secure Shell (SSH) service is a newer Cisco IOS Software feature that is intended for use in secure remote administration. To create a secure link between a client and a server, SSH uses Rivest, Shamir, and Adelman (RSA) public key cryptography. Therefore, the communication between the administrator's host and the router is encrypted. SSH is also used to prevent various kinds of network attacks. Currently, Cisco implements only version 1 of SSH, but remember to check for future updates.
NOTE
The SSH client has been available since the Cisco IOS Software 12.1.3.T release.