New to Cisco IOS, how can I improve the security of this configuration?

Question

I'm pretty new to IOS and I've been building up a configuration file in Packet Tracer. I still have NAT to setup, as I have to account for a couple of streamers. So, what should I do to configure the security portion of this router? Does this configuration leave the router wide open? The model is the 891F ISR, but I'll also be configuring some 881 routers as well.

!
    hostname xxxxxxx
    !
    !
    !
    enable password secret xxxxxxxx
    !
    !
    ip dhcp excluded-address 192.168.1.1
    !
    ip dhcp pool LAN
     network 192.168.1.0 255.255.255.0
     default-router 192.168.1.1
     dns-server 8.8.8.8
    !
    !
    !
    username xxx privilege 15 password 0 xxxxxxxxxxx
    !
    !
    !
    !
    !
    ip ssh version 1
    ip domain-name cisco.com
    ip name-server 192.168.1.2
    !
    !
    spanning-tree mode pvst
    !
    !
    !
    !
    interface FastEthernet0/0
     description ISP connection
     ip address xxx.xxx.xxx.xxx 255.255.255.0
     duplex auto
     speed auto
    !
    interface FastEthernet0/1
     no ip address
     duplex auto
     speed auto
     shutdown
    !
    interface FastEthernet0/1/0
     switchport mode access
     spanning-tree portfast
    !
    interface FastEthernet0/1/1
     switchport mode access
     spanning-tree portfast
    !
    interface FastEthernet0/1/2
     switchport mode access
     spanning-tree portfast
    !
    interface FastEthernet0/1/3
     switchport mode access
     spanning-tree portfast
    !
    interface Vlan1
     ip address 192.168.1.1 255.255.255.0
    !
    ip classless
    ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
    !
    !
    !
    banner motd ^CThis router is private property and may not be accessed without permission of the owner^C
    !
    !
    !
    !
    line con 0
     exec-timeout 0 0
     password xxxxxxxx
     logging synchronous
     login local
    line vty 0 4
     exec-timeout 0 0
     password xxxxxxx
     logging synchronous
     login local
    line vty 5 15
     exec-timeout 0 0
     password xxxxxxxxxxx
     logging synchronous
     login local
    !
    !
    !
    end

Answer 1

I have participated in quite a few certifications for Department of Defense network devices and ALL DoD devices have to adhere to Security Technical Implementation Guides (STIGs). They are a list usually sorted by device type, then by vendor on standards to follow in order to provide security and Defense in Depth with network appliances.

I would download a STIG viewer from the DISA site and pick the correct STIG for your device and start going through them one by one. This is what my company does for all their devices they implement on DoD networks. Additionally we have to pull all our configurations and send them to an accreditation body who grants us permission to connect and have them operate on a DoD networks. Security like this is maybe a bit of an overkill, but it will give you quite a few good guidelines for you implementation.

Here is the link to the network devices STIGS:

http://iase.disa.mil/stigs/net_perimeter/network-infrastructure/Pages/firewall.aspx

Specifically the one labeled: "Network Firewall STIG - Version 8, Release 19"

It will be a zip file that contains vendor specific guidelines as well as a generic file with generic guidelines.

Good luck.

Answer 2

There is a lot to say on this field. I would like to add at Andy answer the following guidelines provided by Cisco.

About the configuration itself, well you can improve ACL on line, service password-encryption, disable not used service like http and so on.

Answer 3

Another thing that you can do is change your ssh configuration:

You need to change your

ip ssh version

from 1 to 2, to IMPROVE your security, ssh version 1 is an old configuration

Answer 4

Just a few things to get you started.

Router MGMT Security

• "Service password-encryption" for plain-text encryption of "password"s.
• "IP SSH version 2".
• "No CDP run" command.
• "transport input ssh" on VTY ports.
• Access-class commands on VTY ports (with associated ACLs).

Router Networking Security

• No IP redirects/no ip unreachables/no ip proxy-arp on interface ports.

Answer 5

As a first step configure a VTY access list to limit direct access to the router, eg

access-list 151 permit ip host 192.168.0.10 any

line vty 0 4 
access-class 151 in

line vty 5 15 
access-class 151 in

This will limit telnet/ssh access to the router to 192.168.0.10 (replace the IP with a different host/subnet as necessary).

Switch off http access if you're not going to use it (don't use it).

Consider adding control-plane policers if the device supports it, see:

http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html

Andy