Closing FTP port on Cisco Routers?

[hectorlaya]

For security policies, we need to block all unused tcp/udp ports on our routers, incuding ftp port (used for large flash files upload). Is this possible on 2500 & 2600 Routers? How? Should we left it open for management reasons?

Thanks in advance for your comments....

[jason.aarons]

Your IOS is probably too old for Cisco Autosecure, here is some good reading from NSA;

http://nsa2.www.conxion.com/cisco/download.htm

[hectorlaya]

These are the IOS on the routers:

c2600-i-mz.120-7.T 12.0(7)T

c2600-i-mz.120-4.T 12.0(4)T

c2500-i-l.120-10 12.0(10)

[steve.busby]

If you have problems hitting the NSA site, here's another great document provided by Cisco to lock down your IOS devices:

http://www.cisco.com/en/US/partner/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml