ASR-9006 MGMT Security

[mspdog22]

Hello

I am new to ASR and IOS-xr

I am faced with securing the ASR-9K that is on the internet doing routing. I need to be able to lock down all services to each mgmt interface on each RSP Card. 

Can i get a sample config to help secure the asr?

I tried with an access list then my phone blew up saying no one can use ssh over the wan. 

Thanks for any help. 

[tkarnani]

Hi,

here is the feature to implement management plane access

https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r7-5/system-security/configuration/guide/b-system-security-cg-asr9000-75x/implementing-management-plane-protection.html

sample of MPP below

https://community.cisco.com/t5/service-providers-knowledge-base/asr9000-xr-local-packet-transport-services-lpts-copp/ta-p/3123792

Thank you

[MHM Cisco World]

What service you need to deny?

MHM

[mamikhai]

this might have some info https://drive.google.com/file/d/1JPlUf21RsHsozOpTYvNI_aQnpZzsQSn5/view?usp=drive_link 

[GhufranPervaiz2]

To secure the ASR-9K, enable SSH access with public key authentication, disable unused services like HTTP, Telnet, and SNMP, enable logging for security events, and configure a strong password for enable mode.