Securing the Console and Aux ports

[kdarmstrong]

We are about to install a router in 3rd part office. How do I secure the Console and Aux ports? I have the ports password protected, and have restricted traffic to specific host pairs using access list etc, but I would like to take it just that stage further.

[jekrauss]

Well, it depends on what you mean by "secure the Console and Aux ports."

For the short answer, the "Improving Security on Cisco Routers" paper below should be helpful in "going to the next step" as it addresses some common and quick steps you can take to lock down your router and network better.

The SAFE document should help you be more strategic in your security implementation by prompting you to develop a tailored security policy for your company which will dictate what specific steps you take on individual routers, how you will handle a security violation, how you will handle an active attack, etc.

Improving Security on Cisco Routers

http://www.cisco.com/warp/public/707/21.html

SAFE

Extending the Security Blueprint to Small, Midsize, and Remote-User Networks

http://www.cisco.com/warp/public/cc/so/cuso/epso/sqfr/safes_wp.htm

Here are two of my favorite security links:

Security Technical Tips

http://www.cisco.com/warp/public/707/

Security Configuration Guide

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/index.htm

HTH

Jeff

[mjbriggs]

If you mean disabling the console and/or aux ports you can

use "no exec" but ensure you have some kind of back door ie.Telnet access.

Regards

Mike