CISCO IOS HARDENING

Presented By :-

Shweta Mehta

Suneet Malik

A• ABOUT IOS

HARDENING

G• 3 PLANES OF

MANAGEMENT

E• MANAGEMENT

PLANE N • CONTROL PLANE

D • DATA PLANE

A • SUMMARY

Introduction

Cisco IOS Software• Internetwork Operating system• Used on Cisco Routers and switches• Package integrated with multitasking OS• Characteristics CLI(Command Line Interface)

Hardening• Process of securing a system by reducing vulnerabilities

Three Planes of a Network

Management Plane Control Plane Data Plane Each plane provide

different functionality

MANAGEMENT PLANE

Management Plane Fortification

Implement general management plane hardening. Use strong password and secure them strongly. Use the login password retry lockout feature. Monitor the memory and CPU load of network devices. Disable unneeded services

TCP/UDP

HTTP

DNSBOOTP

DHCP

Contd..

Secure interactive management sessions.

• Limit which IP addresses may establish

management sessions to the network devices.

- Access classes

- Management Plane protection.

- Control plane policing.• Use warning banners for malicious users.• Use secure protocols.

Limit access to network with infrastructure access control List iACLs.

• Permit connections that are required for routing protocols and network management.

• Explicitly deny all other IP traffic to any network device.

• Permit all transit traffic that crosses the network and is not destined for infrastructure devices.

Contd..

Contd..

Permit tcp host 192.168.1.2 host 192.168.1.1 eq 179Permit tcp host 192.168.1.2 eq 179 host 192.168.1.1Permit tcp host 192.168.1.3 any eq 22Deny ip any 192.168.1.0 0.255.255.255

Use Authentication ,Authorization and accounting (AAA).Fortify SNMP.Utilize logging best practices.Utilize configuration management features of CISCO IOS

Software.

NEXT STEP ????

CONTOL PLANE

CONTROL PLANE

Control Plane Fortification

Implement general control plane hardening.

- Disable ICMP Redirect processing.

- Disable ICMP unreachable generation.

- Disable proxy ARP.

- If you use NTP ,explicitly configure a trusted time

source and use proper authentication. Limit CPU impact of control plane traffic

- Implement iACLs

- Implement receive ACLs(rACLs)

- Use CoPP.

Contd..

Secure BGP

- Implement TTL Based security protection generalized TTL based security mechanism(GTSM),also known as BGP TTL security hack (BTCH).

- Implement BGP peer authentication with message

digest five (MD 5)- Configure a maximum number of BGP prefixes that can

be stored by a router in memory.- Filter BGP prefixes with BGP autonomous system (AS)

path access list and prefix list.

Contd..

Secure IGPs- Use routing protocol authentication with MD5 , the

passive interface command and routing filtering

- Configure routing protocol to limit resource consumption.

Secure first hop Redundancy protocols(FHRPs)

- Gateway load balancing protocol

- Hot standby router protocol(HSRB)

- Virtual router redundancy protocol.

NEXT STEP ????

DATA PLANE

DATA PLANE

Data Plane Fortification

Implement general data plane hardening

- Use IP options selective drop feature.

- Disable IP source routing.

- Disable ICMP redirects.

- Disable or limit IP directed broadcast.

Contd..

Implement anti spoofing protections to prevent the many attacks that rely on source address spoofing.

Unicast reverse path forwarding(URPF).

IP source guard.

Dynamic ARP Inspection (DAI).

Port security.

Access control lists.

Contd..

Prevent spoofed addresses from entering the N/W .

Prevent the origination of packets containing spoofed source addrerss.

Filter transit traffic specifically ICPM packets , IP fragments and packets containing IP options with transit ACLs (tACLs).

Contd..

Filter packets containing IP options where they are not needed.

Minimize CPU intensive features such as ACL logging and IP fragmentation.

Limit the generation of ICMP unreachable and Time exceeded messages.

Contd..

Identify and trace attacks Cisco IOS netFlow. Classification ACLs

Use VLAN maps and port ACLs

Use private VLANs

NEXT STEP ????

QUERIES!!!

THANK YOU…