2

Bought a Cisco 1921 router without any additional modules. This is the first time I'm using a non-home router. What security features should I enable so that users are relatively safe when using the internet.

"Relatively safe" meaning the same level of default protection you get from a home router such as a Linksys.

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 8, 2017 at 9:22

4 Answers 4

Reset to default
3

The most basic license (read: cheapest) has only basic IP level functions. It'll do NAT and you can setup ACLs (filters), but there's no "firewall" or "IPS/IDS" (intrusion detection.) It this regard, it's the same as a $50 Linksys: you are "protected" by NAT. (which isn't real security)

Improve this answer
0
2

Security in normal routers is minimal:

  • no NAT
  • flood protection (not all routers)

You could implement ACL's to determine the allowed ports but this isn't the holy grail.

doesn't cover:

  • intrusion prevention systems (ips)
  • intrusion detection systems (ids)
  • DDOS protection
  • proxy
  • ...

and many more.

Improve this answer
2

You don't state if you have public or private addresses.

Specifically 'same level of protection' as typical home user is NAPT, i.e. inbound connections are not possible unless equivalent outbound exists.

If you have private addresses you've already configured NAPT if the connection works, and you have equivalent security.

If you have public addresses you'd need to configure stateful firewall to get same level of security

ip inspect name DEFAULT udp
ip inspect name DEFAULT tcp
ip inspect name DEFAULT icmp
int WAN
  ip access-group DEFAULT in
  ip inspect DEFAULT out
!
ip access-list extended DEFAULT
  deny ip any any
!

Could work as a starting point. If you need to open up something inbound, add it to DEFAULT ACL, e.g. if you want to allow ssh in from world to given PC at home

ip access-list extended DEFAULT
  permit tcp any host MY_SERVER eq 22
  deny ip any any
Improve this answer
1
  • 2
    inspect is CBAC, and it requires Security license on the box. You can check if you have it using 'sh license' and activate it for the trial period as RTU solution. When you do it, you have whole set of things to configure including stateful inspection (CBAC or ZBFW, use ZBFW as it's more flexible and has L4-L7 protection capabilities).
    – Łukasz Bromirski
    May 22, 2013 at 22:03
1

this is still a good guideline for securing Cisco equipment http://www.cisco.com/en/US/docs/ios/security/configuration/guide/12_4/sec_12_4_book.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.