5

I need confirmation that I understood the Cisco manual right. So my network is like this:

ISP_RTR ---x.x.x.x/30--- Perimeter/Edge_RTR ---y.y.y.y/30--- FW1 --- DMZ1
                                            ---z.z.z.z/30--- FW2 --- DMZ2

Networks x.x.x.x/30, y.y.y.y/30, z.z.z.z/30, DMZ1 and DMZ2 are all with public IP addresses.

On my Perimeter/Edge router I need only console access.

So I configured commands:

#enable secret password
#service password-encryption
#no service tcp-small-servers
#no service udp-small-servers
#no ip finger
#no ip bootp server
#ip dhcp bootp ignore
#no service dhcp
#no ip domain-lookup
#no service pad
#no service config
#no cdp run
#no lldp run
#service tcp-keepalives-in
#service tcp-keepalives-out
#exception crashinfo maximum files 10
#no ip http server
#no ip http secure-server
#line aux 0
 #transport input none
 #transport output none
 #no exec
 #exec-timeout 0 1
 #no password
#line console 0
 #transport output none
#line vty 0 97
 #transport input none
 #transport output none
 #no exec
 #exec-timeout 0 1
 #no password
 #login

Commands that my IOS didn't have were:

#no mop enabled
#memory reserve console 4096
#exception memory ignore overflow io
#exception memory ignore overflow processor
#no vstack

I also buid ACL that should protect the router.

#ip access-list extended OUTSIDE
 !---Deny fragments to the infrastructure block
 #deny tcp any host x.x.x.x fragments
 #deny udp any host x.x.x.x fragments
 #deny icmp any host x.x.x.x fragments
 #deny ip any host x.x.x.x fragments
 #deny tcp any y.y.y.y 0.0.0.3 fragments
 #deny udp any y.y.y.y 0.0.0.3 fragments
 #deny icmp any y.y.y.y 0.0.0.3 fragments
 #deny ip any y.y.y.y 0.0.0.3 fragments
 #deny tcp any z.z.z.z 0.0.0.3 fragments
 #deny udp any z.z.z.z 0.0.0.3 fragments
 #deny icmp any z.z.z.z 0.0.0.3 fragments
 #deny ip any z.z.z.z 0.0.0.3 fragments
 !---Deny ip options
 #deny ip any any option any-options
 !---Deny/filter TTL value
 #deny ip any any ttl lt 5
 !---Anti-spoofing entries for RFC3330
 #deny ip host 0.0.0.0 any
 #deny ip 0.0.0.0 0.255.255.255 any
 #deny ip 14.0.0.0 0.255.255.255 any
 #deny ip 24.0.0.0 0.255.255.255 any
 #deny ip 39.0.0.0 0.255.255.255 any
 #deny ip 127.0.0.0 0.255.255.255 any
 #deny ip 128.0.0.0 0.0.255.255 any
 #deny ip 169.254.0.0 0.0.255.255 any
 #deny ip 191.255.0.0 0.0.255.255 any
 #deny ip 192.0.0.0 0.0.0.255 any
 #deny ip 192.0.2.0 0.0.0.255 any
 #deny ip 192.88.99.0 0.0.0.255 any
 #deny ip 198.18.0.0 0.1.255.255 any
 #deny ip 223.255.255.0 0.0.0.255 any
 #deny ip 224.0.0.0 15.255.255.255 any
 #deny ip 240.0.0.0 15.255.255.255 any
 !---Anti-spoofing entries for RFC1918
 #deny ip 10.0.0.0 0.255.255.255 any
 #deny ip 172.16.0.0 0.15.255.255 any
 #deny ip 192.168.0.0 0.0.255.255 any
 !---Anti-spoofing entries for my addresses as source
 #deny ip y.y.y.y 0.0.0.3 any
 #deny ip z.z.z.z 0.0.0.3 any
 #deny ip dmz1-address dmz1-wildcard mask any
 #deny ip dmz2-address dmz2-wildcard mask any
 !---Deny access to infrastructure addresses (router interface and point-to-point links)
 #deny ip any host x.x.x.x
 #deny ip any y.y.y.y 0.0.0.3
 #deny ip any z.z.z.z 0.0.0.3
 !---Permit transit traffic
 #permit ip any any

And applied ACL on to interface toward ISP router:

#interface ge 0/0
 #ip access-group OUTSIDE in

Did I miss something? Or did I put something too much?

  • 1
    re: deny ip any z.z.z.z 0.0.0.3 fragments, you probably don't want to restrict this to merely your /30 uplink... just use deny ip any any fragments – Mike Pennington Jul 10 '18 at 13:27
  • you might want to put a password on your vty and aux lines, even though you don't use them. Make it long. – Ron Trunk Jul 10 '18 at 14:45
  • Ron, but if there is no password configured on aux and vty lines, connections will be refused? Why is it better to configure the password? – John Jul 16 '18 at 8:21
  • Is it smart to have " #deny ip any any option any-options " enabled? Is there some legitimate traffic that use IP options? Or should I use selective drop? – John Jul 16 '18 at 8:26
0

Typically I do not restrict any device to only console access, I would build a management VRF instead and allow connections only on that port. Regardless if you have a console server, it is always more intelligent to have more than 1 way in without having to physically plug into the router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.