In this video, we're going to leverage the Cisco iOS guide
for hardening Cisco IOS devices as we
focus on the management plane for Cisco routers and switches
running IOS.
And once again, we're going to use
this terrific document, the Cisco Guide to Hardening Cisco
IOS devices.
And if we scroll down, we have a section just
for the features that we can incorporate
regarding the management plane for hardening those devices.
So let's go ahead and take a look at a few of these.
Also, if you scroll down, for each of these,
it has details on implementing those solutions WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it has details on implementing those solutions
for hardening the devices.
So let's talk about password management.
The goal there would be to use TACACS.
And because we're talking about the management plane,
we're talking about management traffic
from our secure management stations
or our computers as administrators
to the network devices.
And so ideally, we'll have TACACS.
And hopefully, we'll have a redundant TACACS server using
triple A, so if we can't reach the first TACACS server,
we'll reach the second one.
And then, as a third method, we'd
also probably want to have a local user account
with privilege level 15 access.
And when we create that local user account, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And when we create that local user account,
this would be in the case that our TACACS servers are not
reachable, that local user should
have a very secure password.
I mean, not just upper and lower case,
alphanumeric, all that good stuff,
but it should also be stored very, very securely.
And as an example, when we create the user account,
we'd go into configuration mode, username.
We'll call this admin1, and we'll
give him privilege level 15.
And then right here, instead of specifying password,
which would be a really bad idea, that's a type 7 password,
we would use the keyword secret, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we would use the keyword secret, which
gives us a type 5 password.
However, there is another really cool option, and that's this.
If we type in algorithm-type and then do a question mark
and specify scrypt, now if we put a password here--
let's use a secret of Cisco123.
Actually, I'm going to put an exclamation mark there,
[LAUGHS] and press Enter.
Now, if we do a show run-- and let's do a pipe
and include username, we have some really great encryption
storing our password.
And that is a type 0. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that is a type 0.
So type 7 is a bad idea.
Type 5 is preferable over the type 7.
And type 9 what we want to do if our IOS supports it.
Also, we're getting password security.
We definitely don't want to use the enable password.
We want to use the enable secret.
And we want to avoid and not use type 7 or plain text passwords
even worse anywhere in our config.
The Login Password Retry Timeout is another great option.
I mean, how many times do you want
to allow an attacker to do a brute force
attack on your system?
1,000 times?
10,000 times? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
10,000 times?
So basically, the Login Password Retry Lockout
is going to say, OK, here's the threshold.
Once that threshold has been exceeded,
that account is going to be locked out.
And that can help against a brute force attack.
Now, if you do this feature, if somebody, like the user
we just created, has a privilege level of 15,
it doesn't apply to privilege level 15 accounts.
And that way, the attacker can't block you out
as an administrator, so the password lockout
doesn't apply to a privilege level 15 account.
If you're in an environment where you don't want password
recovery capabilities, you can turn off
that feature, which is good for security, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that feature, which is good for security,
but it's also a hassle.
In the event you need to do your password recovery,
you have to go through a lot more work to get the system up
and running because the password recovery feature is disabled.
If you have services or features that
are running on your system, you want to turn those off.
Don't leave those open.
So on this IOS router, if we did a show control
plane, post, open ports, it's going to show us the open port.
So right now-- [LAUGHS] oh, not good.
So telnet is available and listening on this server.
And that's not a great idea.
So if we did a conf t, line, vty 0 through 4, and said, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we did a conf t, line, vty 0 through 4, and said,
transport input SSH--
and then, let's also go to ip http secure server.
They will generate some keys for us.
It'll open up TCP 443.
And let's do a show, control plane, host, open ports.
So here, I have 22 that's open and 443--
looks like, wow, still have 23 open.
Let's take a look-- show run sec line. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's take a look-- show run sec line.
Huh, what do you know about that?
[LAUGHS] So even though the transport input SSH is there,
it still has 23 open--
so that way, you can open a port,
but no one's going to be able to connect on it
because we're not allowing telnet inbound.
So we can verify that with a show IP interface brief,
and if I telnet to myself--
yep, connection refused.
However, based on this output here,
it's still a listening port.
The key is, if we have unused services or unused ports,
we want to disable them when possible.
Another option for hardening the management plane WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Another option for hardening the management plane
would be the exec timeout.
So if we want our TCP session, like our SSH session,
to timeout after 5 minutes or 10 minutes, that's not a bad idea.
Because if it times out, then a re-login game
will be required, as opposed to having a session that never
times out or it doesn't timeout for hours,
there's more opportunity for somebody
to actually see or console or get to your computer,
if you don't leave it locked, and actually
pick up on that session.
And again, I'm just going to do some cherry picking here.
Management Interface Use-- it's a great idea.
Like on the router we just looked at,
it has a loopback address of 1.1.1.1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it has a loopback address of 1.1.1.1.
And if we specify that IP address on a loopback
and we have reachability, if this is the router-- router 1,
and it's got multiple paths, even if a physical interface
goes down, we still have reachability, as long as
that 1.1.1.1 address space is being
advertised to the network.
