Networking / Beginners

Router

The following sets of configuration guidelines are broad enough to address core elements of router security. To build a complete set of router hardening guidelines for your organization make sure to take a look at the additional resources listed at the end of this section.

Firmware Version

Update to the most current firmware if possible.
Check the vendor's web site for security advisories and/or bug notifications.
Avoid early deployment software in production environments.

User Access Controls

Ensure that a unique and complex password is set for each user level.
Restrict connectp, telnet, ssh, rlogin, "show login", and "show access-lists" commands to exec privilege only.
Add password authentication for Console, AUX, and VTY access.
Utilize higher encryption for stored passwords.
Set an inactivity timeout for sessions.
Configure remote access to utilize a TACAS+ or RADIUS server.
Ensure that settings are applied for local, modem, and network access as applicable.
Restrict network access to specified hosts.
Utilize SSH access instead of Telnet on supported IOSs.
Enable a nonidentifiable warning banner.

Router Services

Disable all nonessential router listening services (small-services).
Disable source routing.
Disable ICMP redirects.
Disable CDP, FINGER, IDENTD, BOOTP, DNS, TFTP (use scp), and HTTP.
Disable Finger.
Restrict network boot searches.
Allow only restricted SNMP read access; and without default community strings.
Enable encryption for SNMP (use SNMP v3).
Specify time updates from a trusted NTP server only.

Router Access Control Lists

Assign appropriate access zones.
Restrict ICMP activity.
Restrict essential service access with ACL.
Apply egress traffic filters.
Apply ingress traffic filters.
Enable rate limiting.
Enable protocol limiting to distribute bandwidth consumption during peak hours.
Enable static routing.
Review the use of HSRP, RIPv1, RIPv2, EIGRP, OSPF, and BGP.

Logging

Specify remote logging to trusted host.
Enable sequence entries to logs.
Send commands used on the router to the log server.
Log trap alerts and violations.
Synch network time.
Review log data.