I need confirmation that I understood the Cisco manual right. So my network is like this:
ISP_RTR ---x.x.x.x/30--- Perimeter/Edge_RTR ---y.y.y.y/30--- FW1 --- DMZ1
---z.z.z.z/30--- FW2 --- DMZ2
Networks x.x.x.x/30, y.y.y.y/30, z.z.z.z/30, DMZ1 and DMZ2 are all with public IP addresses.
On my Perimeter/Edge router I need only console access.
So I configured commands:
#enable secret password
#service password-encryption
#no service tcp-small-servers
#no service udp-small-servers
#no ip finger
#no ip bootp server
#ip dhcp bootp ignore
#no service dhcp
#no ip domain-lookup
#no service pad
#no service config
#no cdp run
#no lldp run
#service tcp-keepalives-in
#service tcp-keepalives-out
#exception crashinfo maximum files 10
#no ip http server
#no ip http secure-server
#line aux 0
#transport input none
#transport output none
#no exec
#exec-timeout 0 1
#no password
#line console 0
#transport output none
#line vty 0 97
#transport input none
#transport output none
#no exec
#exec-timeout 0 1
#no password
#login
Commands that my IOS didn't have were:
#no mop enabled
#memory reserve console 4096
#exception memory ignore overflow io
#exception memory ignore overflow processor
#no vstack
I also buid ACL that should protect the router.
#ip access-list extended OUTSIDE
!---Deny fragments to the infrastructure block
#deny tcp any host x.x.x.x fragments
#deny udp any host x.x.x.x fragments
#deny icmp any host x.x.x.x fragments
#deny ip any host x.x.x.x fragments
#deny tcp any y.y.y.y 0.0.0.3 fragments
#deny udp any y.y.y.y 0.0.0.3 fragments
#deny icmp any y.y.y.y 0.0.0.3 fragments
#deny ip any y.y.y.y 0.0.0.3 fragments
#deny tcp any z.z.z.z 0.0.0.3 fragments
#deny udp any z.z.z.z 0.0.0.3 fragments
#deny icmp any z.z.z.z 0.0.0.3 fragments
#deny ip any z.z.z.z 0.0.0.3 fragments
!---Deny ip options
#deny ip any any option any-options
!---Deny/filter TTL value
#deny ip any any ttl lt 5
!---Anti-spoofing entries for RFC3330
#deny ip host 0.0.0.0 any
#deny ip 0.0.0.0 0.255.255.255 any
#deny ip 14.0.0.0 0.255.255.255 any
#deny ip 24.0.0.0 0.255.255.255 any
#deny ip 39.0.0.0 0.255.255.255 any
#deny ip 127.0.0.0 0.255.255.255 any
#deny ip 128.0.0.0 0.0.255.255 any
#deny ip 169.254.0.0 0.0.255.255 any
#deny ip 191.255.0.0 0.0.255.255 any
#deny ip 192.0.0.0 0.0.0.255 any
#deny ip 192.0.2.0 0.0.0.255 any
#deny ip 192.88.99.0 0.0.0.255 any
#deny ip 198.18.0.0 0.1.255.255 any
#deny ip 223.255.255.0 0.0.0.255 any
#deny ip 224.0.0.0 15.255.255.255 any
#deny ip 240.0.0.0 15.255.255.255 any
!---Anti-spoofing entries for RFC1918
#deny ip 10.0.0.0 0.255.255.255 any
#deny ip 172.16.0.0 0.15.255.255 any
#deny ip 192.168.0.0 0.0.255.255 any
!---Anti-spoofing entries for my addresses as source
#deny ip y.y.y.y 0.0.0.3 any
#deny ip z.z.z.z 0.0.0.3 any
#deny ip dmz1-address dmz1-wildcard mask any
#deny ip dmz2-address dmz2-wildcard mask any
!---Deny access to infrastructure addresses (router interface and point-to-point links)
#deny ip any host x.x.x.x
#deny ip any y.y.y.y 0.0.0.3
#deny ip any z.z.z.z 0.0.0.3
!---Permit transit traffic
#permit ip any any
And applied ACL on to interface toward ISP router:
#interface ge 0/0
#ip access-group OUTSIDE in
Did I miss something? Or did I put something too much?
deny ip any z.z.z.z 0.0.0.3 fragments
, you probably don't want to restrict this to merely your /30 uplink... just usedeny ip any any fragments