Hello Giuseppe ,
thank you for Thank you for clarifying things .
I am Using Cisco Configuration Professional to manage my Router ,
I have two Option :
1- Security Audit
2- One-step-lockdown
The Configuration is below .
My Question is which option should i use to secure my router without any conflict with current configuration and without exceeding router resource ?
============Security Audit ==================
==========================================
Configuration commands for the router:
saved on 24/05/2012 09:28:37 Õ
----------------------------------------------------------------------------
ip access-list extended SDM_SSH
remark CCP_ACL Category=1
permit tcp any any eq 22
exit
ip access-list extended SDM_HTTPS
remark CCP_ACL Category=1
permit tcp any any eq 443
exit
ip access-list extended SDM_SHELL
remark CCP_ACL Category=1
permit tcp any any eq cmd
exit
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
ip domain lookup
no snmp-server
line con 0
transport output telnet
exit
line aux 0
transport output telnet
exit
ip name-server 8.8.8.8
service sequence-numbers
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
scheduler allocate 4000 1000
ip tcp synwait-time 10
security authentication failure rate 3 log
security passwords min-length 6
banner login ~Access is restricted to authorized users only~
logging console critical
logging trap debugging
logging buffered 51200 debugging
parameter-map type regex ccp-regex-nonascii
pattern "[^\x00-\x80]"
exit
parameter-map type protocol-info yahoo-servers
server name scs.msg.yahoo.com
server name scsa.msg.yahoo.com
server name scsb.msg.yahoo.com
server name scsc.msg.yahoo.com
server name scsd.msg.yahoo.com
server name cs16.msg.dcn.yahoo.com
server name cs19.msg.dcn.yahoo.com
server name cs42.msg.dcn.yahoo.com
server name cs53.msg.dcn.yahoo.com
server name cs54.msg.dcn.yahoo.com
server name ads1.vip.scd.yahoo.com
server name radio1.launch.vip.dal.yahoo.com
server name in1.msg.vip.re2.yahoo.com
server name data1.my.vip.sc5.yahoo.com
server name address1.pim.vip.mud.yahoo.com
server name edit.messenger.yahoo.com
server name messenger.yahoo.com
server name http.pager.yahoo.com
server name privacy.yahoo.com
server name csa.yahoo.com
server name csb.yahoo.com
server name csc.yahoo.com
exit
parameter-map type protocol-info aol-servers
server name login.oscar.aol.com
server name toc.oscar.aol.com
server name oam-d09a.blue.aol.com
exit
parameter-map type protocol-info msn-servers
server name messenger.hotmail.com
server name gateway.messenger.hotmail.com
server name webmessenger.msn.com
exit
class-map type inspect imap match-any ccp-app-imap
match invalid-command
exit
class-map type inspect match-any SDM_SHELL
match access-group name SDM_SHELL
exit
class-map type inspect match-any ccp-cls-protocol-im
match protocol ymsgr yahoo-servers
match protocol msnmsgr msn-servers
match protocol aol aol-servers
exit
class-map type inspect match-all ccp-protocol-im
match class-map ccp-cls-protocol-im
exit
class-map type inspect match-all ccp-protocol-pop3
match protocol pop3
exit
class-map type inspect http match-any ccp-app-nonascii
match req-resp header regex ccp-regex-nonascii
exit
class-map type inspect match-all ccp-protocol-smtp
match protocol smtp
exit
class-map type inspect match-any ccp-h323-inspect
match protocol h323
exit
class-map type inspect match-all ccp-protocol-imap
match protocol imap
exit
class-map type inspect match-any ccp-cls-insp-traffic
match protocol dns
match protocol https
match protocol icmp
match protocol imap
match protocol pop3
match protocol tcp
match protocol udp
exit
class-map type inspect match-any ccp-h323annexe-inspect
match protocol h323-annexe
exit
class-map type inspect match-any ccp-h225ras-inspect
match protocol h225ras
exit
class-map type inspect match-any SDM_HTTPS
match access-group name SDM_HTTPS
exit
class-map type inspect match-any ccp-skinny-inspect
match protocol skinny
exit
class-map type inspect match-all ccp-protocol-http
match protocol http
exit
class-map type inspect match-all ccp-icmp-access
match class-map ccp-cls-icmp-accesss
exit
class-map type inspect match-any ccp-cls-protocol-p2p
match protocol edonkey signature
match protocol gnutella signature
match protocol kazaa2 signature
match protocol fasttrack signature
match protocol bittorrent signature
exit
class-map type inspect match-all ccp-invalid-src
match access-group 100
exit
class-map type inspect match-any ccp-h323nxg-inspect
match protocol h323-nxg
exit
class-map type inspect match-all ccp-insp-traffic
match class-map ccp-cls-insp-traffic
exit
class-map type inspect match-any ccp-sip-inspect
match protocol sip
exit
class-map type inspect pop3 match-any ccp-app-pop3
match invalid-command
exit
class-map type inspect match-any ccp-cls-icmp-access
match protocol icmp
exit
class-map type inspect match-all ccp-protocol-p2p
match class-map ccp-cls-protocol-p2p
exit
class-map type inspect http match-any ccp-app-httpmethods
match request method bcopy
match request method bdelete
match request method bmove
match request method bpropfind
match request method bproppatch
match request method connect
match request method copy
match request method delete
match request method edit
match request method getattribute
match request method getattributenames
match request method getproperties
match request method index
match request method lock
match request method mkcol
match request method mkdir
match request method move
match request method notify
match request method options
match request method poll
match request method post
match request method propfind
match request method proppatch
match request method put
match request method revadd
match request method revlabel
match request method revlog
match request method revnum
match request method save
match request method search
match request method setattribute
match request method startrev
match request method stoprev
match request method subscribe
match request method trace
match request method unedit
match request method unlock
match request method unsubscribe
exit
class-map type inspect match-any SDM_SSH
match access-group name SDM_SSH
exit
class-map type inspect http match-any ccp-http-blockparam
match request port-misuse im
match request port-misuse p2p
match request port-misuse tunneling
match req-resp protocol-violation
exit
class-map type inspect smtp match-any ccp-app-smtp
