Cisco Certification Track

Cisco Certification track for Security

• CCNA Security

• CCNP Security

• CCIE Security
Cisco Certification

• Cert. NAME: CCNA Security

• Cert. No: 640-554

• Name: Implementing Cisco IOS Network Security

• Exam Duration: 90 minutes

• Number of question in Exam: 55-65 questions

Reference Books
Enforcing Perimeter Security Policy

• Routers are used to secure the Router 1 (R1)

LAN 1
Internet 192.168.2.0
network perimeter.

• Scenario 1:
Scenario 1
– The router protects the LAN.

• Scenario 2: R1 Firewall
LAN 1
Internet 192.168.2.0
– The router screens traffic before a
firewall (PIX/ASA).
Scenario 2
• Scenario 3:
– The zone directly connected to the R1 Firewall R2
LAN 1
Internet
firewall is called a DMZ. 192.168.2.0

– Internet-accessible servers are DMZ

located in the DMZ. Scenario 3

Three Areas of Router Security

• Physical security
– Secure infrastructure equipment in a locked room that:
• Is accessible only to authorized personnel.

• Is free of electrostatic or magnetic interference.

• Has fire suppression.

• Has controls for temperature and humidity.

– Install an uninterruptible power supply (UPS) and keep spare components available to reduce the
possibility of a DoS attack from power loss to the building.
Three Areas of Router Security

• Operating system
– Configure the router with the maximum amount of memory possible.
• Helps protect it from some DoS attacks.

– Use the latest stable version of the operating system that meets the feature requirements of the network.

– Keep a secure copy of the router operating system image and router configuration file as a backup.
Three Areas of Router Security

• Router hardening
– Secure administrative control to ensure that only authorized personnel have access and that their level of
access is controlled.

– Disable unused ports and interfaces to reduce the number of ways a device can be accessed.

– Disable unnecessary services that can be used by an attacker to gather information or for exploitation.
Three Areas of Router Security
Secure Administrative Access

• Restrict device accessibility

– Limit the accessible ports, restrict the permitted communicators, and restrict the permitted methods of
access.

• Log and account for all access

– For auditing purposes, record anyone who accesses a device, including what occurs and when.

• Authenticate access
– Ensure that access is granted only to authenticated users, groups, and services.

– Limit the number of failed login attempts and the time between logins.
Secure Administrative Access

• Authorize actions
– Restrict the actions and views permitted by any particular user, group, or service.

• Present Legal Notification

– Display a legal notice, developed in conjunction with company legal counsel, for interactive sessions.

• Ensure the confidentiality of data

– Protect locally stored sensitive data from viewing and copying.

– Consider the vulnerability of data in transit over a communication channel to sniffing, session hijacking, and
man-in-the-middle (MITM) attacks.
Cisco Router Passwords

• All routers need a locally configured password for privileged access and other access.

R1(config)# enable secret cisco

R1(config)# line vty 0 4 R1(config)# line aux 0

R1(config-line)# password cisco R1(config-line)# password cisco
R1(config-line)# login R1(config-line)# login

R1

R1(config)# line con 0

R1(config-line)# password cisco
R1(config-line)# login
Cisco Router Passwords

• To increase the security of passwords, the following Cisco IOS commands should be utilized:
– Enforce minimum password length: security passwords min-length.

– Disable unattended connections: exec-timeout.

– Encrypt config file passwords: service password-encryption.

Enforce Minimum Password Lengths

• Make passwords lengthy.

– IOS 12.3 and later passwords can be 0 to 16 characters in length.

– The best practice is to have a minimum of 10 characters.

• To enforce the minimum length use the global command:

– security passwords min-length length

• The command affects all “new” router passwords.

– Existing router passwords are unaffected.

• Any attempt to create a new password that is less than the specified length fails and results in an
“Password too short” error message.
Disable Unattended Connections

• Default time is 10 minutes.

• Terminates an unattended connection (console or vty).
• Provides additional level of security if an administrator walks away from an active console
session.
Router(config-line)#
exec-timeout minutes [seconds]

– To terminate an unattended console connection after 3 minutes and 30 seconds:

Sudbury(config)# line console 0

– To disable the exec process on the
Sudbury(config-line)# line:
exec-timeout 3 30

Sudbury(config)# line aux 0

Sudbury(config-line)# no exec-timeout
Encrypt All Passwords

• Encrypt all passwords in the router configuration file.

