WEBVTT

1
00:00.000 --> 00:00.660 align:middle line:84%


2
00:00.660 --> 00:03.270 align:middle line:90%
In this video, we're going to
leverage the Cisco iOS guide

3
00:03.270 --> 00:05.850 align:middle line:90%
for hardening Cisco
IOS devices as we

4
00:05.850 --> 00:09.300 align:middle line:90%
focus on the management plane
for Cisco routers and switches

5
00:09.300 --> 00:10.133 align:middle line:84%
running IOS.

6
00:10.133 --> 00:11.550 align:middle line:90%
And once again,
we're going to use

7
00:11.550 --> 00:13.967 align:middle line:90%
this terrific document, the
Cisco Guide to Hardening Cisco

8
00:13.967 --> 00:15.310 align:middle line:84%
IOS devices.

9
00:15.310 --> 00:17.490 align:middle line:90%
And if we scroll down,
we have a section just

10
00:17.490 --> 00:19.740 align:middle line:90%
for the features that
we can incorporate

11
00:19.740 --> 00:23.543 align:middle line:90%
regarding the management plane
for hardening those devices.

12
00:23.543 --> 00:25.710 align:middle line:90%
So let's go ahead and take
a look at a few of these.

13
00:25.710 --> 00:27.870 align:middle line:90%
Also, if you scroll
down, for each of these,

14
00:27.870 --> 00:30.450 align:middle line:90%
it has details on
implementing those solutions
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:27.870 --> 00:30.450 align:middle line:90%
it has details on
implementing those solutions

15
00:30.450 --> 00:32.020 align:middle line:84%
for hardening the devices.

16
00:32.020 --> 00:33.780 align:middle line:90%
So let's talk about
password management.

17
00:33.780 --> 00:35.442 align:middle line:90%
The goal there would
be to use TACACS.

18
00:35.442 --> 00:37.650 align:middle line:90%
And because we're talking
about the management plane,

19
00:37.650 --> 00:39.233 align:middle line:90%
we're talking about
management traffic

20
00:39.233 --> 00:41.160 align:middle line:90%
from our secure
management stations

21
00:41.160 --> 00:43.620 align:middle line:90%
or our computers
as administrators

22
00:43.620 --> 00:45.570 align:middle line:84%
to the network devices.

23
00:45.570 --> 00:47.180 align:middle line:90%
And so ideally,
we'll have TACACS.

24
00:47.180 --> 00:49.710 align:middle line:90%
And hopefully, we'll have a
redundant TACACS server using

25
00:49.710 --> 00:52.320 align:middle line:90%
triple A, so if we can't
reach the first TACACS server,

26
00:52.320 --> 00:53.820 align:middle line:84%
we'll reach the second one.

27
00:53.820 --> 00:55.740 align:middle line:90%
And then, as a
third method, we'd

28
00:55.740 --> 00:58.050 align:middle line:90%
also probably want to
have a local user account

29
00:58.050 --> 00:59.958 align:middle line:84%
with privilege level 15 access.

30
00:59.958 --> 01:01.750 align:middle line:90%
And when we create that
local user account,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
00:59.958 --> 01:01.750 align:middle line:90%
And when we create that
local user account,

31
01:01.750 --> 01:03.570 align:middle line:90%
this would be in the case that
our TACACS servers are not

32
01:03.570 --> 01:05.340 align:middle line:90%
reachable, that
local user should

33
01:05.340 --> 01:07.290 align:middle line:84%
have a very secure password.

34
01:07.290 --> 01:08.970 align:middle line:90%
I mean, not just
upper and lower case,

35
01:08.970 --> 01:10.387 align:middle line:90%
alphanumeric, all
that good stuff,

36
01:10.387 --> 01:13.505 align:middle line:90%
but it should also be
stored very, very securely.

37
01:13.505 --> 01:15.630 align:middle line:90%
And as an example, when we
create the user account,

38
01:15.630 --> 01:17.790 align:middle line:90%
we'd go into configuration
mode, username.

39
01:17.790 --> 01:21.450 align:middle line:90%
We'll call this
admin1, and we'll

40
01:21.450 --> 01:23.730 align:middle line:84%
give him privilege level 15.

41
01:23.730 --> 01:26.880 align:middle line:90%
And then right here, instead
of specifying password,

42
01:26.880 --> 01:29.430 align:middle line:90%
which would be a really bad
idea, that's a type 7 password,

43
01:29.430 --> 01:31.050 align:middle line:90%
we would use the
keyword secret, which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:29.430 --> 01:31.050 align:middle line:90%
we would use the
keyword secret, which

44
01:31.050 --> 01:33.070 align:middle line:84%
gives us a type 5 password.

45
01:33.070 --> 01:36.240 align:middle line:90%
However, there is another really
cool option, and that's this.

46
01:36.240 --> 01:39.500 align:middle line:90%
If we type in algorithm-type
and then do a question mark

47
01:39.500 --> 01:42.120 align:middle line:90%
and specify scrypt, now if
we put a password here--

48
01:42.120 --> 01:45.552 align:middle line:84%
let's use a secret of Cisco123.

49
01:45.552 --> 01:47.760 align:middle line:90%
Actually, I'm going to put
an exclamation mark there,

50
01:47.760 --> 01:50.100 align:middle line:84%
[LAUGHS] and press Enter.

51
01:50.100 --> 01:52.770 align:middle line:90%
Now, if we do a show
run-- and let's do a pipe

52
01:52.770 --> 01:57.450 align:middle line:90%
and include username, we have
some really great encryption

53
01:57.450 --> 01:58.680 align:middle line:84%
storing our password.

54
01:58.680 --> 02:00.080 align:middle line:84%
And that is a type 0.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:58.680 --> 02:00.080 align:middle line:84%
And that is a type 0.

