Border Router Security Settings Notes
R1 (conf) # no cdp run # shuts down the CDP protocol on the border router to prevent illegal users from detecting the internal network through CDP
R1 (conf) # no service tcp-small-service # echo 17; chargen 19; daytime 13
R1 (conf) # no service udp-small-service # shuts down low port services, such as preventing * from sending traffic to chargen service ports, consuming CPU resources, and preventing DoS***.
R1 (conf) # no ip finger # shuts down FINGER to prevent * users logging in via finger to check the router
R1 (conf) # no ip identd # identD allows remote devices to query a TCP port for identification purposes, port number is 113
R1 (conf) # no ip source-route # closes the IP source path to prevent * * from bypassing the firewall by using IP source route selection
R1 (conf) # no ftp-server enable # turns off the FTP-SERVER function to prevent the establishment of a FTP server on the router
R1 (conf) # no ip bootp server # prevents * * from starting as Boot through the router
R1 (conf) # no service pad # PAD (packet assembler/disassemble) for X.25 network
R1 (conf) # no boot network # forbids starting as TFTP through the router
R1 (conf) # no service config # turn off server settings
R1 (conf) # no ip proxy-arp # there is a case in which the ARP agent should not be turned off: when the router side remotely accesses the IPSec × × connection, the local device has to go through the × × × remote defense client, and the router responds to the arp request from the local device. In this case, the APR agent function should be turned on.
R1 (conf) # no ip directed-broadcast # Dos*** uses broadcast direction to flood specific networks or subnets *
R1 (conf) # no ip unreachable # * * uses DoS*** to cause the router to generate ICMP unreachable messages
R1 (conf) # no ip redirect # * * may use the ip redirection method to make the route generate a loop route, resulting in a network paralysis.
R1 (conf) # no ip mask-reply # uses the subnet message request function to * broadcast DoS*** subnets directionally
-
ACL parameter description:
Precedence: filter specific priority levels, ranging from 0 to 7. IP packet headers usually classify traffic for quality of service (Quality of Service, Qos) and queue purposes.
Dscp: filter the differentiated Services Code (Differentiated Services Code Point,DSCP) value in the IP packet header to filter
Tos: filter the service type domain in the IP packet header for QoS implementation
Log: used to record control bars, internal caches or system logs, including TCP, UDP or ICMP, source port number and destination port number, etc.
Log-input: the recorded information includes the input interface of the received packet and the layer 2 source address in the packet
ACL example:
Access-list 100 permit tcp any host 200.1.1.2 eq 25 # any traffic can send E-mail traffic to 200.1.1.2
Access-list 100 permit tcp any eq 25 host 200.1.1.2 established # internal E-mail server sends mail to an external server and receives a reply. Established is the TCP traffic sent by the user will be allowed to return, but this parameter will create a loophole on the border router, that is, * it can be modified and carried out by using the TCP tag bits such as ACK\ FIN\ PSH\ RST\ SYS of the returned data.
Using ip accounting access-violations to do IP statistics under the interface
-
Use PAM and ACL to restrict CBAC review
R1 (config) # ip port-map http port 8080 list 1
R1 (config) # access-list permit 192.168.100.2
R1 (config) # ip port-map http port 8090 list 2
R1 (config) # access-list permit 192.168.100.3
-
Use ACL to deal with TCP SYN floods
R1 (config) # ip access-list extended tcp-syn-flood
R1 (config-ext-nacl) # permit tcp any 200.1.1.0 0.0.0.255 establised
R1 (config-ext-nacl) # permit tcp any host 200.1.1.11 eq 25
R1 (config-ext-acl) # deny ip any any
R1 (config) # interface g0bin1
R1 (config-if) # ip access-group tcp-syn-flood in
This example ACL cannot prevent the E-mail server TCP SYN flood, which should be reviewed in conjunction with CBAC.
