WEBVTT

1
00:00.000 --> 00:01.910 align:middle line:84%


2
00:01.910 --> 00:03.530 align:middle line:90%
I've heard it said
that repetition

3
00:03.530 --> 00:05.310 align:middle line:84%
is the parent of learning.

4
00:05.310 --> 00:08.480 align:middle line:90%
Well, in this document from
Cisco regarding hardening Cisco

5
00:08.480 --> 00:10.730 align:middle line:90%
devices, it covers
how we can do it

6
00:10.730 --> 00:14.180 align:middle line:90%
for traffic related to the
control plane, the data plane,

7
00:14.180 --> 00:15.230 align:middle line:84%
and the management plane.

8
00:15.230 --> 00:16.910 align:middle line:90%
But it also includes
at the very bottom

9
00:16.910 --> 00:19.010 align:middle line:90%
of this document,
an appendix, which

10
00:19.010 --> 00:20.787 align:middle line:90%
is a checklist,
which is a great way

11
00:20.787 --> 00:22.370 align:middle line:90%
to review some of
those things that we

12
00:22.370 --> 00:25.010 align:middle line:90%
might want to consider or
hardening the Cisco iOS

13
00:25.010 --> 00:25.980 align:middle line:84%
devices.

14
00:25.980 --> 00:27.980 align:middle line:90%
So, here is the appendix
from that same document

15
00:27.980 --> 00:29.480 align:middle line:90%
that we started off
at the beginning

16
00:29.480 --> 00:30.410 align:middle line:84%
of this set of videos.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.480 --> 00:30.410 align:middle line:84%
of this set of videos.

17
00:30.410 --> 00:33.320 align:middle line:90%
And it states it's a collection
of all the hardening steps

18
00:33.320 --> 00:35.100 align:middle line:90%
that are presented
in this guide.

19
00:35.100 --> 00:37.340 align:middle line:90%
So, if you want any
detail on any one of them,

20
00:37.340 --> 00:39.410 align:middle line:90%
you can go back to the
guide into that section

21
00:39.410 --> 00:42.410 align:middle line:90%
where they provide configuration
examples and more explanation

22
00:42.410 --> 00:43.770 align:middle line:84%
on each and every one of them.

23
00:43.770 --> 00:46.160 align:middle line:90%
So, it starts off with a
management plane with passwords

24
00:46.160 --> 00:49.220 align:middle line:90%
and then details on that,
disabling unused services,

25
00:49.220 --> 00:51.490 align:middle line:90%
keepalive informations
and notifications.

26
00:51.490 --> 00:52.850 align:middle line:84%
Then it has a whole section--

27
00:52.850 --> 00:54.392 align:middle line:90%
they call it configure
here, but it's

28
00:54.392 --> 00:57.800 align:middle line:90%
like memory and CPU, reserving
memory, buffer overflow

29
00:57.800 --> 01:01.220 align:middle line:90%
detection, enhanced crashed
info, kind of a grab bag here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:57.800 --> 01:01.220 align:middle line:90%
detection, enhanced crashed
info, kind of a grab bag here.

30
01:01.220 --> 01:03.470 align:middle line:90%
And then it goes down
infrastructure ACLs,

31
01:03.470 --> 01:06.170 align:middle line:90%
which are basically specifying
what traffic is allowed

32
01:06.170 --> 01:07.670 align:middle line:90%
or not allowed in
your environment.

33
01:07.670 --> 01:10.270 align:middle line:90%
That way, you can stop the
traffic that's not allowed,

34
01:10.270 --> 01:12.800 align:middle line:90%
like Telnet or SSH from
unauthorized hosts.

35
01:12.800 --> 01:14.600 align:middle line:90%
You can stop it
right at the edge,

36
01:14.600 --> 01:17.210 align:middle line:90%
and that way we can stop
that traffic before it even

37
01:17.210 --> 01:19.130 align:middle line:84%
gets to the router or switch.

38
01:19.130 --> 01:21.140 align:middle line:90%
And then for filtering,
you know, considerations

39
01:21.140 --> 01:22.670 align:middle line:90%
we're getting IP
traffic and ICMP

40
01:22.670 --> 01:24.730 align:middle line:84%
traffic and options and TTL.

41
01:24.730 --> 01:27.050 align:middle line:90%
And then we have options
for control plane protection

42
01:27.050 --> 01:28.250 align:middle line:84%
and control plane policing.

43
01:28.250 --> 01:32.780 align:middle line:90%
Now, policing is a less granular
option for protecting the CPU.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:28.250 --> 01:32.780 align:middle line:90%
Now, policing is a less granular
option for protecting the CPU.