match data-length gt 5000000
exit
policy-map type inspect http ccp-action-app-http
class type inspect http ccp-http-blockparam
log
reset
exit
class type inspect http ccp-app-httpmethods
log
reset
exit
class type inspect http ccp-app-nonascii
log
reset
exit
exit
policy-map type inspect pop3 ccp-action-pop3
class type inspect pop3 ccp-app-pop3
log
reset
exit
exit
policy-map type inspect imap ccp-action-imap
class type inspect imap ccp-app-imap
log
reset
exit
exit
policy-map type inspect smtp ccp-action-smtp
class type inspect smtp ccp-app-smtp
reset
exit
exit
policy-map type inspect ccp-permit-icmpreply
class type inspect ccp-icmp-access
no drop
inspect
exit
class type inspect ccp-sip-inspect
no drop
inspect
exit
class type inspect ccp-h323-inspect
no drop
inspect
exit
class type inspect ccp-h323annexe-inspect
no drop
inspect
exit
class type inspect ccp-h225ras-inspect
no drop
inspect
exit
class type inspect ccp-h323nxg-inspect
no drop
inspect
exit
class type inspect ccp-skinny-inspect
no drop
inspect
exit
class class-default
no drop
pass
exit
exit
policy-map type inspect ccp-inspect
class type inspect ccp-invalid-src
drop log
exit
class type inspect ccp-protocol-http
no drop
inspect
service-policy http ccp-action-app-http
exit
class type inspect ccp-protocol-smtp
no drop
inspect
service-policy smtp ccp-action-smtp
exit
class type inspect ccp-protocol-imap
no drop
inspect
service-policy imap ccp-action-imap
exit
class type inspect ccp-protocol-pop3
no drop
inspect
service-policy pop3 ccp-action-pop3
exit
class type inspect ccp-protocol-p2p
drop log
exit
class type inspect ccp-protocol-im
drop log
exit
class type inspect ccp-insp-traffic
no drop
inspect
exit
class type inspect ccp-sip-inspect
no drop
inspect
exit
class type inspect ccp-h323-inspect
no drop
inspect
exit
class type inspect ccp-h323annexe-inspect
no drop
inspect
exit
class type inspect ccp-h225ras-inspect
no drop
inspect
exit
class type inspect ccp-h323nxg-inspect
no drop
inspect
exit
class type inspect ccp-skinny-inspect
no drop
inspect
exit
exit
policy-map type inspect ccp-permit
class type inspect ccp-sip-inspect
no drop
inspect
exit
class type inspect ccp-h323-inspect
no drop
inspect
exit
class type inspect ccp-h323annexe-inspect
no drop
inspect
exit
class type inspect ccp-h225ras-inspect
no drop
inspect
exit
class type inspect ccp-h323nxg-inspect
no drop
inspect
exit
class type inspect ccp-skinny-inspect
no drop
inspect
exit
class class-default
exit
zone security in-zone
zone security out-zone
zone-pair security ccp-zp-out-self source out-zone destination self
service-policy type inspect ccp-permit
exit
zone-pair security ccp-zp-in-out source in-zone destination out-zone
service-policy type inspect ccp-inspect
exit
zone-pair security ccp-zp-self-out source self destination out-zone
service-policy type inspect ccp-permit-icmpreply
exit
interface Tunnel49
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface FastEthernet0/2
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Loopback1
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Null0
exit
default interface Null0
interface Null0
no ip unreachables
exit
interface Tunnel9
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel29
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel37
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel26
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel17
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel5
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface GigabitEthernet0/3
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
no mop enabled
exit
interface Tunnel33
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface GigabitEthernet0/2
description $FW_OUTSIDE$
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
no mop enabled
zone-member security out-zone
exit
interface Tunnel41
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface GigabitEthernet0/1
description $FW_INSIDE$
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
no mop enabled
zone-member security in-zone
exit
interface Tunnel13
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel21
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
==========================================
=============One-step-lockdown==============
==========================================
Configuration commands for the router: x.x.x.x
saved on 24/05/2012 09:43:12 Õ
----------------------------------------------------------------------------
aaa authorization exec local_author local
aaa authentication login local_authen local
no snmp-server
line vty 0 4
login authentication local_authen
authorization exec local_author
exit
service sequence-numbers
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
scheduler allocate 4000 1000
ip tcp synwait-time 10
security authentication failure rate 3 log
security passwords min-length 6
ip ssh time-out 60
ip ssh authentication-retries 2
banner login ~
Authorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!
~
logging console critical
logging trap debugging
logging buffered 51200 debugging
interface Tunnel49
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface FastEthernet0/2
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Loopback1
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Null0
exit
default interface Null0
interface Null0
no ip unreachables
exit
interface Tunnel9
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel29
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel37
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel26
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel17
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel5
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface GigabitEthernet0/3
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
no mop enabled
exit
interface Tunnel33
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface GigabitEthernet0/2
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
no mop enabled
exit
interface Tunnel41
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface GigabitEthernet0/1
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
no mop enabled
exit
interface Tunnel13
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
interface Tunnel21
no ip proxy-arp
no ip redirects
no ip unreachables
ip route-cache flow
exit
==========================================
Best Regard
