Cisco Certification Track
Cisco Certification track for Security
• CCNA Security
• CCNP Security
• CCIE Security
Cisco Certification
• Cert. NAME: CCNA Security
• Cert. No: 640-554
• Name: Implementing Cisco IOS Network Security
• Exam Duration: 90 minutes
• Number of question in Exam: 55-65 questions
Reference Books
Enforcing Perimeter Security Policy
• Routers are used to secure the Router 1 (R1)
LAN 1
Internet 192.168.2.0
network perimeter.
• Scenario 1:
Scenario 1
– The router protects the LAN.
• Scenario 2: R1 Firewall
LAN 1
Internet 192.168.2.0
– The router screens traffic before a
firewall (PIX/ASA).
Scenario 2
• Scenario 3:
– The zone directly connected to the R1 Firewall R2
LAN 1
Internet
firewall is called a DMZ. 192.168.2.0
– Internet-accessible servers are DMZ
located in the DMZ. Scenario 3
Three Areas of Router Security
• Physical security
– Secure infrastructure equipment in a locked room that:
• Is accessible only to authorized personnel.
• Is free of electrostatic or magnetic interference.
• Has fire suppression.
• Has controls for temperature and humidity.
– Install an uninterruptible power supply (UPS) and keep spare components available to reduce the
possibility of a DoS attack from power loss to the building.
Three Areas of Router Security
• Operating system
– Configure the router with the maximum amount of memory possible.
• Helps protect it from some DoS attacks.
– Use the latest stable version of the operating system that meets the feature requirements of the network.
– Keep a secure copy of the router operating system image and router configuration file as a backup.
Three Areas of Router Security
• Router hardening
– Secure administrative control to ensure that only authorized personnel have access and that their level of
access is controlled.
– Disable unused ports and interfaces to reduce the number of ways a device can be accessed.
– Disable unnecessary services that can be used by an attacker to gather information or for exploitation.
Three Areas of Router Security
Secure Administrative Access
• Restrict device accessibility
– Limit the accessible ports, restrict the permitted communicators, and restrict the permitted methods of
access.
• Log and account for all access
– For auditing purposes, record anyone who accesses a device, including what occurs and when.
• Authenticate access
– Ensure that access is granted only to authenticated users, groups, and services.
– Limit the number of failed login attempts and the time between logins.
Secure Administrative Access
• Authorize actions
– Restrict the actions and views permitted by any particular user, group, or service.
• Present Legal Notification
– Display a legal notice, developed in conjunction with company legal counsel, for interactive sessions.
• Ensure the confidentiality of data
– Protect locally stored sensitive data from viewing and copying.
– Consider the vulnerability of data in transit over a communication channel to sniffing, session hijacking, and
man-in-the-middle (MITM) attacks.
Cisco Router Passwords
• All routers need a locally configured password for privileged access and other access.
R1(config)# enable secret cisco
R1(config)# line vty 0 4 R1(config)# line aux 0
R1(config-line)# password cisco R1(config-line)# password cisco
R1(config-line)# login R1(config-line)# login
R1
R1(config)# line con 0
R1(config-line)# password cisco
R1(config-line)# login
Cisco Router Passwords
• To increase the security of passwords, the following Cisco IOS commands should be utilized:
– Enforce minimum password length: security passwords min-length.
– Disable unattended connections: exec-timeout.
– Encrypt config file passwords: service password-encryption.
Enforce Minimum Password Lengths
• Make passwords lengthy.
– IOS 12.3 and later passwords can be 0 to 16 characters in length.
– The best practice is to have a minimum of 10 characters.
• To enforce the minimum length use the global command:
– security passwords min-length length
• The command affects all “new” router passwords.
– Existing router passwords are unaffected.
• Any attempt to create a new password that is less than the specified length fails and results in an
“Password too short” error message.
Disable Unattended Connections
• Default time is 10 minutes.
• Terminates an unattended connection (console or vty).
• Provides additional level of security if an administrator walks away from an active console
session.
Router(config-line)#
exec-timeout minutes [seconds]
– To terminate an unattended console connection after 3 minutes and 30 seconds:
Sudbury(config)# line console 0
– To disable the exec process on the
Sudbury(config-line)# line:
exec-timeout 3 30
Sudbury(config)# line aux 0
Sudbury(config-line)# no exec-timeout
Encrypt All Passwords
• Encrypt all passwords in the router configuration file.