-
* Dos***,Fraggle that uses ACL to block Smurf and Fraggle,Smurf for icmp echo (echo) uses UDP echo *
R1 (config) # ip access-list extended Smurf-fraggle
R1 (config-ext-nacl) # deny icmp any any echo
R1 (config-ext-nacl) # deny icmp any any echo-reply
R1 (config-ext-nacl) # deny udp any any echo
R1 (config-ext-nacl) # deny udp any any echo-reply
R1 (config-ext-acl) # deny ip any any
R1 (config) # interface g0bin1
R1 (config-if) # ip access-group Smurf-fraggle in
R1 (config-if) # ip access-group Smurf-fraggle out
-
Filter icmp, traceroute, RPC, SQL
R1 (config) # ip access-list extended ICMP-IN-OUT
R1 (config-ext-nacl) # deny icmp any any echo
R1 (config-ext-nacl) # deny icmp any any redirect
R1 (config-ext-nacl) # deny icmp any any mask-request
R1 (config-ext-nacl) # permit icmp any host 200.1.1.5 echo-reply
R1 (config-ext-nacl) # deny icmp any any echo-reply
R1 (config-ext-nacl) # permit icmp any 200.1.1.0 0.0.0.255
R1 (config-ext-nacl) # deny udp any any range 32400 34400 # filter Traceroute
R1 (config-ext-nacl) # deny tcp any any eq 514 # filter RPC
R1 (config-ext-nacl) # deny udp any any eq 1434 # filter SQL
R1 (config-ext-nacl) # deny tcp any any eq 1433 # filter SQL
R1 (config-ext-nacl) # deny tcp any any eq 445 # filter SMB
R1 (config-ext-acl) # deny ip any any
R1 (config) # interface g0bin1
R1 (config-if) # ip access-group CMP-IN-OUT in
R1 (config-if) # ip access-group CMP-IN-OUT out
-
Filter Trinoo
R1 (config) # ip access-list extended trinoo
R1 (config-ext-nacl) # deny tcp any any eq 1524
R1 (config-ext-nacl) # deny tcp any any eq 1524
R1 (config-ext-nacl) # deny udp any any eq 1524
R1 (config-ext-nacl) # deny tcp any any eq 27665
R1 (config-ext-nacl) # deny tcp any any eq 27665
R1 (config-ext-nacl) # deny tcp any any eq 31335
R1 (config-ext-nacl) # deny tcp any any eq 31335
R1 (config-ext-acl) # deny ip any any
R1 (config) # interface g0bin1
R1 (config-if) # ip access-group trinoo in
R1 (config-if) # ip access-group trinoo out
-
Filter DCOM connections and * take advantage of defects in Microsoft's RPC code. Microsoft found a vulnerability in the distributed object module (Distributed Component Object Module,DCOM). The port used by DCOM is 135139 445
R1 (config) # ip access-list extended Deny_RPC
R1 (config-ext-nacl) # deny tcp any any eq 135
R1 (config-ext-nacl) # deny udp any any eq 135
R1 (config-ext-nacl) # deny tcp any any eq 139
R1 (config-ext-nacl) # deny udp any any eq 139
R1 (config-ext-nacl) # deny tcp any any eq 445
R1 (config-ext-nacl) # deny udp any any eq 445
R1 (config-ext-nacl) # deny udp any any eq 593
R1 (config-ext-nacl) # deny udp any any eq 4444
R1 (config-ext-nacl) # permit ip any any
R1 (config) # interface g0bin1
R1 (config-if) # ip access-group Deny_RPC in
-
Use CBAC to block DoS***
R1 (config) # ip inspect tcp synwait-time 20
R1 (config) # ip inspect tcp idle-time 60
R1 (config) # ip inspect udp idle-time 20
R1 (config) # ip inspect max-incomplete high 400
R1 (config) # ip inspect max-incomplete low 300
R1 (config) # ip inspect one-minute high 600
R1 (config) # ip inspect one-minute low 500
R1 (config) # ip inspect tcp max-incomplete host 300 block-time 0
Set up a simple audit configuration for CBAC
R1 (config) # ip access-list extended extended_acl
R1 (config-ext-nacl) # deny tcp any any log
R1 (config-ext-nacl) # deny udp any any log
R1 (config-ext-nacl) # deny icmp any any log
R1 (config-ext-nacl) # permit ip any any
R1 (config) # ip inspect name cbac-example tcp
R1 (config) # ip inspect name cbac-example udp
R1 (config) # ip inspect name cbac-example icmp
R1 (config) # interface g0bin1
R1 (config-if) # ip access-group extended_acl
R1 (config-if) # ipinspect cbac-example in
-
Use CBAC to block DoS***
R1 (config) # ip inspect tcp synwait-time 20
R1 (config) # ip inspect tcp idle-time 60
R1 (config) # ip inspect udp idle-time 20
R1 (config) # ip inspect max-incomplete high 400
R1 (config) # ip inspect max-incomplete low 300
R1 (config) # ip inspect one-minute high 600
R1 (config) # ip inspect one-minute low 500
R1 (config) # ip inspect tcp max-incomplete host 300 block-time 0
-
Use TCP to intercept servers inside the reserve.
R1 (config) # access-list 100 tcp permit tcp any host 192.168.1.1 eq 80
R1 (config) # access-list 100 tcp permit tcp any host 192.168.1.2 eq25
R1 (config) # ip tcp intercept list 100
R1 (config) # ip tcp intercept mode watch
R1 (config) # ip tcp intercept watch-timeout 20
R1 (config) # ip tcp intercept connection-time 120
R1 (config) # ip tcp intercept max-incomplete high 600
R1 (config) # ip tcp intercept min-incomplete low 500
R1 (config) # ip tcp intercept one-minute high 800
R1 (config) # ip tcp intercept one-minute low 600
