I've heard it said that repetition
is the parent of learning.
Well, in this document from Cisco regarding hardening Cisco
devices, it covers how we can do it
for traffic related to the control plane, the data plane,
and the management plane.
But it also includes at the very bottom
of this document, an appendix, which
is a checklist, which is a great way
to review some of those things that we
might want to consider or hardening the Cisco iOS
devices.
So, here is the appendix from that same document
that we started off at the beginning
of this set of videos. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of this set of videos.
And it states it's a collection of all the hardening steps
that are presented in this guide.
So, if you want any detail on any one of them,
you can go back to the guide into that section
where they provide configuration examples and more explanation
on each and every one of them.
So, it starts off with a management plane with passwords
and then details on that, disabling unused services,
keepalive informations and notifications.
Then it has a whole section--
they call it configure here, but it's
like memory and CPU, reserving memory, buffer overflow
detection, enhanced crashed info, kind of a grab bag here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
detection, enhanced crashed info, kind of a grab bag here.
And then it goes down infrastructure ACLs,
which are basically specifying what traffic is allowed
or not allowed in your environment.
That way, you can stop the traffic that's not allowed,
like Telnet or SSH from unauthorized hosts.
You can stop it right at the edge,
and that way we can stop that traffic before it even
gets to the router or switch.
And then for filtering, you know, considerations
we're getting IP traffic and ICMP
traffic and options and TTL.
And then we have options for control plane protection
and control plane policing.
Now, policing is a less granular option for protecting the CPU. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, policing is a less granular option for protecting the CPU.
And control plane protection is very granular.
It can be very specific regarding
what it's trying to protect and which queues
and which threshold you want to set.
But they both have the overall same goal,
and that is to protect the CPU on our network infrastructure
device.
And it continues on with management access,
making sure we're using the best practices there.
AAA is a great idea.
Specifically TACACS+ or authentication, authorization,
and accounting.
TACACS is preferred over RADIUS because it
has more granular control over the authorization of commands WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
has more granular control over the authorization of commands
that can be issued.
And then with SNMP, use version 3 when possible.
And if you're going to use version 2,
make sure you use it in combination with ACLs.
And also, change the default passwords involved with SNMP.
And then logging and configuration management.
And then for the control plane, things to consider
disabling if we're not using them.
And then basically, all these say use authentication.
So, NTP with authentication, routing
protocols with authentication, and FHRP with authentication.
And then it also talks here about control plane policing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then it also talks here about control plane policing
and protection.
Again with the protection being a more granular option
for controlling what finally makes it to the CPU
for processing on a Cisco device.
And then, finally, in this checklist
we have the data plane.
So, we can consider dropping certain types of traffic.
We can disable certain features.
All of which we talked about previously.
We can limit IP directed broadcasts,
which is kind of funny, because it's off by default
on most Cisco devices.
We can configure access control lists.
The little t for that refers to transit access control lists. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The little t for that refers to transit access control lists.
This is for traffic that's attempting
to go through your network, not to a network device.
Access lists can also be used for anti-spoofing
as we discussed in the previous video.
And we also have additional protections
that help mitigate against spoofing,
people lying about layer 2, people lying
about layer 3, which would include Unicast RPF and IP
Source Guard.
And port security, just to control
the number of MAC addresses and which MAC addresses
are allowed to show up in our layer 2 environments.
And as we continue down, it reinforces
the use of ACLs, private VLANs.
I'd also toss in there, VRF-lite, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'd also toss in there, VRF-lite,
which is a great method for segmentation.
And then control plane protection
because our users on the data plane should never be--
they should never be sending traffic
to a network device as the final destination.
Admins should.
Network management tools should.
But end users should not be targeting our infrastructure
devices at all.
So, we could use a combination of access control lists,
control plane policing, to help restrict the impact
that user traffic is going to have on our devices.
Because at the end of the day, a user like Bob
should not be targeting or have an IP packet destined WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
should not be targeting or have an IP packet destined
for an infrastructure device.
They're supposedly going through the network,
not to our routers and switches directly.
So, we want to drop that traffic when
we see it if it's coming from those unauthorized users.
And if we are allowing some of that traffic in, like SSH
and so forth, at least limit it so if it's
the malicious attack, it can't consume the CPU
on those devices.
So thanks for joining me in this video, as we've
taken a look at the checklist as part of this document
for securing iOS devices.
And I'll see you in the next video.
Meanwhile, I hope this has been informative for you, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.