44
01:32.780 --> 01:35.870 align:middle line:90%
And control plane
protection is very granular.

45
01:35.870 --> 01:37.700 align:middle line:90%
It can be very
specific regarding

46
01:37.700 --> 01:39.650 align:middle line:90%
what it's trying to
protect and which queues

47
01:39.650 --> 01:41.030 align:middle line:90%
and which threshold
you want to set.

48
01:41.030 --> 01:42.738 align:middle line:90%
But they both have
the overall same goal,

49
01:42.738 --> 01:45.590 align:middle line:90%
and that is to protect the CPU
on our network infrastructure

50
01:45.590 --> 01:46.340 align:middle line:84%
device.

51
01:46.340 --> 01:48.420 align:middle line:90%
And it continues on
with management access,

52
01:48.420 --> 01:50.700 align:middle line:90%
making sure we're using
the best practices there.

53
01:50.700 --> 01:52.060 align:middle line:84%
AAA is a great idea.

54
01:52.060 --> 01:54.850 align:middle line:90%
Specifically TACACS+ or
authentication, authorization,

55
01:54.850 --> 01:56.000 align:middle line:84%
and accounting.

56
01:56.000 --> 01:58.455 align:middle line:90%
TACACS is preferred
over RADIUS because it

57
01:58.455 --> 02:01.310 align:middle line:90%
has more granular control over
the authorization of commands
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
01:58.455 --> 02:01.310 align:middle line:90%
has more granular control over
the authorization of commands

58
02:01.310 --> 02:02.360 align:middle line:84%
that can be issued.

59
02:02.360 --> 02:04.718 align:middle line:90%
And then with SNMP, use
version 3 when possible.

60
02:04.718 --> 02:06.260 align:middle line:90%
And if you're going
to use version 2,

61
02:06.260 --> 02:09.139 align:middle line:90%
make sure you use it in
combination with ACLs.

62
02:09.139 --> 02:12.560 align:middle line:90%
And also, change the default
passwords involved with SNMP.

63
02:12.560 --> 02:14.887 align:middle line:90%
And then logging and
configuration management.

64
02:14.887 --> 02:16.970 align:middle line:90%
And then for the control
plane, things to consider

65
02:16.970 --> 02:18.810 align:middle line:90%
disabling if we're
not using them.

66
02:18.810 --> 02:22.170 align:middle line:90%
And then basically, all
these say use authentication.

67
02:22.170 --> 02:24.650 align:middle line:90%
So, NTP with
authentication, routing

68
02:24.650 --> 02:28.887 align:middle line:90%
protocols with authentication,
and FHRP with authentication.

69
02:28.887 --> 02:31.220 align:middle line:90%
And then it also talks here
about control plane policing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:28.887 --> 02:31.220 align:middle line:90%
And then it also talks here
about control plane policing

70
02:31.220 --> 02:32.030 align:middle line:84%
and protection.

71
02:32.030 --> 02:35.270 align:middle line:90%
Again with the protection
being a more granular option

72
02:35.270 --> 02:37.910 align:middle line:90%
for controlling what
finally makes it to the CPU

73
02:37.910 --> 02:40.440 align:middle line:90%
for processing on
a Cisco device.

74
02:40.440 --> 02:42.080 align:middle line:90%
And then, finally,
in this checklist

75
02:42.080 --> 02:43.800 align:middle line:84%
we have the data plane.

76
02:43.800 --> 02:46.140 align:middle line:90%
So, we can consider dropping
certain types of traffic.

77
02:46.140 --> 02:48.090 align:middle line:84%
We can disable certain features.

78
02:48.090 --> 02:49.910 align:middle line:90%
All of which we talked
about previously.

79
02:49.910 --> 02:51.505 align:middle line:90%
We can limit IP
directed broadcasts,

80
02:51.505 --> 02:53.630 align:middle line:90%
which is kind of funny,
because it's off by default

81
02:53.630 --> 02:54.782 align:middle line:84%
on most Cisco devices.

82
02:54.782 --> 02:56.365 align:middle line:90%
We can configure
access control lists.

83
02:56.365 --> 03:00.068 align:middle line:90%
The little t for that refers to
transit access control lists.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
02:56.365 --> 03:00.068 align:middle line:90%
The little t for that refers to
transit access control lists.

84
03:00.068 --> 03:01.610 align:middle line:90%
This is for traffic
that's attempting

85
03:01.610 --> 03:04.760 align:middle line:90%
to go through your network,
not to a network device.

