Router Security
Base Security Configuration
Standard and Extended ACL Traffic Filtering
TCP Intercept Configuration
Router Security Monitoring
NetFlow Traffic Monitoring
Base Security Configuration on Router
Configuring security on a router is crucial for protecting network infrastructure from various threats.
Base security configuration for a router
1. Access Control Lists (ACLs)
- ACLs are used to control traffic entering or leaving a router interface.
- They can permit or deny traffic based on source and destination IP addresses, protocols, and ports.
- Apply ACLs to interfaces to restrict unauthorized traffic and protect against network attacks.
2. Password Security
- Set strong passwords for privileged EXEC mode (enable mode) and console/VTY (telnet/SSH) access.
- Use a combination of alphanumeric characters, special characters, and consider implementing
password aging and complexity policies.
- Avoid using default or easily guessable passwords.
3. Management Plane Protection
- Secure management protocols like SSH (Secure Shell) and SNMP (Simple Network Management
Protocol) by configuring access control lists and setting up encryption.
- Limit management access to trusted hosts and networks.
- Implement role-based access control (RBAC) to restrict access based on user roles.
4. Device Hardening
- Disable unnecessary services and interfaces to reduce the attack surface.
- Keep the router software up-to-date with security patches to address known vulnerabilities.
- Disable unused or insecure protocols such as Telnet and SNMPv1.
Page 1 --- J.M. Odhiambo
- Enable features like Control Plane Policing (CoPP) to protect the router's control plane from DoS
(Denial of Service) attacks.
5. Logging and Monitoring
- Configure logging to monitor router activity, including login attempts, configuration changes, and
security-related events.
- Use syslog or SNMP to send logs to a centralized logging server for easier analysis and correlation.
- Regularly review logs to detect and respond to security incidents promptly.
6. Intrusion Detection and Prevention
- Deploy intrusion detection and prevention systems (IDS/IPS) to detect and block malicious activity on
the network.
- Consider using features like Cisco IOS Embedded Event Manager (EEM) for automated responses to
security events.
7. Physical Security
- Protect physical access to the router by placing it in a secure location and using locking cabinets or
cages.
- Implement tamper-evident seals to detect unauthorized access attempts.
- Disable USB and console port access if physical security is a concern.
8. User Authentication
- Implement authentication mechanisms such as TACACS+ (Terminal Access Controller Access-Control
System Plus) or RADIUS (Remote Authentication Dial-In User Service) for user authentication.
- Use AAA (Authentication, Authorization, and Accounting) to control user access and track their
activities.
By implementing these base security configurations, you can enhance the security posture of your
router and safeguard your network infrastructure against various threats. However, it's essential to
regularly review and update security measures to adapt to evolving threats.
Standard and Extended ACL Traffic Filtering on Router
Standard and Extended Access Control Lists (ACLs) are used in routers to filter traffic based on various
criteria such as source/destination IP addresses, protocols, and ports. Here are the key differences and
considerations for using Standard and Extended ACLs for traffic filtering:
Standard ACLs
Page 2 --- J.M. Odhiambo
1. Filtering Based on Source IP Address
- Standard ACLs can only filter traffic based on the source IP address.
- They are typically used when you need to permit or deny entire ranges of source IP addresses.
2. Numeric Identification
- Standard ACLs are identified by a number from 1 to 99 or 1300 to 1999 in Cisco routers.
- Lower-numbered ACLs are processed before higher-numbered ones.
3. Placement Considerations
- Standard ACLs are generally placed as close to the destination as possible.
- Placing them near the destination allows more traffic to be filtered out before reaching the router,
conserving router resources.
4. Example Configuration
access-list 10 permit [Link] [Link]
access-list 10 deny any
Extended ACLs
1. Filtering Based on Source and Destination IP Addresses, Protocols, and Ports
- Extended ACLs offer more granularity by allowing filtering based on source and destination IP
addresses, protocols (TCP, UDP, ICMP), and port numbers.
- They are suitable for allowing or denying specific types of traffic.
2. Numeric Identification
- Extended ACLs are identified by a number from 100 to 199 or 2000 to 2699 in Cisco routers.
- Similar to Standard ACLs, lower-numbered ACLs are processed first.
3. Placement Considerations
- Extended ACLs should be placed as close to the source as possible.
- Placing them near the source allows filtering to occur before routing decisions are made, which can
prevent unnecessary processing of denied traffic.
4. Example Configuration
access-list 101 permit tcp [Link] [Link] any eq 80
Page 3 --- J.M. Odhiambo
access-list 101 permit udp any any range 1024 65535
access-list 101 deny ip any any
Considerations for both Standard and Extended ACLs
1. Order of Statements
- The order of permit and deny statements is crucial. ACLs are processed sequentially, and the first
match is applied.