Router(config)#
service password-encryption

R1(config)# service password-encryption

R1(config)# exit
R1# show running-config
enable password 7 06020026144A061E
!
line con 0
password 7 094F471A1A0A
login
!
line aux 0
password 7 01100F175804575D72
login
line vty 0 4
password 7 03095A0F034F38435B49150A1819
login
Securing Local Database Passwords

• Secure the local database passwords.

– Traditional user configuration with plaintext password.
username name password {[0] password | 7 hidden-password}

– Use MD5 hashing for strong password protection.

– More secure than the type 7 encryption.
username name secret {[0] password | encrypted-secret}
Securing Local Database Passwords

R1# conf t
R1(config)# username JR-ADMIN password letmein
% Password too short - must be at least 10 characters. Password configuration
failed
R1(config)# username JR-ADMIN password cisco12345
R1(config)# username ADMIN secret cisco54321
R1(config)# line con 0
R1(config-line)# login local

R1# show run | include username

username JR-ADMIN password 7 060506324F41584B564347
username ADMIN secret 5 $1$G3oQ$hEvsd5iz76WJuSJvtzs8I0
R1#

R1 con0 is now available

Press RETURN to get started.

User Access Verification

Username: ADMIN
Password:
R1>
Provide Legal Notification

• Banner messages should be used to warn would-be intruders that they are not welcome on your
network.

• Banners are important, especially from a legal perspective.

– Intruders have been known to win court cases because they did not encounter appropriate warning
messages.

– Choosing what to place in banner messages is extremely important and should be reviewed by legal
counsel before being implemented.

– Never use the word “welcome” or any other familiar or similar greeting that may be misconstrued as an
invitation to use the network.
Configuring Banner Messages

• Specify what is “proper use” of the system.

• Specify that the system is being monitored.

• Specify that privacy should not be expected when using this system.

• Do not use the word “welcome.”

• Have legal department review the content of the message.

Router(config)#
banner {exec | incoming | login | motd | slip-ppp} d message d
Secure Virtual Logins

• To improve security for virtual

login connections, the login
process should be configured
with specific parameters: Welcome to SPAN
Engineering
User Access Verification
– Implement delays between Password: cisco
Password: cisco1
successive login attempts. Password: cisco12
Password: cisco123

– Enable login shutdown if DoS Password: cisco1234

attacks are suspected.

– Generate system logging
messages for login detection.
Disable Login for Excessive Attempts

• In this sample config, if more than 5 login failures occur within 60 seconds, then all logins will be
disabled for 120 seconds.
– This command must be issued before any other login command can be used.
– The command also helps provide DoS detection and prevention.
• The PERMIT-ADMIN commands exempt administrative stations from the disabled login.
– If not configured, all login requests will be denied during the Quiet-Mode.

R1# configure terminal

R1(config)# username ADMIN secret cisco54321
R1(config)# line vty 0 4
R1(config-line)# login local
R1(config)# exit
R1(config)# login block-for 120 attempts 5 within 60
R1(config)# ip access-list standard PERMIT-ADMIN
R1(config-std-nacl)# remark Permit only Administrative hosts
R1(config-std-nacl)# permit 192.168.10.10
R1(config-std-nacl)# permit 192.168.11.10
R1(config-std-nacl)# exit
R1(config)# login quiet-mode access-class PERMIT-ADMIN
R1(config)# login delay 10
R1(config)# login on-success log
R1(config)# login on-failure log
R1(config)# exit
Verify Login Security

• In this example, the login block-for command was configured to block login hosts for
120 seconds if more than 5 login requests fail within 60 seconds.

R1# show login

A login delay of 10 seconds is applied.
Quiet-Mode access list PERMIT-ADMIN is applied.

Router enabled to watch for login Attacks.

If more than 5 login failures occur in 60 seconds or less,
logins will be disabled for 120 seconds.

Router presently in Normal-Mode.

Current Watch Window
Time remaining: 5 seconds.
Login failures for current window: 4.
Total login failures: 4.
Verify Login Security When in Quiet Mode

• In this example, a 6th failed attempt at logging has occurred.

– A log message is initiated at the console stating that the router is in Quiet-Mode.
– All login attempts made using Telnet, SSH, and HTTP are denied except as specified by the PERMIT-ADMIN
ACL.

