Cisco 7100 Series Especificaciones descargar pdf (Pagina 27)

Before You Begin 2-5

Considerations

— Think about access control before you connect a console port to the network in any

way, including attaching a modem to the port. Be aware that a break on the console

port might give total control of the ﬁrewall, even with access control conﬁgured.

— Apply access lists and password protection to all virtual terminal ports. Use access

lists to limit who can Telnet into your router.

— Do not enable any local service (such as Simple Network Management Protocol

[SNMP] or Network Time Protocol [NTP]) that you do not plan to use. Cisco

Discovery Protocol (CDP) and NTP are on by default, and you should turn these off

if you do not need them.

To turn off CDP, enter the no cdp run global conﬁguration command. To turn off

NTP, enter the ntp disable interface conﬁguration command on each interface not

using NTP.

IfyoumustrunNTP,conﬁgure NTP onlyon required interfaces,and conﬁgure NTP

to listen only to certain peers.

Any enabled service could present a potential security risk. A determined, hostile

party might be able to ﬁnd creative ways to misuse the enabled services to access

the ﬁrewall or the network.

For local services that are enabled, protect against misuse. Protect by conﬁguring

the services to communicate only with speciﬁc peers, and protect by conﬁguring

access lists to deny packets for the services at speciﬁc interfaces.

— Protect against spooﬁng: protect the networks on both sides of the ﬁrewall from

being spoofed from the other side. You could protect against spooﬁng by

conﬁguring input access lists at all interfaces to pass only trafﬁc from expected

source addresses, and to deny all other trafﬁc.

You should also disable source routing. For IP, enter the no ip source-route global

conﬁguration command. Disabling source routing at all routers can also help

prevent spooﬁng.

You should also disable minor services. For IP, enter the no service

tcp-small-servers and no service udp-small-servers global conﬁguration

commands.

— Prevent the ﬁrewall from being used as a relay by conﬁguring access lists on any

asynchronous Telnet ports.

1 2 ... 22 23 24 25 26 27 28 29 30 31 32 ... 111 112

Sin comentarios

Cisco 7100 Series Especificaciones Pagina 27