allowed an IOS router to perform stateful inspection of traffic (using Context-based Access Control [CBAC])

basic traffic filtering using access control lists (ACLs)

a router at a headquarters location and at a branch office location could interconnect via an IPsec-protected VPN

allow traffic to pass securely between those sites, even if the VPN crossed an "untrusted" network, such as the Internet

integrate various services (voice and security) into the router architecture

last three digits of their model begin with 8

Integrated VPN Acceleration

Dedicated voice hardware

Advanced Integration Modules

USB port

Cisco HWIC-AP

Cisco IDS Network Module

Cisco Content Engine

Cisco Network Analysis Mode (NAM)

uses dedicated hardware for VPN encryption, so ISRs reduce the overhead placed on a router's processor, thereby increasing VPN performance and scalability

support AES and 3DES

IP telephony applications often use digital signal processors (DSP) to mix multiple voice streams in a conference, encrypt voice packets and convert between high-bandwidth and low-bandwidth codecs

Voice traffic uses Real-time Transport Protocol (RTP), Layer 4 protocol, to transport voice in a network. SRTP provides AES encryption

The processor overhead to use the encryption, dedicated DSP hardware is required-ISRs can use packet voice DSP modules (PVDM) to take over the processing tasks

offload processor-intensive tasks from a router's processor

AIMs can be used for VPN processing, including a variety of standards for encryption, authentication and data integrity

AIM Models

• AIM-VPN/BPII-PLUS-1800 series ISRs (support1mod)
• AIM-VPN/EPII-PLUS-2800 series ISR, 3825 ISR (2)
• AIM-VPN/HPII-PLUS - 3845 ISR supports 2 AIMS

all ISRs except 850, include one or more USB ports. Ports can be used with a USB flash drive to store IOS images or configuration files

USB eToken containing a signed digital certification can be inserted for VPN use

includes hard drive containing multiple signatures of well-known attacks

can be used to detect and subsequently prevent malicious traffic

either 40-GB or 80-GB hard drive for caching web content

amkes it available for qick retrieval by local clients, as opposed to the client's having to retrieve all the information from the web

as soon as administrator is granted access to router

limited number of commands

most router administration is performed in this mode

to access privileged mode from user mode, administrator enters enable command

typically then another password needs to be entered - sometimes called the enable password

used to permit access to a router's privileged mode

password is stored in the router's configuration as an MD5 hash value, making it difficult for an attacker to guess and impossible to see with the naked eye

password is not encrypted (or hashed) by default

enable password is considered weaker than enable secret password

Cisco IOS still supports the enable password for backward compatibility

R1(config)# enable secret [password]

R1(config)# end

R1(config)# line con 0

R1(config-line)# password [password]

R1(config-line)# login

R1(config)# line aux 0

R1(config-line)# password [password]

R1(config-line)# login

R1(config)# line vty 0 4

R1(config-line)# login

R1(config-line)#password [password]

R1(config)# username [username] secret [password]

R1(config)# end

ROM monitor mode

during bootup process, can generate break sequence causing the router to go into ROMMON mode

From there the router's password can be reset

15-second delay after 10 failed login attempts

security authentication failure rate [#] log can change the default to specified lengths

exec-timeout [minutes][seconds]

disable by doing exec-timeout 0 0

R1# config term

R1(config)# privilege exe level [#] debug

R1(config)# enable secret level 5 [password]

R1(config)# end

1. Enable AAA: aaa new-model
2. Enable the root view: enable view
3. Create a view: parser view [name]
4. Set a password for the view: secret 0 [password]
5. Add available commands to view: commands [parser mode] {include|include-exclusive|command} [all] [interface (int ident|command)]
6. Verify the role-based CLI view configuration: enable view [name]

Cisco IOS Resilient Configuration feature

a secure copy of a router's image and configuration

1. Enable image resilience
2. Secure the boot configuration
3. Verify the security of the bootset

Cisco IOS Resilient Configuration Steps

Enable image resilience

secure boot-image command

issued in global configuration mode and secures the IOS image

secured image is hidden so that it does not appear in a directory listing of files

Cisco IOS Resilient Configuration Steps

Secure the boot configuration

secure boot-config command

done in global configuration mode

archives the running configuration of a router to persistent storage

Cisco IOS Resilient Configuration Steps

Verify the security of the bootset

show secure bootset command

used to verify that IOS Resilient Configuration is enabled and that the files in the bootset have been secured

Create a delay between repeated login attempts

Suspend the login process if a denial-of-service (DoS) attack is suspected

Create syslog messages upon the success and/or failure of a login attempt

Enable Cisco IOS Login Enhancements

login block-for command in global config mode

default settings -

• delay of 1 second occurs between successive login attempts

• no virtual connection can be made during the quiet period

specifies a minimum period of time that must pass between login attempts

default period of time is 1 second

banner motd [delimiter message_body delimiter]

motd stands for message of the day

delimiter is a character you choose to indicate the beginning and end of the banner message - choose a delimiter that will not appear in the body of the message

• smart wizards use Cisco TAC best-practice recommendations

• intelligently determines an appropriate security configuration baded on what it learns about a router's configuration (router's interfaces, NAT configuration and existing security configuration)
• supports multiple security features such as wizard-based VPN configuration, router security auditing and One-Step Lockdown configuration
• does not affect router's DRAM or CPU

Router(config)# ip http authentication local

Cisco SDM Wizards

Interfaces and Connections

Cisco SDM Wizards

Firewall and ACL

Cisco SDM Wizards

VPN

Cisco SDM Wizards

Security Audit

Cisco SDM Wizards

Routing

Cisco SDM Wizards

NAT

Cisco SDM Wizards

Intrustion Prevention

Cisco SDM Wizards

Quality of Service

Cisco SDM Wizards

NAC