Router(config)#
service password-encryption
R1(config)# service password-encryption
R1(config)# exit
R1# show running-config
enable password 7 06020026144A061E
!
line con 0
password 7 094F471A1A0A
login
!
line aux 0
password 7 01100F175804575D72
login
line vty 0 4
password 7 03095A0F034F38435B49150A1819
login
Securing Local Database Passwords
• Secure the local database passwords.
– Traditional user configuration with plaintext password.
username name password {[0] password | 7 hidden-password}
– Use MD5 hashing for strong password protection.
– More secure than the type 7 encryption.
username name secret {[0] password | encrypted-secret}
Securing Local Database Passwords
R1# conf t
R1(config)# username JR-ADMIN password letmein
% Password too short - must be at least 10 characters. Password configuration
failed
R1(config)# username JR-ADMIN password cisco12345
R1(config)# username ADMIN secret cisco54321
R1(config)# line con 0
R1(config-line)# login local
R1# show run | include username
username JR-ADMIN password 7 060506324F41584B564347
username ADMIN secret 5 $1$G3oQ$hEvsd5iz76WJuSJvtzs8I0
R1#
R1 con0 is now available
Press RETURN to get started.
User Access Verification
Username: ADMIN
Password:
R1>
Provide Legal Notification
• Banner messages should be used to warn would-be intruders that they are not welcome on your
network.
• Banners are important, especially from a legal perspective.
– Intruders have been known to win court cases because they did not encounter appropriate warning
messages.
– Choosing what to place in banner messages is extremely important and should be reviewed by legal
counsel before being implemented.
– Never use the word “welcome” or any other familiar or similar greeting that may be misconstrued as an
invitation to use the network.
Configuring Banner Messages
• Specify what is “proper use” of the system.
• Specify that the system is being monitored.
• Specify that privacy should not be expected when using this system.
• Do not use the word “welcome.”
• Have legal department review the content of the message.
Router(config)#
banner {exec | incoming | login | motd | slip-ppp} d message d
Secure Virtual Logins
• To improve security for virtual
login connections, the login
process should be configured
with specific parameters: Welcome to SPAN
Engineering
User Access Verification
– Implement delays between Password: cisco
Password: cisco1
successive login attempts. Password: cisco12
Password: cisco123
– Enable login shutdown if DoS Password: cisco1234
attacks are suspected.
– Generate system logging
messages for login detection.
Disable Login for Excessive Attempts
• In this sample config, if more than 5 login failures occur within 60 seconds, then all logins will be
disabled for 120 seconds.
– This command must be issued before any other login command can be used.
– The command also helps provide DoS detection and prevention.
• The PERMIT-ADMIN commands exempt administrative stations from the disabled login.
– If not configured, all login requests will be denied during the Quiet-Mode.
R1# configure terminal
R1(config)# username ADMIN secret cisco54321
R1(config)# line vty 0 4
R1(config-line)# login local
R1(config)# exit
R1(config)# login block-for 120 attempts 5 within 60
R1(config)# ip access-list standard PERMIT-ADMIN
R1(config-std-nacl)# remark Permit only Administrative hosts
R1(config-std-nacl)# permit 192.168.10.10
R1(config-std-nacl)# permit 192.168.11.10
R1(config-std-nacl)# exit
R1(config)# login quiet-mode access-class PERMIT-ADMIN
R1(config)# login delay 10
R1(config)# login on-success log
R1(config)# login on-failure log
R1(config)# exit
Verify Login Security
• In this example, the login block-for command was configured to block login hosts for
120 seconds if more than 5 login requests fail within 60 seconds.
R1# show login
A login delay of 10 seconds is applied.
Quiet-Mode access list PERMIT-ADMIN is applied.
Router enabled to watch for login Attacks.
If more than 5 login failures occur in 60 seconds or less,
logins will be disabled for 120 seconds.
Router presently in Normal-Mode.
Current Watch Window
Time remaining: 5 seconds.
Login failures for current window: 4.
Total login failures: 4.
Verify Login Security When in Quiet Mode
• In this example, a 6th failed attempt at logging has occurred.
– A log message is initiated at the console stating that the router is in Quiet-Mode.
– All login attempts made using Telnet, SSH, and HTTP are denied except as specified by the PERMIT-ADMIN
ACL.