55
02:00.080 --> 02:02.370 align:middle line:84%
So type 7 is a bad idea.

56
02:02.370 --> 02:05.460 align:middle line:90%
Type 5 is preferable
over the type 7.

57
02:05.460 --> 02:09.000 align:middle line:90%
And type 9 what we want to
do if our IOS supports it.

58
02:09.000 --> 02:10.919 align:middle line:90%
Also, we're getting
password security.

59
02:10.919 --> 02:13.245 align:middle line:90%
We definitely don't want
to use the enable password.

60
02:13.245 --> 02:14.620 align:middle line:90%
We want to use
the enable secret.

61
02:14.620 --> 02:17.730 align:middle line:90%
And we want to avoid and not use
type 7 or plain text passwords

62
02:17.730 --> 02:19.920 align:middle line:90%
even worse anywhere
in our config.

63
02:19.920 --> 02:23.010 align:middle line:90%
The Login Password Retry
Timeout is another great option.

64
02:23.010 --> 02:24.750 align:middle line:90%
I mean, how many
times do you want

65
02:24.750 --> 02:26.520 align:middle line:90%
to allow an attacker
to do a brute force

66
02:26.520 --> 02:28.660 align:middle line:84%
attack on your system?

67
02:28.660 --> 02:29.450 align:middle line:84%
1,000 times?

68
02:29.450 --> 02:31.030 align:middle line:84%
10,000 times?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:29.450 --> 02:31.030 align:middle line:84%
10,000 times?

69
02:31.030 --> 02:33.330 align:middle line:90%
So basically, the Login
Password Retry Lockout

70
02:33.330 --> 02:35.430 align:middle line:90%
is going to say, OK,
here's the threshold.

71
02:35.430 --> 02:37.050 align:middle line:90%
Once that threshold
has been exceeded,

72
02:37.050 --> 02:38.310 align:middle line:90%
that account is going
to be locked out.

73
02:38.310 --> 02:40.020 align:middle line:90%
And that can help against
a brute force attack.

74
02:40.020 --> 02:42.312 align:middle line:90%
Now, if you do this feature,
if somebody, like the user

75
02:42.312 --> 02:44.820 align:middle line:90%
we just created, has a
privilege level of 15,

76
02:44.820 --> 02:47.280 align:middle line:90%
it doesn't apply to
privilege level 15 accounts.

77
02:47.280 --> 02:49.320 align:middle line:90%
And that way, the attacker
can't block you out

78
02:49.320 --> 02:51.540 align:middle line:90%
as an administrator,
so the password lockout

79
02:51.540 --> 02:53.905 align:middle line:90%
doesn't apply to a
privilege level 15 account.

80
02:53.905 --> 02:56.280 align:middle line:90%
If you're in an environment
where you don't want password

81
02:56.280 --> 02:58.710 align:middle line:90%
recovery capabilities,
you can turn off

82
02:58.710 --> 03:00.570 align:middle line:90%
that feature, which
is good for security,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
02:58.710 --> 03:00.570 align:middle line:90%
that feature, which
is good for security,

83
03:00.570 --> 03:01.560 align:middle line:84%
but it's also a hassle.

84
03:01.560 --> 03:03.750 align:middle line:90%
In the event you need to
do your password recovery,

85
03:03.750 --> 03:06.208 align:middle line:90%
you have to go through a lot
more work to get the system up

86
03:06.208 --> 03:08.928 align:middle line:90%
and running because the password
recovery feature is disabled.

87
03:08.928 --> 03:10.470 align:middle line:90%
If you have services
or features that

88
03:10.470 --> 03:13.110 align:middle line:90%
are running on your system,
you want to turn those off.

89
03:13.110 --> 03:14.470 align:middle line:84%
Don't leave those open.

90
03:14.470 --> 03:17.490 align:middle line:90%
So on this IOS router,
if we did a show control

91
03:17.490 --> 03:21.250 align:middle line:90%
plane, post, open ports, it's
going to show us the open port.

92
03:21.250 --> 03:23.880 align:middle line:90%
So right now--
[LAUGHS] oh, not good.

93
03:23.880 --> 03:26.380 align:middle line:90%
So telnet is available and
listening on this server.

94
03:26.380 --> 03:27.700 align:middle line:84%
And that's not a great idea.

95
03:27.700 --> 03:33.870 align:middle line:90%
So if we did a conf t, line,
vty 0 through 4, and said,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:27.700 --> 03:33.870 align:middle line:90%
So if we did a conf t, line,
vty 0 through 4, and said,

96
03:33.870 --> 03:38.070 align:middle line:84%
transport input SSH--

97
03:38.070 --> 03:44.370 align:middle line:90%
and then, let's also go
to ip http secure server.

98
03:44.370 --> 03:45.870 align:middle line:90%
They will generate
some keys for us.

99
03:45.870 --> 03:48.200 align:middle line:84%
It'll open up TCP 443.

100
03:48.200 --> 03:53.290 align:middle line:90%
And let's do a show, control
plane, host, open ports.

101
03:53.290 --> 03:55.710 align:middle line:90%
So here, I have 22
that's open and 443--

102
03:55.710 --> 03:57.300 align:middle line:90%
looks like, wow,
still have 23 open.

103
03:57.300 --> 04:01.095 align:middle line:90%
Let's take a look--
show run sec line.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:57.300 --> 04:01.095 align:middle line:90%
Let's take a look--
show run sec line.

104
04:01.095 --> 04:02.470 align:middle line:90%
Huh, what do you
know about that?