86
03:04.760 --> 03:07.250 align:middle line:90%
Access lists can also be
used for anti-spoofing

87
03:07.250 --> 03:09.090 align:middle line:90%
as we discussed in
the previous video.

88
03:09.090 --> 03:10.400 align:middle line:90%
And we also have
additional protections

89
03:10.400 --> 03:11.900 align:middle line:90%
that help mitigate
against spoofing,

90
03:11.900 --> 03:13.820 align:middle line:90%
people lying about
layer 2, people lying

91
03:13.820 --> 03:17.180 align:middle line:90%
about layer 3, which would
include Unicast RPF and IP

92
03:17.180 --> 03:18.050 align:middle line:84%
Source Guard.

93
03:18.050 --> 03:19.730 align:middle line:90%
And port security,
just to control

94
03:19.730 --> 03:22.190 align:middle line:90%
the number of MAC addresses
and which MAC addresses

95
03:22.190 --> 03:24.820 align:middle line:90%
are allowed to show up in
our layer 2 environments.

96
03:24.820 --> 03:26.570 align:middle line:90%
And as we continue
down, it reinforces

97
03:26.570 --> 03:28.910 align:middle line:84%
the use of ACLs, private VLANs.

98
03:28.910 --> 03:30.890 align:middle line:90%
I'd also toss in
there, VRF-lite,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:28.910 --> 03:30.890 align:middle line:90%
I'd also toss in
there, VRF-lite,

99
03:30.890 --> 03:33.715 align:middle line:90%
which is a great method
for segmentation.

100
03:33.715 --> 03:35.090 align:middle line:90%
And then control
plane protection

101
03:35.090 --> 03:37.970 align:middle line:90%
because our users on the
data plane should never be--

102
03:37.970 --> 03:39.530 align:middle line:90%
they should never
be sending traffic

103
03:39.530 --> 03:42.830 align:middle line:90%
to a network device as
the final destination.

104
03:42.830 --> 03:43.760 align:middle line:84%
Admins should.

105
03:43.760 --> 03:45.140 align:middle line:84%
Network management tools should.

106
03:45.140 --> 03:48.290 align:middle line:90%
But end users should not be
targeting our infrastructure

107
03:48.290 --> 03:49.268 align:middle line:84%
devices at all.

108
03:49.268 --> 03:51.560 align:middle line:90%
So, we could use a combination
of access control lists,

109
03:51.560 --> 03:54.770 align:middle line:90%
control plane policing, to
help restrict the impact

110
03:54.770 --> 03:56.960 align:middle line:90%
that user traffic is going
to have on our devices.

111
03:56.960 --> 03:59.480 align:middle line:90%
Because at the end of
the day, a user like Bob

112
03:59.480 --> 04:02.510 align:middle line:90%
should not be targeting or
have an IP packet destined
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
03:59.480 --> 04:02.510 align:middle line:90%
should not be targeting or
have an IP packet destined

113
04:02.510 --> 04:04.035 align:middle line:84%
for an infrastructure device.

114
04:04.035 --> 04:05.910 align:middle line:90%
They're supposedly going
through the network,

115
04:05.910 --> 04:07.868 align:middle line:90%
not to our routers
and switches directly.

116
04:07.868 --> 04:09.410 align:middle line:90%
So, we want to drop
that traffic when

117
04:09.410 --> 04:12.180 align:middle line:90%
we see it if it's coming from
those unauthorized users.

118
04:12.180 --> 04:14.720 align:middle line:90%
And if we are allowing some
of that traffic in, like SSH

119
04:14.720 --> 04:17.240 align:middle line:90%
and so forth, at least
limit it so if it's

120
04:17.240 --> 04:19.940 align:middle line:90%
the malicious attack,
it can't consume the CPU

121
04:19.940 --> 04:20.910 align:middle line:84%
on those devices.

122
04:20.910 --> 04:22.910 align:middle line:90%
So thanks for joining me
in this video, as we've

123
04:22.910 --> 04:25.430 align:middle line:90%
taken a look at the checklist
as part of this document

124
04:25.430 --> 04:26.780 align:middle line:84%
for securing iOS devices.

125
04:26.780 --> 04:28.830 align:middle line:90%
And I'll see you
in the next video.

126
04:28.830 --> 04:31.160 align:middle line:90%
Meanwhile, I hope this has
been informative for you,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
04:28.830 --> 04:31.160 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

127
04:31.160 --> 04:34.330 align:middle line:90%
and I'd like to thank
you for viewing.