topic Cisco Router Basic Security Configuration in Network Security

Cisco Router Basic Security Configuration

AlexM445 — Wed, 24 May 2023 16:56:32 GMT

Hello All,

Let me start off with saying that I am a beginner and trying to learn the fundamentals. I have a basic config on my C921 router that suits my needs. I am turning to the topic of network security and trying to learn how to configure a good secure router. My intent is to add an external network firewall in the near future but I would like some guidance with the basics. What are some topics / concerns when configuring a routers basic security functions? As always, I am trying to learn the basics, so in depth discussion and explanations are very much appreciated.

Re: Cisco Router Basic Security Configuration

MHM Cisco World — Wed, 24 May 2023 17:08:48 GMT

https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html

this help you

Re: Cisco Router Basic Security Configuration

AlexM445 — Wed, 24 May 2023 18:03:05 GMT

Thank you very much for the response. I have been going through what you have linked and I do have some very basic questions. How do these two differ "enable secret 12345" and "username test secret 12345"? I am assuming that this is depending on how the router is accessed? I understand the first is through the CLI enable but not sure of what the second is protecting.

Re: Cisco Router Basic Security Configuration

MHM Cisco World — Wed, 24 May 2023 18:24:41 GMT

username let you access to Router
the enable let you go from user to config/enable mode

Re: Cisco Router Basic Security Configuration

AlexM445 — Wed, 24 May 2023 18:16:57 GMT

My understanding still is not firm. When you say "access the router" do you mean when you first go into the serial console and it asks for a login? I ask because I have used the following to accomplish this:

Router(config)# line console 0
Router(config-line)# password 12345
Router(config-line)# login

How would this differ from the afore mentioned "username test secret 12345" ?

Re: Cisco Router Basic Security Configuration

MHM Cisco World — Wed, 24 May 2023 18:33:38 GMT

first since you start read keep away from console (dont config login under it) and config enable password cisco or admin
then start with VTY
when we config VTY we can config login but here we need password
the password in R/SW is in save in may place
1- if you config VTY with login, then the VTY will used the password you enter under the VTY (only password need here)
2- if you config VTY with login local, the VTY will search global mode router for USERNAME + PASSWORD
3- if you config VTY with auth then the VTY, will search the password in radius/tacacs server or local (if server local)

NOW we access the R/SW via VTY using one of password above
the mode is user
>
we need to start config the R/SW
we need to enter
enable
here come the rule of enable password
you need enable password to go from user to config/enable mode

Re: Cisco Router Basic Security Configuration

AlexM445 — Thu, 25 May 2023 16:51:11 GMT

I think I am starting to better understand the differences in logging in to the different modes.

I am still not completely clear on what the difference between the Console password (Router(config)# line console 0...) and the VTY password ( "username test secret 12345" ) and what they are protecting. I do understand the enable secret in full now. I understand that you recommended to stay away from the console config for now, with that in mind, what is the "username test secret 12345" accomplishing? I am assuming this has something to do with accessing the router through Telnet? When I enter Putty and navigate to Configuration mode it only asks for the enable password I set up, not the user name and secret that I also set up.

Re: Cisco Router Basic Security Configuration

MHM Cisco World — Sun, 28 May 2023 00:42:16 GMT

Console password <<- can you more elaborate about the console password there is no console password and vty password you can use same username/password for both.
you use putty without username/password to access via console ? if yes then you dont config login/login local under the console line

friend
you config username/password in global mode but how will use this user/password ?
this depend on config
if you config under vty login local then you will use it

username/password let you access to router
this will direct you to user mode
router>

to go to enable mode you need enable password
router>en <<- this user mode
password : $$$$
router# <<- this enable mode