105
04:02.470 --> 04:06.120 align:middle line:90%
[LAUGHS] So even though the
transport input SSH is there,

106
04:06.120 --> 04:07.985 align:middle line:84%
it still has 23 open--

107
04:07.985 --> 04:09.360 align:middle line:90%
so that way, you
can open a port,

108
04:09.360 --> 04:11.340 align:middle line:90%
but no one's going to
be able to connect on it

109
04:11.340 --> 04:14.070 align:middle line:90%
because we're not
allowing telnet inbound.

110
04:14.070 --> 04:16.380 align:middle line:90%
So we can verify that with
a show IP interface brief,

111
04:16.380 --> 04:19.660 align:middle line:84%
and if I telnet to myself--

112
04:19.660 --> 04:20.700 align:middle line:84%
yep, connection refused.

113
04:20.700 --> 04:22.650 align:middle line:90%
However, based on
this output here,

114
04:22.650 --> 04:24.240 align:middle line:84%
it's still a listening port.

115
04:24.240 --> 04:27.150 align:middle line:90%
The key is, if we have unused
services or unused ports,

116
04:27.150 --> 04:29.068 align:middle line:90%
we want to disable
them when possible.

117
04:29.068 --> 04:31.110 align:middle line:90%
Another option for hardening
the management plane
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
04:29.068 --> 04:31.110 align:middle line:90%
Another option for hardening
the management plane

118
04:31.110 --> 04:32.520 align:middle line:84%
would be the exec timeout.

119
04:32.520 --> 04:35.580 align:middle line:90%
So if we want our TCP
session, like our SSH session,

120
04:35.580 --> 04:38.970 align:middle line:90%
to timeout after 5 minutes or 10
minutes, that's not a bad idea.

121
04:38.970 --> 04:41.250 align:middle line:90%
Because if it times out,
then a re-login game

122
04:41.250 --> 04:44.130 align:middle line:90%
will be required, as opposed
to having a session that never

123
04:44.130 --> 04:46.980 align:middle line:90%
times out or it doesn't
timeout for hours,

124
04:46.980 --> 04:48.630 align:middle line:90%
there's more
opportunity for somebody

125
04:48.630 --> 04:50.880 align:middle line:90%
to actually see or console
or get to your computer,

126
04:50.880 --> 04:52.630 align:middle line:90%
if you don't leave it
locked, and actually

127
04:52.630 --> 04:53.665 align:middle line:84%
pick up on that session.

128
04:53.665 --> 04:56.040 align:middle line:90%
And again, I'm just going to
do some cherry picking here.

129
04:56.040 --> 04:58.320 align:middle line:90%
Management Interface
Use-- it's a great idea.

130
04:58.320 --> 04:59.862 align:middle line:90%
Like on the router
we just looked at,

131
04:59.862 --> 05:02.180 align:middle line:90%
it has a loopback
address of 1.1.1.1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:59.862 --> 05:02.180 align:middle line:90%
it has a loopback
address of 1.1.1.1.

132
05:02.180 --> 05:05.122 align:middle line:90%
And if we specify that
IP address on a loopback

133
05:05.122 --> 05:07.580 align:middle line:90%
and we have reachability, if
this is the router-- router 1,

134
05:07.580 --> 05:10.820 align:middle line:90%
and it's got multiple paths,
even if a physical interface

135
05:10.820 --> 05:13.280 align:middle line:90%
goes down, we still have
reachability, as long as

136
05:13.280 --> 05:15.297 align:middle line:90%
that 1.1.1.1 address
space is being

137
05:15.297 --> 05:16.380 align:middle line:84%
advertised to the network.

138
05:16.380 --> 05:17.720 align:middle line:90%
So if we're using that for
management, not only do we

139
05:17.720 --> 05:20.012 align:middle line:90%
have fault tolerance if we
have multiple paths compared

140
05:20.012 --> 05:21.450 align:middle line:90%
to the IP address
on an interface,

141
05:21.450 --> 05:25.130 align:middle line:90%
we also have the ability to
lock that puppy down with ACLs

142
05:25.130 --> 05:26.670 align:middle line:84%
elsewhere in our environment.

143
05:26.670 --> 05:28.880 align:middle line:90%
So we can specify another
ACL in our environment

144
05:28.880 --> 05:31.760 align:middle line:90%
that the traffic going
to this IP address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:28.880 --> 05:31.760 align:middle line:90%
that the traffic going
to this IP address

145
05:31.760 --> 05:34.610 align:middle line:90%
from an administrator, regarding
SSH or some other management

146
05:34.610 --> 05:36.110 align:middle line:84%
protocol, is allowed.

147
05:36.110 --> 05:38.990 align:middle line:90%
And then it also helps us out
infrastructure-wide in locking

148
05:38.990 --> 05:40.910 align:middle line:90%
down that address
because we know

149
05:40.910 --> 05:42.320 align:middle line:84%
exactly what is going to be.

150
05:42.320 --> 05:45.265 align:middle line:90%
If there's a router that's under
attack and a CPU is going way,

151
05:45.265 --> 05:46.890 align:middle line:90%
way high, we'd want
to know about that.

152
05:46.890 --> 05:50.323 align:middle line:90%
So we can turn on
notification for CPU issues.

153
05:50.323 --> 05:52.490 align:middle line:90%
And we can do it with SNMP
simple network management

154
05:52.490 --> 05:54.830 align:middle line:90%
protocol by setting
up our thresholds.

155
05:54.830 --> 05:59.030 align:middle line:90%
There's options for collecting
data in the event of a crash.

156
05:59.030 --> 06:00.710 align:middle line:90%
For network time
protocol, we'd always
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
05:59.030 --> 06:00.710 align:middle line:90%
For network time
protocol, we'd always

157
06:00.710 --> 06:03.500 align:middle line:90%
want to use authentication,
that way we're not being spoofed

158
06:03.500 --> 06:06.890 align:middle line:90%
or lied to by an
unauthenticated NTP server.

