cisco安全培训 PPT

No service udp-small-servers
Disabled
TECSEC-2101 12644_04_2006_c1
© 2006 Cisco Systems, Inc. All rights reserved.
Cisco Biblioteka ublic5Disable Unneeded Services
Command
Impact
12.4M Default
No service finger
No ip bootp server No service dhcp
Reconnaissance
Reconnaissance or DoS Reconnaissance or DoS Reconnaissance or Gain Access Reconnaissance
Cisco Public
4
Disable Unneeded Services
Command
Impact
12.4M Default
No service config No boot network No cdp run No service pad No service tcp-small-servers
• Before you connect a new router to the network, you should ―harden‖ the configuration
TECSEC-2101 12644_04_2006_c1 © 2006 Cisco Systems, Inc. All rights reserved.
Protecting the Core: Detecting and Mitigating Attacks Using Your Infrastructure
TECSEC-2101 12644_04_2006_c1
© 2006 Cisco Systems, Inc. All rights reserved.
Many services switched on to make getting started easier
• Once a router has an IP address, it is accessible to the outside world
Campus LAN
Company LAN/WAN Internet
Cisco Public
6
Disable Unneeded Services
Command Impact 12.4M Default
No ip source-route No ip proxy-arp
DoS DoS
Enabled Enabled
No ip directed-broadcast
No ip unreachables No ip mask-reply No ip information-reply No ip redirects No ip identd
From external time source Upstream ISP, Internet, GPS, atomic clock
From internal time source
Router can act as stratum 1 time source
ntp source loopback0
• CPU threshold notification—12.0(26)S, 12.3(4)T
Generates an SNMP trap message when a predefined threshold of CPU usage is crossed /en/US/products/sw/iosswrel/ps5207/prod ucts_white_paper09186a00801cd87d.shtml
DoS
Reconnaissance Reconnaissance Reconnaissance Reconnaissance Reconnaissance
Disabled
Enabled Disabled Disabled Enabled Disabled
TECSEC-2101 12644_04_2006_c1
© 2006 Cisco Systems, Inc. All rights reserved.
Cisco Public
7
What Ports Are Open on the Router?
• It may be useful to see what sockets/ports are open on the router • Show ip sockets—show some of the UDP ports opened
Disabled
Enabled Enabled
Disabled
(Enabled on SDM Routers) Enabled
No ip http server
No ip domain lookup
TECSEC-2101 12644_04_2006_c1
© 2006 Cisco Systems, Inc. All rights reserved.
TECSEC-2101 12644_04_2006_c1 © 2006 Cisco Systems, Inc. All rights reserved.
Cisco Public
9
Network Time Protocol
• Synchronize time across all devices • When security event occurs, data must have consistent timestamps
GSR-1#show tcp tcb 537D0944 Connection state is LISTEN, I/O status: 1, unread input bytes: 0 Connection is ECN Disabled Local host: UNKNOWN, Local port: 179 Foreign host: 60.20.1.1, Foreign port: 0 ... Datagrams (max data segment is 516 bytes): Rcvd: 5 (out of order: 0), with data: 0, total data bytes: 0 Sent: 0 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 0, total data bytes: 0
Cisco Public
8
What Ports Are Open on the Router?
Two Steps Required for TCP Ports:
• show tcp brief all • show tcp tcb < TCB address >
GSR-1#show tcp brief all TCB Local Address 52F6D218 60.20.1.2.11002 52F7065C 50.20.1.1.179 52F6CD8C *.* 537D0944 *.179 537CE2C4 *.179 Foreign Address 60.20.1.1.179 50.20.1.2.11007 *.* 60.20.1.1.* 50.20.1.2.* (state) ESTAB ESTAB LISTEN LISTEN LISTEN
ntp server 10.1.1.1 source loopback0
TECSEC-2101 12644_04_2006_c1
© 2006 Cisco Systems, Inc. All rights reserved.
Cisco Public
10
CPU and Memory Threshold Notification
TECSEC-2101 12644_04_2006_c1 © 2006 Cisco Systems, Inc. All rights reserved.
Cisco Public
3
Router Security
• Routers as shipped from the factory have:
Default configuration
IOSRouter#show ip sockets Proto Remote Port 17 192.190.224.195 162 17 --listen-17 0.0.0.0 123 17 0.0.0.0
Local 204.178.123.178 204.178.123.178 204.178.123.178
Reconnaissance or Gain Access Reconnaissance Reconnaissance Gain Access
Disabled Disabled Enabled Enabled Disabled
Reconnaissance or DoS
Reconnaissance or DoS
• Memory threshold notification
Available in 12.0(26)S and 12.2(18)S If available free processor or I/O memory falls below the specified thresholds, the router will log an event; network operations staff can investigate, and if necessary take action, before router performance is impacted or free memory becomes so low that the router is in danger of crashing /en/US/products/sw/iosswrel/ps1838/prod ucts_feature_guide09186a00801b1bee.html