- Be cautious when writing ACLs to ensure that desired traffic is permitted and unwanted traffic is
denied.
2. Implicit Deny
- If there is no explicit permit statement at the end of an ACL, there is an implicit deny all.
- Always include an explicit permit or deny statement at the end of an ACL to control the default
behavior explicitly.
3. Wildcard Masks
- Use wildcard masks to specify ranges of IP addresses.
- Wildcard masks are the inverse of subnet masks, where 0 bits indicate the bits to match precisely,
and 1 bits indicate wildcard (don't care) bits.
4. Monitoring and Testing
- Regularly monitor ACL traffic matches and adjust ACLs as necessary.
- Test ACLs thoroughly in a controlled environment before deploying them in a production network to
avoid disrupting legitimate traffic.
By understanding the differences and considerations for Standard and Extended ACLs, network
administrators can effectively implement traffic filtering on routers to enhance network security and
performance.
TCP Intercept Configuration on Router
TCP Intercept is a feature that protects TCP servers against SYN flood attacks, a common form of Denial
of Service (DoS) attack. It works by intercepting TCP connection requests (SYN packets) and holding
them until a legitimate three-way handshake is completed or a timeout occurs. Here's how to configure
TCP Intercept on a router:
1. Enable TCP Intercept
Page 4 --- J.M. Odhiambo
Router(config)# ip tcp intercept mode {intercept | watch}
- `intercept`: This mode actively intercepts TCP connection requests and holds them until the three-
way handshake is completed or the timeout expires.
- `watch`: This mode only monitors TCP connection requests and does not actively intercept them. It
provides logging and statistics for analysis.
2. Set Global Parameters
Router(config)# ip tcp intercept max-incomplete high-water 1000
Router(config)# ip tcp intercept max-incomplete low-water 800
Router(config)# ip tcp intercept watch-timeout 30
Router(config)# ip tcp intercept drop-mode random
- `max-incomplete high-water`: Specifies the maximum number of incomplete connections allowed
before TCP Intercept starts dropping new connection requests.
- `max-incomplete low-water`: Specifies the threshold at which TCP Intercept stops dropping new
connection requests.
- `watch-timeout`: Sets the timeout value (in seconds) for monitoring incomplete connections before
dropping them.
- `drop-mode`: Determines the method used to drop excessive connection requests. `random` is one of
the available options.
3. Apply TCP Intercept to Specific Interfaces
Router(config)# interface <interface>
Router(config-if)# ip tcp intercept mode {intercept | watch}
- Apply TCP Intercept to specific interfaces where protection against SYN flood attacks is required.
4. Monitoring and Troubleshooting
- Monitor TCP Intercept statistics and logs to assess its effectiveness and detect any anomalies.
- Use commands such as `show tcp intercept statistics` and `show tcp intercept connections` to view
statistics and active connections being intercepted.
5. Adjust Configuration as Needed
- Fine-tune TCP Intercept parameters based on network traffic patterns and the severity of potential
SYN flood attacks.
Page 5 --- J.M. Odhiambo
- Regularly review logs and statistics to identify any issues or adjustments required for optimal
performance.
6. Optional: Configure ACLs
- Optionally, configure access control lists (ACLs) to permit or deny TCP traffic based on specific criteria
before it reaches the TCP Intercept feature.
- ACLs can provide additional filtering capabilities to enhance network security.
By configuring TCP Intercept on a router, network administrators can mitigate the impact of SYN flood
attacks and ensure the availability and reliability of TCP services. Regular monitoring and adjustment of
TCP Intercept parameters are essential to adapt to evolving network conditions and security threats.
Router Security Monitoring
Router security monitoring is essential for maintaining the integrity, confidentiality, and availability of
network infrastructure. Here's a comprehensive guide on router security monitoring:
1. Logging Configuration
- Enable logging on the router to capture security-related events.
- Configure logging to record login attempts, configuration changes, interface status changes, and
security violations.
- Set logging levels appropriately to ensure relevant events are logged without overwhelming the
logging system.
2. Centralized Logging
- Send router logs to a centralized logging server for aggregation and analysis.
- Centralized logging facilitates centralized monitoring, correlation of events from multiple devices,
and long-term storage for compliance and forensic purposes.
3. Syslog Server Configuration
- Configure the router to send syslog messages to the designated syslog server.
- Use protocols such as Syslog, SNMP traps, or NetFlow to transmit logs securely to the syslog server.
4. Security Information and Event Management (SIEM)
- Integrate router logs with a SIEM system for advanced analysis and correlation of security events
across the network.