159
06:06.890 --> 06:09.800 align:middle line:90%
And then it refers here
infrastructure ACLs,

160
06:09.800 --> 06:11.190 align:middle line:84%
which is amazing.

161
06:11.190 --> 06:13.850 align:middle line:90%
So let's imagine that
this is our network.

162
06:13.850 --> 06:15.260 align:middle line:84%
We have these three devices.

163
06:15.260 --> 06:17.427 align:middle line:90%
If we have loopbacks that
we're using for management

164
06:17.427 --> 06:20.345 align:middle line:90%
of each of these devices, we
can specify with access control

165
06:20.345 --> 06:23.463 align:middle line:90%
lists that traffic, especially
management traffic--

166
06:23.463 --> 06:24.880 align:middle line:90%
we can specify
with access control

167
06:24.880 --> 06:27.380 align:middle line:90%
list at the edges of our network
and throughout the network,

168
06:27.380 --> 06:30.200 align:middle line:90%
we can specify that traffic
from your admin computer
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
06:27.380 --> 06:30.200 align:middle line:90%
we can specify that traffic
from your admin computer

169
06:30.200 --> 06:33.140 align:middle line:90%
and my admin computer
can go to these devices

170
06:33.140 --> 06:35.360 align:middle line:90%
if they're the protocols
acceptable, like SSH and so

171
06:35.360 --> 06:36.000 align:middle line:84%
forth.

172
06:36.000 --> 06:40.010 align:middle line:90%
And then we could deny SSH
from every other IP address

173
06:40.010 --> 06:41.810 align:middle line:90%
to anywhere in
our address space.

174
06:41.810 --> 06:44.150 align:middle line:90%
And they refer to that as
an infrastructure ACL, which

175
06:44.150 --> 06:46.730 align:middle line:90%
is specifically permitting
certain types of traffic

176
06:46.730 --> 06:47.897 align:middle line:84%
within the addressing space.

177
06:47.897 --> 06:49.313 align:middle line:90%
And that way, if
somebody's trying

178
06:49.313 --> 06:50.870 align:middle line:90%
to come in from the
outside or trying

179
06:50.870 --> 06:53.275 align:middle line:90%
to come in from the
inside from a device,

180
06:53.275 --> 06:55.400 align:middle line:90%
those infrastructure ACLs
can identify that traffic

181
06:55.400 --> 06:57.050 align:middle line:90%
and stop it before
it ever reaches

182
06:57.050 --> 06:59.450 align:middle line:90%
the device that the
hacker or attacker is

183
06:59.450 --> 07:00.620 align:middle line:84%
trying to connect to.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
06:59.450 --> 07:00.620 align:middle line:84%
trying to connect to.

184
07:00.620 --> 07:02.540 align:middle line:90%
So as part of the
infrastructure ACLs,

185
07:02.540 --> 07:04.633 align:middle line:90%
we could do ICMP
packet filtering.

186
07:04.633 --> 07:06.300 align:middle line:90%
We could filter
fragments if an attacker

187
07:06.300 --> 07:09.265 align:middle line:90%
is trying to bypass an
ACL using fragmentation.

188
07:09.265 --> 07:10.640 align:middle line:90%
We could look for
those fragments

189
07:10.640 --> 07:13.058 align:middle line:90%
and stop them and block them
based on being a fragment.

190
07:13.058 --> 07:14.600 align:middle line:90%
And other options
in those ACLs would

191
07:14.600 --> 07:17.683 align:middle line:90%
include looking for specific
options or TTL values.

192
07:17.683 --> 07:19.100 align:middle line:90%
So if somebody is
sending a packet

193
07:19.100 --> 07:22.310 align:middle line:90%
in-- it has a strict
resource root option, which

194
07:22.310 --> 07:24.553 align:middle line:90%
is trying to direct
the packet specifically

195
07:24.553 --> 07:25.970 align:middle line:90%
as it goes through
the network, we

196
07:25.970 --> 07:28.140 align:middle line:90%
can have an access list at
the edge that sees that option

197
07:28.140 --> 07:28.880 align:middle line:84%
and says, oh, no, no.

198
07:28.880 --> 07:30.297 align:middle line:90%
We're not allowing
that packet in.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

198
07:28.880 --> 07:30.297 align:middle line:90%
We're not allowing
that packet in.

199
07:30.297 --> 07:31.800 align:middle line:90%
Or we see a packet
that's coming in.

200
07:31.800 --> 07:33.565 align:middle line:90%
It's got a TTL two,
for example, and we

201
07:33.565 --> 07:34.940 align:middle line:90%
know it's going
to take like four

202
07:34.940 --> 07:36.440 align:middle line:84%
hops to get across our network.

203
07:36.440 --> 07:38.340 align:middle line:90%
We can kill it
right at the edge.

204
07:38.340 --> 07:41.660 align:middle line:90%
Now, some of these functions--
if we filter ICMP packets

205
07:41.660 --> 07:43.940 align:middle line:90%
and we filter TTLs
that are too low,

206
07:43.940 --> 07:46.370 align:middle line:90%
that's going to hamper
ourselves because we won't

207
07:46.370 --> 07:48.140 align:middle line:90%
be able to do a
pinging or traceroute

208
07:48.140 --> 07:49.940 align:middle line:90%
from any device in
the infrastructure.

209
07:49.940 --> 07:52.190 align:middle line:90%
We'll be limited to doing
those types of commands that

210
07:52.190 --> 07:54.590 align:middle line:90%
are permitted by these
infrastructure ACLs

211
07:54.590 --> 07:57.200 align:middle line:90%
from either our trusted
computers that you and I manage

212
07:57.200 --> 07:58.317 align:middle line:84%
or our management systems.

