8 steps to protect your Cisco router
Daniel B. Cid daniel@underlinux.com.br

Network security is a completely changing area; new devices like IDS (Intrusion Detection systems), IPS (Intrusion Prevention systems), and Honeypots are modifying the way people think about security. Companies are spending thousand of dollars on new security devices, but forgetting the basic, the first line of defense: the border router. Although a lot of people may think that routers don’t need to be protect, they are completely wrong. A lot of secure problems appear all time against this kind of device and most of them are vulnerable. Some information about some common security problems found on Cisco Routers, can be read on the text “Exploiting Cisco Routers”, available at: http://www.securityfocus.com/infocus/1734 In this article I will give you 8 steps, easy to follow, to minimize your Cisco router exposure by turning off some unused services, applying some access control and applying some security options available on that.

12345678-

Control Access to your router; Restrict telnet access to it; Block Spoof/Malicious packets; Restrict SNMP; Encrypt all passwords; Disable all unused services; Add some security options; Log everything;

1- Control Access to your router The first thing to do is apply some rules to restrict all external access to some ports of the router. You can block all ports, but it is not always necessary. These commands bellow will protect your router against some reconnaissance attacks and, obviously, will restrict access to these ports:

access-list 110 deny tcp any host $yourRouterIP eq 7 access-list 110 deny tcp any host $yourRouterIP eq 9 access-list 110 deny tcp any host $yourRouterIP eq 13

access-list 110 deny tcp any host $yourRouterIP eq 19 access-list 110 deny tcp any host $yourRouterIP eq 23 access-list 110 deny tcp any host $yourRouterIP