So if we're using that for management, not only do we
have fault tolerance if we have multiple paths compared
to the IP address on an interface,
we also have the ability to lock that puppy down with ACLs
elsewhere in our environment.
So we can specify another ACL in our environment
that the traffic going to this IP address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that the traffic going to this IP address
from an administrator, regarding SSH or some other management
protocol, is allowed.
And then it also helps us out infrastructure-wide in locking
down that address because we know
exactly what is going to be.
If there's a router that's under attack and a CPU is going way,
way high, we'd want to know about that.
So we can turn on notification for CPU issues.
And we can do it with SNMP simple network management
protocol by setting up our thresholds.
There's options for collecting data in the event of a crash.
For network time protocol, we'd always WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For network time protocol, we'd always
want to use authentication, that way we're not being spoofed
or lied to by an unauthenticated NTP server.
And then it refers here infrastructure ACLs,
which is amazing.
So let's imagine that this is our network.
We have these three devices.
If we have loopbacks that we're using for management
of each of these devices, we can specify with access control
lists that traffic, especially management traffic--
we can specify with access control
list at the edges of our network and throughout the network,
we can specify that traffic from your admin computer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can specify that traffic from your admin computer
and my admin computer can go to these devices
if they're the protocols acceptable, like SSH and so
forth.
And then we could deny SSH from every other IP address
to anywhere in our address space.
And they refer to that as an infrastructure ACL, which
is specifically permitting certain types of traffic
within the addressing space.
And that way, if somebody's trying
to come in from the outside or trying
to come in from the inside from a device,
those infrastructure ACLs can identify that traffic
and stop it before it ever reaches
the device that the hacker or attacker is
trying to connect to. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
trying to connect to.
So as part of the infrastructure ACLs,
we could do ICMP packet filtering.
We could filter fragments if an attacker
is trying to bypass an ACL using fragmentation.
We could look for those fragments
and stop them and block them based on being a fragment.
And other options in those ACLs would
include looking for specific options or TTL values.
So if somebody is sending a packet
in-- it has a strict resource root option, which
is trying to direct the packet specifically
as it goes through the network, we
can have an access list at the edge that sees that option
and says, oh, no, no.
We're not allowing that packet in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're not allowing that packet in.
Or we see a packet that's coming in.
It's got a TTL two, for example, and we
know it's going to take like four
hops to get across our network.
We can kill it right at the edge.
Now, some of these functions-- if we filter ICMP packets
and we filter TTLs that are too low,
that's going to hamper ourselves because we won't
be able to do a pinging or traceroute
from any device in the infrastructure.
We'll be limited to doing those types of commands that
are permitted by these infrastructure ACLs
from either our trusted computers that you and I manage
or our management systems.
So let's scroll down a little bit more
and take a look at secure interactive management WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and take a look at secure interactive management
sessions.
Of course, we would never want to use
Telnet or any unprotected protocols
as we manage our devices.
And on some IOS devices, there's literally
a feature of Management Plane Protection which
can specify which interfaces are allowing
which protocols, like SSH on fast Ethernet 0/0
or gigabit 0/0.
And that's it.
So those protocols coming in on any other interfaces
would be denied.
And there's also Control Plane Protection and Policing,
which are absolutely amazing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which are absolutely amazing.
We have separate sets of videos on Control Plane Protection,
but with the Control Plane, there are some packets--
see, this is R1.
Some packets, the router is going to forward, like data
plane traffic--
gets back it in, looks at the IP header, Ceph has it all cached,
forwards it.
Next packet, please.
No problem.
However, there's some traffic that the router
has to process itself, like a routing update.
So the router get that, de-encapsulates the routing
update, looks at it, has to think about it,
and that takes CPU.
So an attacker who's trying to compromise this system
could actually send a boatload of traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
could actually send a boatload of traffic
that has to be processed by the CPU in an attempt
to disrupt service on this router.
So with Control Plane Protection and Control Plane Policing,
we can identify thresholds.
We could say, if this is your computer--
I'll put you here, and I'll put mine right next to you.
So this is you and me.
We can specify that traffic, like SSH traffic,
HTTPS traffic, other management protocols that
are coming from you or me--
no problem.
Let the router go ahead and process it.
However, if traffic is coming in from any other addresses WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, if traffic is coming in from any other addresses
on those protocols, we can set thresholds.
So the router can say, whoa, whoa,
this quantity of ICMP traffic directed to me
or this quantity of SSH traffic directed to me,
I'm going to go ahead and I'm going to limit it right here,
basically cut it off.
Because it's not coming from trusted sources.
And that way, I can deny that traffic
and stop it before I have to actually send it
to my processor for processing.
So we're basically killing the traffic
that, otherwise, if we had to process, might overload us.
And that's kind of the thought process
behind Control Plane Policing and Control Plane Protection. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
behind Control Plane Policing and Control Plane Protection.
And you might think, wait, wait, wait, stop the truck, Keith.
Aren't we in the management plane section?
And the answer is, yes, we are.
However, Control Plane Policing and Control Plane Protection
is also going to protect our management protocols
by taking stuff from unauthorized sources
and dropping it and not causing harm.
So a lot of these techniques will fall into both camps.