213
07:58.317 --> 07:59.900 align:middle line:90%
So let's scroll down
a little bit more

214
07:59.900 --> 08:01.730 align:middle line:90%
and take a look at secure
interactive management
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

214
07:59.900 --> 08:01.730 align:middle line:90%
and take a look at secure
interactive management

215
08:01.730 --> 08:02.150 align:middle line:84%
sessions.

216
08:02.150 --> 08:03.692 align:middle line:90%
Of course, we would
never want to use

217
08:03.692 --> 08:06.470 align:middle line:90%
Telnet or any
unprotected protocols

218
08:06.470 --> 08:08.360 align:middle line:84%
as we manage our devices.

219
08:08.360 --> 08:10.640 align:middle line:90%
And on some IOS devices,
there's literally

220
08:10.640 --> 08:13.370 align:middle line:90%
a feature of Management
Plane Protection which

221
08:13.370 --> 08:15.890 align:middle line:90%
can specify which
interfaces are allowing

222
08:15.890 --> 08:18.670 align:middle line:90%
which protocols, like
SSH on fast Ethernet 0/0

223
08:18.670 --> 08:20.525 align:middle line:84%
or gigabit 0/0.

224
08:20.525 --> 08:21.570 align:middle line:84%
And that's it.

225
08:21.570 --> 08:24.260 align:middle line:90%
So those protocols coming
in on any other interfaces

226
08:24.260 --> 08:25.420 align:middle line:84%
would be denied.

227
08:25.420 --> 08:28.100 align:middle line:90%
And there's also Control
Plane Protection and Policing,

228
08:28.100 --> 08:30.549 align:middle line:84%
which are absolutely amazing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

228
08:28.100 --> 08:30.549 align:middle line:84%
which are absolutely amazing.

229
08:30.549 --> 08:33.049 align:middle line:90%
We have separate sets of videos
on Control Plane Protection,

230
08:33.049 --> 08:35.960 align:middle line:90%
but with the Control Plane,
there are some packets--

231
08:35.960 --> 08:36.818 align:middle line:84%
see, this is R1.

232
08:36.818 --> 08:39.110 align:middle line:90%
Some packets, the router is
going to forward, like data

233
08:39.110 --> 08:40.010 align:middle line:84%
plane traffic--

234
08:40.010 --> 08:43.130 align:middle line:90%
gets back it in, looks at the IP
header, Ceph has it all cached,

235
08:43.130 --> 08:43.707 align:middle line:84%
forwards it.

236
08:43.707 --> 08:44.540 align:middle line:84%
Next packet, please.

237
08:44.540 --> 08:45.395 align:middle line:84%
No problem.

238
08:45.395 --> 08:47.270 align:middle line:90%
However, there's some
traffic that the router

239
08:47.270 --> 08:50.180 align:middle line:90%
has to process itself,
like a routing update.

240
08:50.180 --> 08:52.880 align:middle line:90%
So the router get that,
de-encapsulates the routing

241
08:52.880 --> 08:55.290 align:middle line:90%
update, looks at it,
has to think about it,

242
08:55.290 --> 08:56.330 align:middle line:84%
and that takes CPU.

243
08:56.330 --> 08:59.030 align:middle line:90%
So an attacker who's trying
to compromise this system

244
08:59.030 --> 09:01.340 align:middle line:90%
could actually send
a boatload of traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

244
08:59.030 --> 09:01.340 align:middle line:90%
could actually send
a boatload of traffic

245
09:01.340 --> 09:03.980 align:middle line:90%
that has to be processed
by the CPU in an attempt

246
09:03.980 --> 09:06.450 align:middle line:90%
to disrupt service
on this router.

247
09:06.450 --> 09:10.020 align:middle line:90%
So with Control Plane Protection
and Control Plane Policing,

248
09:10.020 --> 09:11.210 align:middle line:84%
we can identify thresholds.

249
09:11.210 --> 09:13.470 align:middle line:90%
We could say, if this
is your computer--

250
09:13.470 --> 09:16.310 align:middle line:90%
I'll put you here, and I'll
put mine right next to you.

251
09:16.310 --> 09:17.930 align:middle line:84%
So this is you and me.

252
09:17.930 --> 09:21.120 align:middle line:90%
We can specify that
traffic, like SSH traffic,

253
09:21.120 --> 09:23.420 align:middle line:90%
HTTPS traffic, other
management protocols that

254
09:23.420 --> 09:24.830 align:middle line:84%
are coming from you or me--

255
09:24.830 --> 09:25.610 align:middle line:84%
no problem.

256
09:25.610 --> 09:27.390 align:middle line:90%
Let the router go
ahead and process it.

257
09:27.390 --> 09:30.800 align:middle line:90%
However, if traffic is coming
in from any other addresses
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

257
09:27.390 --> 09:30.800 align:middle line:90%
However, if traffic is coming
in from any other addresses

258
09:30.800 --> 09:33.200 align:middle line:90%
on those protocols,
we can set thresholds.

259
09:33.200 --> 09:34.910 align:middle line:90%
So the router can
say, whoa, whoa,

260
09:34.910 --> 09:37.790 align:middle line:90%
this quantity of ICMP
traffic directed to me

261
09:37.790 --> 09:40.880 align:middle line:90%
or this quantity of SSH
traffic directed to me,

262
09:40.880 --> 09:43.340 align:middle line:90%
I'm going to go ahead and I'm
going to limit it right here,

263
09:43.340 --> 09:44.600 align:middle line:84%
basically cut it off.