Page 6 --- J.M. Odhiambo
- SIEM systems provide real-time monitoring, alerting, and incident response capabilities to detect and
mitigate security threats effectively.
5. Anomaly Detection
- Implement anomaly detection mechanisms to identify unusual or suspicious behavior on the router.
- Use tools like intrusion detection/prevention systems (IDS/IPS) or behavioral analysis to detect
anomalies in traffic patterns or configuration changes.
6. Traffic Analysis
- Monitor network traffic passing through the router to detect potential security threats.
- Use packet capture tools or NetFlow to analyze traffic patterns, identify anomalies, and investigate
security incidents.
7. Configuration Management
- Monitor router configurations for unauthorized changes or deviations from baseline configurations.
- Use configuration management tools to track configuration changes, compare configurations over
time, and ensure compliance with security policies.
8. Security Auditing
- Conduct regular security audits and vulnerability assessments of router configurations and access
controls.
- Identify and remediate security vulnerabilities to prevent exploitation by malicious actors.
9. User Activity Monitoring
- Monitor user activity on the router, including login attempts, commands executed, and privilege level
changes.
- Implement user accountability measures such as command logging and session recording to track
user actions and detect insider threats.
10. Incident Response
- Develop and document incident response procedures for responding to security incidents on the
router.
- Establish clear roles and responsibilities, escalation procedures, and communication channels for
coordinating incident response efforts.
11. Regular Review and Analysis
Page 7 --- J.M. Odhiambo
- Regularly review router logs, security alerts, and performance metrics to identify security issues and
performance bottlenecks.
- Analyze trends and patterns to proactively identify emerging threats and vulnerabilities.
12. Continuous Improvement
- Continuously assess and improve router security monitoring processes and technologies to adapt to
evolving security threats and regulatory requirements.
- Stay informed about new security best practices, tools, and technologies to enhance router security
posture.
By implementing robust router security monitoring practices, organizations can effectively detect,
mitigate, and respond to security threats and ensure the integrity and availability of network
infrastructure.
NetFlow Traffic Monitoring on Router
NetFlow is a traffic monitoring and analysis technology used to collect and analyze network traffic data.
It provides detailed visibility into traffic patterns, application usage, and network performance. Here's a
guide on how to configure NetFlow traffic monitoring on a router:
1. Enable NetFlow on the Router
- Enter global configuration mode:
Router# configure terminal
- Enable NetFlow on the router and specify the version (usually version 5 or version 9):
Router(config)# ip flow-export version <version>
- Configure the destination to which NetFlow records will be exported (typically an IP address and port
of the NetFlow collector):
Router(config)# ip flow-export destination <destination-IP> <UDP-port>
2. Define NetFlow Flow Record
- Create a flow record to specify the fields to include in each NetFlow record:
Router(config)# flow record <record-name>
Router(config-flow-record)# match <field1> <field2> ...
Router(config-flow-record)# collect <field3> <field4> ...
3. Define NetFlow Flow Exporter
Page 8 --- J.M. Odhiambo
- Define a flow exporter to specify the destination and transport protocol for exporting NetFlow
records:
Router(config)# flow exporter <exporter-name>
Router(config-flow-exporter)# destination <destination-IP> <UDP-port>
4. Define NetFlow Flow Monitor
- Create a flow monitor to associate the flow record and flow exporter:
Router(config)# flow monitor <monitor-name>
Router(config-flow-monitor)# record <record-name>
Router(config-flow-monitor)# exporter <exporter-name>
5. Apply NetFlow to Interfaces
- Apply the flow monitor to the interfaces whose traffic you want to monitor:
Router(config)# interface <interface>
Router(config-if)# ip flow monitor <monitor-name> input
Router(config-if)# ip flow monitor <monitor-name> output
6. View NetFlow Statistics
- To view NetFlow statistics, use commands such as:
Router# show ip cache flow
Router# show flow monitor <monitor-name> statistics
7. Analyze NetFlow Data
- Collect NetFlow records at the configured collector/analysis system.
- Use NetFlow analysis tools to interpret the data, identify traffic patterns, detect anomalies, and
troubleshoot network issues.
8. Fine-tune Configuration
- Adjust NetFlow configuration parameters based on network requirements, such as sampling rate,
flow timeout values, and record size.
9. Security Considerations
Page 9 --- J.M. Odhiambo
- Ensure that NetFlow records are securely exported to the designated collector to prevent
interception or tampering of traffic data.
- Use secure transport protocols (e.g., IPsec) to protect NetFlow data during transmission over
untrusted networks.
By configuring NetFlow traffic monitoring on the router, network administrators can gain valuable
insights into network traffic behavior, optimize network performance, and enhance security posture by
detecting and mitigating security threats.
Page 10 --- J.M. Odhiambo