is it important to secure a CPE router

[SaifAlmodares8882]

i have a CPE router (Cisco LSR 4000 series)and i will be configure it, i also have a firewall that sits after the CPE that will handle everything 

the CPE will be only connecting my network to the ISP 

my question is do i have to do anything related to secure this router? except for the passwords

[Rob Ingram]

Hi,

You should still secure the router, with VTY ACL to restrict access to the router, SNMP, Syslog, Banner, AAA, Routing protocol authentication and general device hardening etc. The Cisco IOS device hardening guide has more information.

HTH

[SaifAlmodares8882]

thanks!

[SaifAlmodares8882]

wow this is a lot 

do i need to everything in this guide ? is there a short way or list of commands to do it? i dont think i have enough time until the day of switching the router 

it would be great if u provide me with short way :)

best

[Rob Ingram]

VTY ACL to restrict access to the router, SNMP, Syslog, Banner, AAA, Routing protocol authentication is a good start and probably the minimum you should configure.

Make sure you disable telnet in the VTY lines and use SSH instead.

HTH

[SaifAlmodares8882]

you mean set the VTY to deny all for these services (SNMP, Syslog, Banner, AAA, Routing protocol authentication) and permit through only local interface?

[Rob Ingram]

That was just a list of protocols to configure, at a minimum do the following:-

- ACL to secure mgmt access to the VTY lines
- SNMPv3 with an ACL to restrict access
- Send logs to syslog server
- Banners
- Routing protocol authentication
- AAA

[SaifAlmodares8882]

i see, correct me if am wring please
-ACL to secure mgmt access to the VTY lines
- SNMPv3 with an ACL to restrict access
- Send logs to syslog server (i dont need to set this if i dont have syslog server)
- Banners
- Routing protocol authentication (i am suing only default route do i need to do authentication for all other protocols)
- AAA (authentication service, do i need to use it)

[Rob Ingram]

Sure, if you aren't using a routing protocol you don't need to authentication. The Syslog and AAA would be advisable, but if you don't have these systems in place then ok. These were just general suggestions.

[SaifAlmodares8882]

so nothing left for me to configure except for

-disabling telnet and enabling SSH with ACL

-create strong passwords for acceding global, vty,...etc

-set passwords lockout time 

-banners

-disable icmp

what about DDoS? i have web servers on premises but they are behind the firewall do i still need to disable ICMP from outside?

[Rob Ingram]

Well, if there is a firewall behind the router, then let that device protect the webservers, Layer 7 inspection/DDoS etc. You just want to secure the router, not necessarily block transit traffic (unless a valid reason to block transit traffic on the router).

It's up to you whether you want to block icmp to the webservers, if you don't need it then block it on the firewall.

[SaifAlmodares8882]

its already set on the firewall, but i believe that i need to block icmp on the router because once the attacker know the web server IP it will be easy to guess the router ip and flood it with ping requests, right?

[Rob Ingram]

If an attacker knows the IP address of the webserver they are probably going to do more than ping flood your devices. If you do block icmp on your router you said you don't have a syslog server, so you'll get no alerts of any blocks.

The best place to filter all traffic is on the firewall, which is has the logging functionality, so you'll get alerts and can react.

[SaifAlmodares8882]

so no need to block ICMP...i ahve everything set on the firewall and it works fine

i do have Nagios, is this considered to be syslog server? i can set the SNMP on the router to log everyhting to Nagios

[Rob Ingram]

No need to block icmp or any transit traffic on the router, up to you if you block icmp on the firewall.

Yes, you can use nagios for syslog and snmp.