5

I need confirmation that I understood the Cisco manual right. So my network is like this:

ISP_RTR ---x.x.x.x/30--- Perimeter/Edge_RTR ---y.y.y.y/30--- FW1 --- DMZ1
                                            ---z.z.z.z/30--- FW2 --- DMZ2

Networks x.x.x.x/30, y.y.y.y/30, z.z.z.z/30, DMZ1 and DMZ2 are all with public IP addresses.

On my Perimeter/Edge router I need only console access.

So I configured commands:

#enable secret password
#service password-encryption
#no service tcp-small-servers
#no service udp-small-servers
#no ip finger
#no ip bootp server
#ip dhcp bootp ignore
#no service dhcp
#no ip domain-lookup
#no service pad
#no service config
#no cdp run
#no lldp run
#service tcp-keepalives-in
#service tcp-keepalives-out
#exception crashinfo maximum files 10
#no ip http server
#no ip http secure-server
#line aux 0
 #transport input none
 #transport output none
 #no exec
 #exec-timeout 0 1
 #no password
#line console 0
 #transport output none
#line vty 0 97
 #transport input none
 #transport output none
 #no exec
 #exec-timeout 0 1
 #no password
 #login

Commands that my IOS didn't have were:

#no mop enabled
#memory reserve console 4096
#exception memory ignore overflow io
#exception memory ignore overflow processor
#no vstack

I also buid ACL that should protect the router.

#ip access-list extended OUTSIDE
 !---Deny fragments to the infrastructure block
 #deny tcp any host x.x.x.x fragments
 #deny udp any host x.x.x.x fragments
 #deny icmp any host x.x.x.x fragments
 #deny ip any host x.x.x.x fragments
 #deny tcp any y.y.y.y 0.0.0.3 fragments
 #deny udp any y.y.y.y 0.0.0.3 fragments
 #deny icmp any y.y.y.y 0.0.0.3 fragments
 #deny ip any y.y.y.y 0.0.0.3 fragments
 #deny tcp any z.z.z.z 0.0.0.3 fragments
 #deny udp any z.z.z.z 0.0.0.3 fragments
 #deny icmp any z.z.z.z 0.0.0.3 fragments
 #deny ip any z.z.z.z 0.0.0.3 fragments
 !---Deny ip options
 #deny ip any any option any-options
 !---Deny/filter TTL value
 #deny ip any any ttl lt 5
 !---Anti-spoofing entries for RFC3330
 #deny ip host 0.0.0.0 any
 #deny ip 0.0.0.0 0.255.255.255 any
 #deny ip 14.0.0.0 0.255.255.255 any
 #deny ip 24.0.0.0 0.255.255.255 any
 #deny ip 39.0.0.0 0.255.255.255 any
 #deny ip 127.0.0.0 0.255.255.255 any
 #deny ip 128.0.0.0 0.0.255.255 any
 #deny ip 169.254.0.0 0.0.255.255 any
 #deny ip 191.255.0.0 0.0.255.255 any
 #deny ip 192.0.0.0 0.0.0.255 any
 #deny ip 192.0.2.0 0.0.0.255 any
 #deny ip 192.88.99.0 0.0.0.255 any
 #deny ip 198.18.0.0 0.1.255.255 any
 #deny ip 223.255.255.0 0.0.0.255 any
 #deny ip 224.0.0.0 15.255.255.255 any
 #deny ip 240.0.0.0 15.255.255.255 any
 !---Anti-spoofing entries for RFC1918
 #deny ip 10.0.0.0 0.255.255.255 any
 #deny ip 172.16.0.0 0.15.255.255 any
 #deny ip 192.168.0.0 0.0.255.255 any
 !---Anti-spoofing entries for my addresses as source
 #deny ip y.y.y.y 0.0.0.3 any
 #deny ip z.z.z.z 0.0.0.3 any
 #deny ip dmz1-address dmz1-wildcard mask any
 #deny ip dmz2-address dmz2-wildcard mask any
 !---Deny access to infrastructure addresses (router interface and point-to-point links)
 #deny ip any host x.x.x.x
 #deny ip any y.y.y.y 0.0.0.3
 #deny ip any z.z.z.z 0.0.0.3
 !---Permit transit traffic
 #permit ip any any

And applied ACL on to interface toward ISP router:

#interface ge 0/0
 #ip access-group OUTSIDE in

Did I miss something? Or did I put something too much?

4
  • 1
    re: deny ip any z.z.z.z 0.0.0.3 fragments, you probably don't want to restrict this to merely your /30 uplink... just use deny ip any any fragments Jul 10, 2018 at 13:27
  • you might want to put a password on your vty and aux lines, even though you don't use them. Make it long.
    – Ron Trunk
    Jul 10, 2018 at 14:45
  • Ron, but if there is no password configured on aux and vty lines, connections will be refused? Why is it better to configure the password?
    – John
    Jul 16, 2018 at 8:21
  • Is it smart to have " #deny ip any any option any-options " enabled? Is there some legitimate traffic that use IP options? Or should I use selective drop?
    – John
    Jul 16, 2018 at 8:26

1 Answer 1

2

Best Cisco ASA FW Security Practice is to Block Everything and Selectively Allow...

Also- Management Only Tracffic should not be used for or mixed with Normal Network Traffic; keep these Port Connections & Traffic Separated. This way if you get a security brach and you are not able to access the FW, you will still be able to access the Management Port and regain control.

Hope this helps...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.