R1#
*Dec 10 15:38:54.455: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching
failures is 12 secs, [user: admin] [Source: 10.10.10.10] [localport: 23] [Reason:
Login Authentication Failed - BadUser] [ACL: PERMIT-ADMIN] at 15:38:54 UTC Wed Dec
10 2008

R1# show login

A login delay of 10 seconds is applied.
Quiet-Mode access list PERMIT-ADMIN is applied.

Router enabled to watch for login Attacks.

If more than 5 login failures occur in 60 seconds or less,
logins will be disabled for 120 seconds.

Router presently in Quiet-Mode.

Will remain in Quiet-Mode for 105 seconds.
Restricted logins filtered by applied ACL PERMIT-ADMIN.

R1#
Verify Login Security When in Quiet Mode

• In this example, the command identifies the number of failures, usernames tried, and offending
IP addresses with a timestamp added to each unsuccessful attempt.

R1# show login failures

Total failed logins: 22
Detailed information about last 50 failures

Username SourceIPAddr lPort Count TimeStamp

admin 1.1.2.1 23 5 15:38:54 UTC Wed Dec 10 2011
Admin 10.10.10.10 23 13 15:58:43 UTC Wed Dec 10 2011
admin 10.10.10.10 23 3 15:57:14 UTC Wed Dec 10 2011
cisco 10.10.10.10 23 1 15:57:21 UTC Wed Dec 10 2011

R1#
Sniffing a Telnet Password

• An attacker is capturing packets using Wireshark on a local subnet.

• The attacker is interested in TCP Telnet streams and notices that the administrator’s IP address
(192.168.2.7) has initiated a Telnet session to a device.
Follow the TCP Stream

• By following the TCP Telnet stream, the attacker has captured the administrator’s username (Bob)
and password (cisco123).
Configure SSH

• When the administrator uses SSH, the attacker no longer sees Telnet packets and must instead
filter by the administrator’s IP address.
 Follow the TCP Stream

• When following the stream of data, the attacker only sees TCP and SSH packets which reveal
useless encrypted information.
Configuring SSH

• Step 1: Configure the IP domain name.

• Step 2: Generate one-way secret RSA keys.

• Step 3: Create a local database username entry.

• Step 4: Enable VTY inbound SSH sessions.

R1# conf t
R1(config)# ip domain-name span.com
R1(config)# crypto key generate rsa general-keys modulus 1024
The name for the keys will be: R1.span.com

% The key modulus size is 1024 bits

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

R1(config)#
*Dec 13 16:19:12.079: %SSH-5-ENABLED: SSH 1.99 has been enabled
R1(config)# username Bob secret cisco
R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exit
Optional SSH Features

• Optionally, SSH commands can be used to configure the following:

– SSH version

– Number of authentication retries

– SSH timeout period

 Optional SSH Features

• SSH Versions:
– Cisco IOS Release 12.1(1)T and later supports SSHv1.
– Cisco IOS Release 12.3(4)T and later supports both SSHv1 and SSHv2 (compatibility mode).
– To change versions, use the ip ssh version {1 | 2} global command.
• Number of authentication retries:
– By default, a user logging in has 3 attempts before being disconnected.
– To configure a different number of consecutive SSH retries, use the ip ssh authentication-retries
integer command in global configuration mode.
• SSH Timeouts:
– The default time interval that the router will wait for an SSH client to respond during SSH negotiation phase is 120
seconds.
– Change the time using ip ssh time-out seconds.
Optional SSH Commands

R1# show ip ssh

SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
R1#
R1# conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)# ip ssh version 2
R1(config)# ip ssh authentication-retries 2
R1(config)# ip ssh time-out 60
R1(config)# ^Z
R1#
R1# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 2
R1#
Router-to-Router SSH
2 R2 establishes an SSH connection with R1.

R2# ssh -l Bob

192.168.2.101

Password:

R1>

1 There are no current SSH sessions ongoing with R1.

R1# sho ssh

%No SSHv2 server connections running.
%No SSHv1 server connections running.
R1#

3 There is an incoming and outgoing SSHv2 session with user Bob.

R1# sho ssh

Connection Version Mode Encryption Hmac State Username
0 2.0 IN aes128-cbc hmac-sha1 Session started Bob
0 2.0 OUT aes128-cbc hmac-sha1 Session started Bob
%No SSHv1 server connections running.
R1#
Host-to-Router SSH
Configuring SSH Using CCP
Configuring SSH Using CCP