So Control Plane Policing and Control Plane Protection
are going to help both the management plane as well
as the control plane, which is our next video.
We'd also want to use secure protocols like SSH--
and not just any SSH. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and not just any SSH.
Ideally, we'd be using SSH version 2, which
means we'd enable SSH, and then in global config,
say IP SSH version 2 to then restrict
SSH traffic so its version 2 only, which is more secure.
So if we do show commands for SSH
and it says it supports 1.9, what that means is it's
willing to support version 1 and version 2.
So if we do IP SSH version 2, then it
can lock it down to version 2.
We'd also want to make sure that's
the only protocol allowed on the VTY lines as well.
And then it talks about triple A, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then it talks about triple A,
which is a great idea, using TACACS acts for admins
who are accessing so we can authenticate them, authorize
the commands they can issue, and then account
for what they did on a centralized triple A server.
And here it just basically reinforces never
used type 7 passwords.
Type 5 is better.
And as we demonstrated earlier, a type 9
is even better than that.
And then regarding SNMP, if you must use SNMP version 2,
[LAUGHS] please do so in combination
with access control lists that restrict
where those SNMP sessions inbound are being allowed from. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
where those SNMP sessions inbound are being allowed from.
So SNMP with ACLs is great, and SNMP version 3
is preferred because it has data integrity
and also has encryption services to protect the confidentiality
and the data integrity of the SNMP traffic going
back and forth.
And then it also refers to logging.
And logging is a great idea so you can see what's happening,
but logging to the console is a bad idea
because it could overrun the CPU.
If you're doing a debug of everything
and it goes to the console, you might have
a real problem on your hands. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a real problem on your hands.
There's options to verify that the IOS that we're running
on our devices is authentic.
And that would look something like this.
If you did a directory-- and here is my IOS.
I'll simply copy that.
And the images show software authenticity file,
and then we point to it.
And I'll simply paste that in and then press Enter.
It can help us verify the authenticity of the IOS
that we're currently running.
Another really, really cool feature
is this bad boy right here--
Configuration Replace and Configuration Rollback, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Configuration Replace and Configuration Rollback,
where you can tell your IOS device,
hey, you know what, every day or every five minutes
or every 40 minutes or whatever time frame
you want, go ahead and do a backup of the configuration
so that if we ever need to restore from that
in the future, we've got some copies of that right
there local on that device.
And that's super handy in the event we need to restore.
In fact, let me demonstrate that for you real quick.
So right here on router 1, if we do a DAR--
I just have these files in the flash at the moment.
And if went into configuration mode
and used the command archive and pressed Enter, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and used the command archive and pressed Enter,
we now have options for telling it
we want to back up periodically.
So I'm going to specify the path first.
And my path is on the flash.
I'm just going to call it KB-backup.cfg.
And then, we can specify how many copies to keep.
I'm going to specify that with a maximum.
Let's say we want 10 copies, and then it'll
just start rolling out the first in, first out
after it reaches the 10.
And the time period--
it refers to how often should it do it.
I'm go say every two minutes just for a demonstration
so we can have a few in there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so we can have a few in there.
And I'm also going to use the option of right memory, which
is the automatic backup generation
during a right memory, which is a copy runstart.
All right, there's one other option
I'd like to share with you, and that is log as well.
So we type in log config.
That takes us into the archive, a special sub component
called log configuration.
And from here, we can specify actions
to take whenever there's configuration changes that
are made so we can keep track of what's happening.
Now ideally, if we're using triple A
with triple A accounting-- every command
and who issued those commands, those
are all being stored centrally on our triple A server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are all being stored centrally on our triple A server.
So we type in end here, and we do a DIR.
There we go.
We've got one of them here that triggered.
And if we type in write or W-R, not only
did it take the running config to startup config,
but it also made another copy in the file system for us.
It backed it up based on how we have it configured.
So if we made a change like this-- let's do a config t,
hostname, and we'll call this R--
how about R2D2, just for fun.
And we just said, oh, you know what, that's a huge problem. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we just said, oh, you know what, that's a huge problem.
Or something modified our config,
we want to roll that back, we can simply
use the config replace command and grab one of these files.
So let's do a config replace.
Now, this is different than a copy start
run because a copy is going to merge the two together.
We want to replace it.
So configure, replace, and I'll specify
the file system it's on.
I know it starts with a KB something,
so I'll tab that out, and let me go grab the rest of that
to make it unique.
So 15-20, and let's grab the first one right there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So 15-20, and let's grab the first one right there.
So I'll paste that in, press Enter, and now it's asking me,
hey, are you sure you want to proceed?
This is going to replace your current running
config with this file.
And if we say yes, press Enter, it'll
acquire our configuration lock.
And it is done.
So our hostname is back to R1.
And that's the Archive option.
So I want to thank you for joining me for a few highlights
from that section of this guide regarding hardening Cisco IOS
devices with a focus on the management plane.
In the next section of this document, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In the next section of this document,
I'd like to share with you some of the highlights and sections
regarding configuring Cisco IOS devices
and hardening them, focusing on the control plane.
And we'll do that next.
See you there in a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.