264
09:44.600 --> 09:46.640 align:middle line:90%
Because it's not coming
from trusted sources.

265
09:46.640 --> 09:48.260 align:middle line:90%
And that way, I can
deny that traffic

266
09:48.260 --> 09:50.300 align:middle line:90%
and stop it before I
have to actually send it

267
09:50.300 --> 09:51.957 align:middle line:84%
to my processor for processing.

268
09:51.957 --> 09:53.540 align:middle line:90%
So we're basically
killing the traffic

269
09:53.540 --> 09:56.187 align:middle line:90%
that, otherwise, if we had to
process, might overload us.

270
09:56.187 --> 09:57.770 align:middle line:90%
And that's kind of
the thought process

271
09:57.770 --> 10:00.418 align:middle line:90%
behind Control Plane Policing
and Control Plane Protection.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

271
09:57.770 --> 10:00.418 align:middle line:90%
behind Control Plane Policing
and Control Plane Protection.

272
10:00.418 --> 10:02.960 align:middle line:90%
And you might think, wait, wait,
wait, stop the truck, Keith.

273
10:02.960 --> 10:05.240 align:middle line:90%
Aren't we in the
management plane section?

274
10:05.240 --> 10:06.790 align:middle line:84%
And the answer is, yes, we are.

275
10:06.790 --> 10:10.690 align:middle line:90%
However, Control Plane Policing
and Control Plane Protection

276
10:10.690 --> 10:13.330 align:middle line:90%
is also going to protect
our management protocols

277
10:13.330 --> 10:15.490 align:middle line:90%
by taking stuff from
unauthorized sources

278
10:15.490 --> 10:17.450 align:middle line:90%
and dropping it and
not causing harm.

279
10:17.450 --> 10:20.100 align:middle line:90%
So a lot of these techniques
will fall into both camps.

280
10:20.100 --> 10:23.205 align:middle line:90%
So Control Plane Policing
and Control Plane Protection

281
10:23.205 --> 10:25.330 align:middle line:90%
are going to help both the
management plane as well

282
10:25.330 --> 10:27.738 align:middle line:90%
as the control plane,
which is our next video.

283
10:27.738 --> 10:29.780 align:middle line:90%
We'd also want to use
secure protocols like SSH--

284
10:29.780 --> 10:31.150 align:middle line:84%
and not just any SSH.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

284
10:29.780 --> 10:31.150 align:middle line:84%
and not just any SSH.

285
10:31.150 --> 10:33.370 align:middle line:90%
Ideally, we'd be using
SSH version 2, which

286
10:33.370 --> 10:36.190 align:middle line:90%
means we'd enable SSH,
and then in global config,

287
10:36.190 --> 10:39.790 align:middle line:90%
say IP SSH version
2 to then restrict

288
10:39.790 --> 10:43.485 align:middle line:90%
SSH traffic so its version 2
only, which is more secure.

289
10:43.485 --> 10:44.860 align:middle line:90%
So if we do show
commands for SSH

290
10:44.860 --> 10:47.800 align:middle line:90%
and it says it supports
1.9, what that means is it's

291
10:47.800 --> 10:50.680 align:middle line:90%
willing to support
version 1 and version 2.

292
10:50.680 --> 10:53.260 align:middle line:90%
So if we do IP SSH
version 2, then it

293
10:53.260 --> 10:54.570 align:middle line:84%
can lock it down to version 2.

294
10:54.570 --> 10:55.987 align:middle line:90%
We'd also want to
make sure that's

295
10:55.987 --> 10:58.785 align:middle line:90%
the only protocol allowed
on the VTY lines as well.

296
10:58.785 --> 11:00.160 align:middle line:90%
And then it talks
about triple A,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

296
10:58.785 --> 11:00.160 align:middle line:90%
And then it talks
about triple A,

297
11:00.160 --> 11:02.740 align:middle line:90%
which is a great idea,
using TACACS acts for admins

298
11:02.740 --> 11:05.530 align:middle line:90%
who are accessing so we can
authenticate them, authorize

299
11:05.530 --> 11:07.690 align:middle line:90%
the commands they can
issue, and then account

300
11:07.690 --> 11:10.600 align:middle line:90%
for what they did on a
centralized triple A server.

301
11:10.600 --> 11:12.550 align:middle line:90%
And here it just
basically reinforces never

302
11:12.550 --> 11:14.210 align:middle line:84%
used type 7 passwords.

303
11:14.210 --> 11:15.338 align:middle line:84%
Type 5 is better.

304
11:15.338 --> 11:17.005 align:middle line:90%
And as we demonstrated
earlier, a type 9

305
11:17.005 --> 11:18.860 align:middle line:84%
is even better than that.

306
11:18.860 --> 11:22.300 align:middle line:90%
And then regarding SNMP, if
you must use SNMP version 2,

307
11:22.300 --> 11:24.730 align:middle line:90%
[LAUGHS] please do
so in combination

308
11:24.730 --> 11:27.070 align:middle line:90%
with access control
lists that restrict

309
11:27.070 --> 11:32.210 align:middle line:90%
where those SNMP sessions
inbound are being allowed from.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

309
11:27.070 --> 11:32.210 align:middle line:90%
where those SNMP sessions
inbound are being allowed from.

310
11:32.210 --> 11:35.650 align:middle line:90%
So SNMP with ACLs is
great, and SNMP version 3

311
11:35.650 --> 11:38.500 align:middle line:90%
is preferred because
it has data integrity

312
11:38.500 --> 11:41.740 align:middle line:90%
and also has encryption services
to protect the confidentiality

313
11:41.740 --> 11:44.320 align:middle line:90%
and the data integrity
of the SNMP traffic going

314
11:44.320 --> 11:45.650 align:middle line:84%
back and forth.

