Slashdot Mirror
8 Steps To Protect Your Cisco Router
Daniel B. Cid writes "I wrote the article '8 steps to Protect your Cisco router' (PDF). This small text gives to the reader eight steps (very easy to understand) showing how minimize your Cisco router exposure, by turning off some unused services, applying some access control lists and applying some security options available on that."
This is such a retarded article. How did this make Slashdot? On a related note, check out my article, 1 step to securing Windows 2000. Block all ports.
Is this like "2 Step To Protect Your Windows Computer."
1. Turn it off.
2. Lock the room door.
SCO (noun.)- A Slimy Corporate Ogre. Often seeks free money.
This is a shameful excuse for a security document. It may be applicable to small offices with a single router, etc. but to post it here as a be all, end all Cisco security document makes me shudder.
Step 1 to securing a Cisco device or any host for that matter is making sure you're running an OS with no blatant security vulnerabilities.
Okay, that's enough about that.
"A clear conscience is usually the sign of a bad memory."
1) Don't rest your coffee on the router
2) Keep the cords and wires out of heavy traffic areas
3) Do not fold, spindle, or mutilate
4) Keep out of reach of children
5) Be kind, rewind
6) Do not remove tag under penalty of law
7) No step
8) Lavese las manos, es la ley
1.) Shut down the router ...
2.) Disconnect the power
3.) Remove all network cables
4.) Remove router from rack, replacing it with a cheap Linux box with some high-end network cards, a hardened kernel and a good iptables script.
5.) Return your Cisco router to original styrofoam packaging. Lock it away somewhere safe.
6.) Your Cisco router is now protected
7.)
8.) Profit!!
Damn straight. I had a Cisco PIX 506E and the thing was rediculously overpriced for what it offered. The manuals that accompany the device were nothing more than IOS command guides (the product guide on CD only vaguely helpful).
I became a much happier person when I moved to a linux machine with a nice shorewall iptables script.
There is one thing I have to say about the cisco 506E, it had a form factor that beats the hell out of a plain pc. I would have loved to run linux on it. It was very small/quiet/light/unobtrusive.
A small disclaimer: I know that with tons of Cisco training you can become a master of these Cisco PIX devices. However I will never forgive cisco for charging for 3DES encryption "upgrades".
A netgear FVS318 VPN firewall has twice the features as this unit for $150, although dont expect huge throughput when using 3DES or AES for vpn tunnels, for that app a 400mhz or greater linux firewall would probably do the trick. They also had buggy firmware in the past, but they seem to be working well with the 1.4 firmware. They have dyndns integration, 8 vpn tunnels, really awesome web based configuration, and a nice professional looking casing. Hooking two of these units together for a vpn is a snap.
The Ro Factor - Jeep/Linux Weblog
you must be an idiot that works in some cheesy place . you know that right?
e cu re/pix.shtml
by the way, idiot, the 3DES shit is FUCKING FREE,
and i quoth CCO:
http://www.cisco.com/kobayashi/sw-center/ciscos
"*FREE* Register for PIX 56-bit IPSEC Software Feature Key
*Free* Register for a 3DES/AES IPSec Software Feature Key "
does the STARS in front of and behind the FREE make something unclear?
you gave up on the PIX config because you suck i've gotten those things to do quite a bit more than lin-sux can do.
oh yeah, where is the option in linux to setup failover and shit like that?
Not exactly free, given possible requirements of a support contract login along with that pix.
the nsa(or nsac or whatever they're called) wrote a much better one, coming in at about 300 pages. can't find the url, but it's on their site...
access-list 111 deny ip 169.254.0.0 0.0.255.255 any
which is used for APIPA ("Automatic Private IP Addressing", the serverless "DHCP" thing) which a lot of people overlook. Also, while looking for that I spotted that you have the wrong subnet masks for 172.16.0.0 (it's a /12 not a /16) and 192.168.0.0 (it's a /16, not a /8), so you should have:
access-list 111 deny ip 172.16.0.0 0.15.255.255 any
access-list 111 deny ip 192.168.0.0 0.0.255.255 any
Couldn't see anything else obvious to suggest, but I've only scanned it so far.
UNIX? They're not even circumcised! Savages!
..unplug the piece of shit.
Since when does the 506E support failover?
Also, the lack of "free" for the DES upgrades came from the lack of a support contract, something which i had no control over (i didnt control the budgeting for this unit). And if they are free now, it wasnt free when we used it.
I did not give up on IOS, we used the cisco firwewall at that company until I left, although I did ask for another network admin's help to set it up.
I'd also like to see what you've gotten a 506E to do that linux cant do, i believe you are talking about more expensive gear Anonymous Coward.
The Ro Factor - Jeep/Linux Weblog
Just stuff a cheap p-box full of nics, load OpenBSD and you can do stuff you can't do with a Cisco box that costs 50 grand.
It's Christmas everyday with BitTorrent.