ALICE

create users in the routers beforehand!!

ALICE(config)# username user privilege 15 password Ciscoccnas

STEP 1. Basic router hardening (do it in all routers if needed)

//////////
-set up to only accept min 10 length password
ALICE(config)# security passwords min-length 10

-encrypted privileged level password

ALICE(config)# enable secret 123passwords

-encryption for all cleartext passwords in the config file

ALICE(config)# service password-encryption

-console and vty lines configurations

(using local database for login, disconnect after 20min 0sec idle)

ALICE(config)# line con 0

ALICE(config-line)# login local
ALICE(config-line)# exec-timeout 20 0

ALICE(config)# line vty 0 15

ALICE(config-line)# login local
ALICE(config-line)# exec-timeout 20 0

-disable CDP protocol (Cisco Discovery Protocol that collects directly connected
neighbor devices)
it is on s0/0/0 port (way to the internet)

ALICE(config)# int s0/0/0

ALICE(config-int)# no cdp enable
---------------------------
STEP 2. and 3. secure Network Management config on the router

-disable logins for 30 sec after 3 failed login attempts within 60 seconds; on all
vty lines
ALICE(config)# login block-for 30 attempts 3 within 60

-config the router as an NTP client on the AAA/NTP/Syslog server (see at the
bottom, ip address: 172.16.25.2)
ALICE(config)# ntp server 172.16.25.2

- update router calendar from NTP (Network Time Protocol)

ALICE(config)# ntp update-calendar

-timestamp log messages

ALICE(config)# service timestamps log datetime msec

-send logging messages to the AAA/NTP/Syslog server

ALICE(config)# logging host 172.16.25.2

- log any failed/successful login attempts to the syslog server

ALICE(config)# login on-failure log
ALICE(config)# login on-success log

- config router to accept SSH connections

(domain name, generate RSA key, SSH version 2, timeout/retry, enable input SSH on
vty)
ALICE(config)# ip domain-name theccnas.com
ALICE(config)# crypto key generate rsa
(modulo is 1024)
ALICE(config)# ip ssh version 2
ALICE(config)# line vty 0 15
ALICE(config-line)# transport input ssh

- configure the router with server-based AAA (here: RADIUS server is configured
already)
> enable AAA:
ALICE(config)# aaa new-model

> set radius server

ALICE(config)# radius-server host 172.16.25.2 key corpradius

> set RADIUS server as default AAA auth. in console and vty lines:
ALICE(config)# aaa authentication login default
ALICE(config)# line con 0
ALICE(config)# login authenticaton default
ALICE(config)# line vty 0 15
ALICE(config)# login authenticaton default

> set local database as a backup if RADIUS fails:

ALICE(config)# aaa authentication login default group radius local
---------------
STEP 4. ACL config on the router to implement secure Management Access
(ACL: Access Control List)

- create ACL 12 to implement on vty lines,

only users logged on from Admin PC (ip: 172.16.25.5) are allowed to access vty
lines

ALICE(config)# access-list 12 permit host 172.16.25.5

-implement on the vty lines:

ALICE(config)# line vty 0 15
ALICE(config-line)# access-class 15 in