315
11:45.650 --> 11:47.560 align:middle line:90%
And then it also
refers to logging.

316
11:47.560 --> 11:50.170 align:middle line:90%
And logging is a great idea so
you can see what's happening,

317
11:50.170 --> 11:53.200 align:middle line:90%
but logging to the
console is a bad idea

318
11:53.200 --> 11:55.348 align:middle line:90%
because it could
overrun the CPU.

319
11:55.348 --> 11:56.890 align:middle line:90%
If you're doing a
debug of everything

320
11:56.890 --> 11:58.930 align:middle line:90%
and it goes to the
console, you might have

321
11:58.930 --> 12:00.280 align:middle line:84%
a real problem on your hands.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

321
11:58.930 --> 12:00.280 align:middle line:84%
a real problem on your hands.

322
12:00.280 --> 12:02.800 align:middle line:90%
There's options to verify that
the IOS that we're running

323
12:02.800 --> 12:04.450 align:middle line:84%
on our devices is authentic.

324
12:04.450 --> 12:06.117 align:middle line:90%
And that would look
something like this.

325
12:06.117 --> 12:08.800 align:middle line:90%
If you did a directory--
and here is my IOS.

326
12:08.800 --> 12:10.480 align:middle line:84%
I'll simply copy that.

327
12:10.480 --> 12:16.180 align:middle line:90%
And the images show
software authenticity file,

328
12:16.180 --> 12:18.700 align:middle line:84%
and then we point to it.

329
12:18.700 --> 12:21.480 align:middle line:90%
And I'll simply paste that
in and then press Enter.

330
12:21.480 --> 12:24.370 align:middle line:90%
It can help us verify the
authenticity of the IOS

331
12:24.370 --> 12:25.630 align:middle line:84%
that we're currently running.

332
12:25.630 --> 12:27.190 align:middle line:90%
Another really,
really cool feature

333
12:27.190 --> 12:28.360 align:middle line:84%
is this bad boy right here--

334
12:28.360 --> 12:31.300 align:middle line:90%
Configuration Replace and
Configuration Rollback,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

334
12:28.360 --> 12:31.300 align:middle line:90%
Configuration Replace and
Configuration Rollback,

335
12:31.300 --> 12:33.250 align:middle line:90%
where you can tell
your IOS device,

336
12:33.250 --> 12:35.520 align:middle line:90%
hey, you know what, every
day or every five minutes

337
12:35.520 --> 12:37.270 align:middle line:90%
or every 40 minutes
or whatever time frame

338
12:37.270 --> 12:40.657 align:middle line:90%
you want, go ahead and do a
backup of the configuration

339
12:40.657 --> 12:42.490 align:middle line:90%
so that if we ever need
to restore from that

340
12:42.490 --> 12:45.010 align:middle line:90%
in the future, we've got
some copies of that right

341
12:45.010 --> 12:46.558 align:middle line:84%
there local on that device.

342
12:46.558 --> 12:48.850 align:middle line:90%
And that's super handy in
the event we need to restore.

343
12:48.850 --> 12:51.490 align:middle line:90%
In fact, let me demonstrate
that for you real quick.

344
12:51.490 --> 12:54.160 align:middle line:90%
So right here on router
1, if we do a DAR--

345
12:54.160 --> 12:57.320 align:middle line:90%
I just have these files in
the flash at the moment.

346
12:57.320 --> 12:58.900 align:middle line:90%
And if went into
configuration mode

347
12:58.900 --> 13:01.863 align:middle line:90%
and used the command
archive and pressed Enter,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

347
12:58.900 --> 13:01.863 align:middle line:90%
and used the command
archive and pressed Enter,

348
13:01.863 --> 13:03.280 align:middle line:90%
we now have options
for telling it

349
13:03.280 --> 13:05.140 align:middle line:84%
we want to back up periodically.

350
13:05.140 --> 13:08.130 align:middle line:90%
So I'm going to
specify the path first.

351
13:08.130 --> 13:10.160 align:middle line:84%
And my path is on the flash.

352
13:10.160 --> 13:13.550 align:middle line:90%
I'm just going to
call it KB-backup.cfg.

353
13:13.550 --> 13:15.612 align:middle line:90%
And then, we can specify
how many copies to keep.

354
13:15.612 --> 13:17.320 align:middle line:90%
I'm going to specify
that with a maximum.

355
13:17.320 --> 13:20.080 align:middle line:90%
Let's say we want 10
copies, and then it'll

356
13:20.080 --> 13:22.210 align:middle line:90%
just start rolling out
the first in, first out

357
13:22.210 --> 13:23.570 align:middle line:84%
after it reaches the 10.

358
13:23.570 --> 13:24.910 align:middle line:84%
And the time period--

359
13:24.910 --> 13:26.890 align:middle line:90%
it refers to how
often should it do it.

360
13:26.890 --> 13:29.098 align:middle line:90%
I'm go say every two minutes
just for a demonstration

361
13:29.098 --> 13:30.510 align:middle line:84%
so we can have a few in there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

361
13:29.098 --> 13:30.510 align:middle line:84%
so we can have a few in there.

362
13:30.510 --> 13:32.968 align:middle line:90%
And I'm also going to use the
option of right memory, which

363
13:32.968 --> 13:34.510 align:middle line:90%
is the automatic
backup generation

364
13:34.510 --> 13:38.582 align:middle line:90%
during a right memory,
which is a copy runstart.

365
13:38.582 --> 13:40.040 align:middle line:90%
All right, there's
one other option

366
13:40.040 --> 13:42.440 align:middle line:90%
I'd like to share with you,
and that is log as well.

367
13:42.440 --> 13:44.050 align:middle line:84%
So we type in log config.