R1#
*Dec 10 15:38:54.455: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching
failures is 12 secs, [user: admin] [Source: 10.10.10.10] [localport: 23] [Reason:
Login Authentication Failed - BadUser] [ACL: PERMIT-ADMIN] at 15:38:54 UTC Wed Dec
10 2008
R1# show login
A login delay of 10 seconds is applied.
Quiet-Mode access list PERMIT-ADMIN is applied.
Router enabled to watch for login Attacks.
If more than 5 login failures occur in 60 seconds or less,
logins will be disabled for 120 seconds.
Router presently in Quiet-Mode.
Will remain in Quiet-Mode for 105 seconds.
Restricted logins filtered by applied ACL PERMIT-ADMIN.
R1#
Verify Login Security When in Quiet Mode
• In this example, the command identifies the number of failures, usernames tried, and offending
IP addresses with a timestamp added to each unsuccessful attempt.
R1# show login failures
Total failed logins: 22
Detailed information about last 50 failures
Username SourceIPAddr lPort Count TimeStamp
admin 1.1.2.1 23 5 15:38:54 UTC Wed Dec 10 2011
Admin 10.10.10.10 23 13 15:58:43 UTC Wed Dec 10 2011
admin 10.10.10.10 23 3 15:57:14 UTC Wed Dec 10 2011
cisco 10.10.10.10 23 1 15:57:21 UTC Wed Dec 10 2011
R1#
Sniffing a Telnet Password
• An attacker is capturing packets using Wireshark on a local subnet.
• The attacker is interested in TCP Telnet streams and notices that the administrator’s IP address
(192.168.2.7) has initiated a Telnet session to a device.
Follow the TCP Stream
• By following the TCP Telnet stream, the attacker has captured the administrator’s username (Bob)
and password (cisco123).
Configure SSH
• When the administrator uses SSH, the attacker no longer sees Telnet packets and must instead
filter by the administrator’s IP address.
Follow the TCP Stream
• When following the stream of data, the attacker only sees TCP and SSH packets which reveal
useless encrypted information.
Configuring SSH
• Step 1: Configure the IP domain name.
• Step 2: Generate one-way secret RSA keys.
• Step 3: Create a local database username entry.
• Step 4: Enable VTY inbound SSH sessions.
R1# conf t
R1(config)# ip domain-name span.com
R1(config)# crypto key generate rsa general-keys modulus 1024
The name for the keys will be: R1.span.com
% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
R1(config)#
*Dec 13 16:19:12.079: %SSH-5-ENABLED: SSH 1.99 has been enabled
R1(config)# username Bob secret cisco
R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exit
Optional SSH Features
• Optionally, SSH commands can be used to configure the following:
– SSH version
– Number of authentication retries
– SSH timeout period
Optional SSH Features
• SSH Versions:
– Cisco IOS Release 12.1(1)T and later supports SSHv1.
– Cisco IOS Release 12.3(4)T and later supports both SSHv1 and SSHv2 (compatibility mode).
– To change versions, use the ip ssh version {1 | 2} global command.
• Number of authentication retries:
– By default, a user logging in has 3 attempts before being disconnected.
– To configure a different number of consecutive SSH retries, use the ip ssh authentication-retries
integer command in global configuration mode.
• SSH Timeouts:
– The default time interval that the router will wait for an SSH client to respond during SSH negotiation phase is 120
seconds.
– Change the time using ip ssh time-out seconds.
Optional SSH Commands
R1# show ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
R1#
R1# conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)# ip ssh version 2
R1(config)# ip ssh authentication-retries 2
R1(config)# ip ssh time-out 60
R1(config)# ^Z
R1#
R1# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 2
R1#
Router-to-Router SSH
2 R2 establishes an SSH connection with R1.
R2# ssh -l Bob
192.168.2.101
Password:
R1>
1 There are no current SSH sessions ongoing with R1.
R1# sho ssh
%No SSHv2 server connections running.
%No SSHv1 server connections running.
R1#
3 There is an incoming and outgoing SSHv2 session with user Bob.
R1# sho ssh
Connection Version Mode Encryption Hmac State Username
0 2.0 IN aes128-cbc hmac-sha1 Session started Bob
0 2.0 OUT aes128-cbc hmac-sha1 Session started Bob
%No SSHv1 server connections running.
R1#
Host-to-Router SSH
Configuring SSH Using CCP
Configuring SSH Using CCP
