0

I'm trying to build a decent base configuration and I'm just a little curious if features like IPS and SPI need to be setup explicitly? This network isn't going to be integrated in with our users, but I'm still looking to try to prevent access from anyone on the outside. If someone could discuss their approach to a basic security configuration, it would be most appreciated.

!
hostname xxxxxxx
!
!
!
enable password secret xxxxxxxx
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool LAN
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 8.8.8.8
!
!
!
username xxxxx privilege 15 password 0 xxxxxxxxxxx
!
!
!
!
!
ip ssh version 1
ip domain-name cisco.com
ip name-server 192.168.1.2
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
 description ISP connection
 ip address xxx.xxx.xxx.xxx 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface FastEthernet0/1/0
 switchport mode access
 spanning-tree portfast
!
interface FastEthernet0/1/1
 switchport mode access
 spanning-tree portfast
!
interface FastEthernet0/1/2
 switchport mode access
 spanning-tree portfast
!
interface FastEthernet0/1/3
 switchport mode access
 spanning-tree portfast
!
interface Vlan1
 ip address 192.168.1.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
!
!
!
banner motd ^CThis router is private property and may not be accessed without permission of the owner^C
!
!
!
!
line con 0
 exec-timeout 0 0
 password xxxxxxxx
 logging synchronous
 login local
line vty 0 4
 exec-timeout 0 0
 password xxxxxxx
 logging synchronous
 login local
line vty 5 15
 exec-timeout 0 0
 password xxxxxxxxxxx
 logging synchronous
 login local
!
!
!
end
1

There is no IPS, ACL, etc. by default.

By looking at your config, everyone from ISP interface f0/0 could reach vlan 1 if proper routing is configured. Anyway, because you don't perform any NAT, if f0/0 is connected to an ISP directly, your traffic from Vlan1 will be dropped because of the private IP addressing.

Security can't be explained in a short column, you're missing too many things (SSH v2, avoid use of native VLAN, etc.), and also out of the security field your name server setting seems inconsistent and there is no NAT (as stated before).

A good fast reading is http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_autosecure.html , about the autosecure feature that might automagically set up your router. CBAC (SPI) with "ip ips" (IPS) are the technology you'll need to delve into.

1
  • Thanks for taking the time to post. The configuration has changed over the past few days to include SSH 2, auto secure and to have NAT setup. I like your idea of changing from the native VLAN and I'll be integrating it into what I do. – ParanoidPenguin Aug 25 '15 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.