368
13:44.050 --> 13:46.930 align:middle line:90%
That takes us into the archive,
a special sub component

369
13:46.930 --> 13:48.380 align:middle line:84%
called log configuration.

370
13:48.380 --> 13:49.960 align:middle line:90%
And from here, we
can specify actions

371
13:49.960 --> 13:51.850 align:middle line:90%
to take whenever there's
configuration changes that

372
13:51.850 --> 13:53.980 align:middle line:90%
are made so we can keep
track of what's happening.

373
13:53.980 --> 13:55.810 align:middle line:90%
Now ideally, if
we're using triple A

374
13:55.810 --> 13:57.520 align:middle line:90%
with triple A
accounting-- every command

375
13:57.520 --> 13:59.020 align:middle line:90%
and who issued those
commands, those

376
13:59.020 --> 14:01.870 align:middle line:90%
are all being stored centrally
on our triple A server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

376
13:59.020 --> 14:01.870 align:middle line:90%
are all being stored centrally
on our triple A server.

377
14:01.870 --> 14:06.010 align:middle line:90%
So we type in end
here, and we do a DIR.

378
14:06.010 --> 14:06.560 align:middle line:84%
There we go.

379
14:06.560 --> 14:08.410 align:middle line:90%
We've got one of them
here that triggered.

380
14:08.410 --> 14:12.593 align:middle line:90%
And if we type in
write or W-R, not only

381
14:12.593 --> 14:15.220 align:middle line:90%
did it take the running
config to startup config,

382
14:15.220 --> 14:19.030 align:middle line:90%
but it also made another copy
in the file system for us.

383
14:19.030 --> 14:21.710 align:middle line:90%
It backed it up based on
how we have it configured.

384
14:21.710 --> 14:24.370 align:middle line:90%
So if we made a change like
this-- let's do a config t,

385
14:24.370 --> 14:26.770 align:middle line:90%
hostname, and
we'll call this R--

386
14:26.770 --> 14:29.412 align:middle line:84%
how about R2D2, just for fun.

387
14:29.412 --> 14:31.870 align:middle line:90%
And we just said, oh, you know
what, that's a huge problem.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

387
14:29.412 --> 14:31.870 align:middle line:90%
And we just said, oh, you know
what, that's a huge problem.

388
14:31.870 --> 14:33.245 align:middle line:90%
Or something
modified our config,

389
14:33.245 --> 14:35.110 align:middle line:90%
we want to roll that
back, we can simply

390
14:35.110 --> 14:37.900 align:middle line:90%
use the config replace command
and grab one of these files.

391
14:37.900 --> 14:41.620 align:middle line:84%
So let's do a config replace.

392
14:41.620 --> 14:43.630 align:middle line:90%
Now, this is different
than a copy start

393
14:43.630 --> 14:46.810 align:middle line:90%
run because a copy is going
to merge the two together.

394
14:46.810 --> 14:47.900 align:middle line:84%
We want to replace it.

395
14:47.900 --> 14:51.100 align:middle line:90%
So configure, replace,
and I'll specify

396
14:51.100 --> 14:52.660 align:middle line:84%
the file system it's on.

397
14:52.660 --> 14:54.320 align:middle line:90%
I know it starts
with a KB something,

398
14:54.320 --> 14:57.370 align:middle line:90%
so I'll tab that out, and let
me go grab the rest of that

399
14:57.370 --> 14:58.840 align:middle line:84%
to make it unique.

400
14:58.840 --> 15:03.640 align:middle line:90%
So 15-20, and let's grab
the first one right there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

400
14:58.840 --> 15:03.640 align:middle line:90%
So 15-20, and let's grab
the first one right there.

401
15:03.640 --> 15:06.727 align:middle line:90%
So I'll paste that in, press
Enter, and now it's asking me,

402
15:06.727 --> 15:08.310 align:middle line:90%
hey, are you sure
you want to proceed?

403
15:08.310 --> 15:10.270 align:middle line:90%
This is going to replace
your current running

404
15:10.270 --> 15:12.110 align:middle line:84%
config with this file.

405
15:12.110 --> 15:14.350 align:middle line:90%
And if we say yes,
press Enter, it'll

406
15:14.350 --> 15:16.240 align:middle line:84%
acquire our configuration lock.

407
15:16.240 --> 15:17.450 align:middle line:84%
And it is done.

408
15:17.450 --> 15:19.680 align:middle line:84%
So our hostname is back to R1.

409
15:19.680 --> 15:21.023 align:middle line:84%
And that's the Archive option.

410
15:21.023 --> 15:23.440 align:middle line:90%
So I want to thank you for
joining me for a few highlights

411
15:23.440 --> 15:26.590 align:middle line:90%
from that section of this guide
regarding hardening Cisco IOS

412
15:26.590 --> 15:28.978 align:middle line:90%
devices with a focus on
the management plane.

413
15:28.978 --> 15:30.520 align:middle line:90%
In the next section
of this document,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

413
15:28.978 --> 15:30.520 align:middle line:90%
In the next section
of this document,

414
15:30.520 --> 15:33.103 align:middle line:90%
I'd like to share with you some
of the highlights and sections

415
15:33.103 --> 15:35.260 align:middle line:90%
regarding configuring
Cisco IOS devices

416
15:35.260 --> 15:38.262 align:middle line:90%
and hardening them, focusing
on the control plane.

417
15:38.262 --> 15:39.220 align:middle line:84%
And we'll do that next.

418
15:39.220 --> 15:40.340 align:middle line:84%
See you there in a moment.

419
15:40.340 --> 15:42.730 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

420
15:42.730 --> 15:45.960 align:middle line:90%
and I'd like to thank
you for viewing.