Cisco Routers provide routing capabilities to forward IP Packets across LAN and WAN.
Securing these routes and protecting the Router Infrastructure is critical to any enterprise running Cisco ISR and Enterprise routers.
A typical enterprise owns and operates infrastructure to meet their business needs.
Infrastructure devices include:
Securing these infra devices is the responsibility of a network security professional.
In CCNA Security, you learn some of these security strategies to harden and secure these infra devices.
In this Article, I am writing more specifically about Cisco ISR Routers and strategies to secure and harden them.
Threat actors (Hackers) try to gain access to Routers to gather network infrastructure details and steal sensitive and confidential files stored in the LAN.
As Router is an edge device which is the backbone for any LAN or Internal Network. It’s crucial to protect these devices.
In a realistic scenario a threat actor can get access to router and
- erase startup config
- gain access to configuration mode
- enters critical commands ( routing protocols, NAT etc)
To prevent unauthorized access to Routers, A network security engineer must implement:
- Router Hardening Strategies
- security policies and access control strategies
Below Image represents an edge router used in the LAN Premise.
Image Credit: Cisco
Cisco ISR Router Security Infra Strategy
Normally, you have 3 approaches to network security talking about routers.
As shared above, you can have an edge router as a single entry point into the network or you can have multiple architecture strategies.
3 Common Network Approaches include:
- Edge Network aka Single Router Approach
- Defense in depth approach
- DMZ Approach
Image Credit- Cisco – Cisco Learn
Single Router Approach
In Single Router Approach, only one router also called an Edge Router.
This is suitable for – SOHO Sites, Home Offices and small branch sites.
Security hardening is performed on edge routers and appropriate security configurations are implemented.
As shown in figure, traffic entering the edge router from public networks (internet) is secured at the edge perimeter and is blocked and filtered by the edge router where – security config and access controls are implemented.
Defense-in-depth-approach
defense in depth is a cybersecurity strategy which provides a layer based security approach to protect security infra.
In this scenario our considering only routers, you have 2 routers implemented in the defense in depth approach
.
Edge Router facing Internet is secured with firewall appliance in the middle and Another Router is placed Internally at the LAN Facing.
Applying this infra architecture helps secure the internal LAN Further from the Internet.
Edge Router which misses malicious traffic will be further monitored via firewall integration and will pass the IP Traffic through the LAN facing Router providing security, redundancy and more reliability for the overall network architecture.
DMZ Network Approach
This approach includes an intermediate area, often called the demilitarized zone (DMZ).
The DMZ can be used for servers that must be accessible from the internet or some other external network.
The DMZ can be set up between two routers, with an internal router connecting to the protected network and an external router connecting to the unprotected network.
The firewall is located between the protected and unprotected networks. The firewall is set up to permit the required connections, such as HTTP, from the outside (untrusted) networks to the public servers in the DMZ. The firewall serves as the primary protection for all devices in the DMZ.
Areas of Router Security
Securing Routers have various layers and areas, helping admins with more clarity and a broader lens.
3 Common areas of router security include:
- Physical Security
- Operating System Security
- Router Hardening
Physical Security
Physical security of routers include restricting access to routers and maintaining in a secure physical location.
Security Strategies include – Placing Routers in physical racks in a secured locked room which is accessible to only authorized network admins working on it.
Implementation of fire suppression, temperature and humidity controls for disaster recovery strategy.
Installation of UPS ( Uninterurepted power supply) and redundant power supply in network devices. This reduces the possibility of a network outage from power loss or failed power equipment.
Operating System Security
Operating system in routers are called Cisco IOS Software.
Cisco IOS is an operating system of routers.
Updating ios version is critical security feature admins must focus as encryption features are improved and updated and prevents vulnerabilities in cisco routers.
Keeping a secure copy of router IOS images and router configuration files as backups.
Configuring routers with the maximum amount of memory possible to avoid and prevent Network access attacks like DOS and DDOS Attacks.
Router Hardening
Router hardening is most critical to protect network infra and limit network access within the LAN.
Some Network Security strategies to harden routers include:
- Implement security on unused ports on routers
- Implementing secure admin access to ensure only authorized admins have access to router configurations
- reducing number of options to access router device
- Disable unused and less important services running on cisco ios
I will share tutorials on router hardening in coming ccna network series.
This Article is the 2nd blog article on cisco ccna security demonstrating on the basics on cisco router security and the practical landscape to achieve it.
Secure Administrative Cisco Router Access
Securing administrative access is an extremely important security task. If an unauthorized person gains administrative access to a router, that person could alter routing parameters, disable routing functions, or discover and gain access to other systems within the network.
Critical admin access strategies include:
- Restrict router access
- Authentication of access to authorized admins
- Authorization implementation
- Implement legal consent and notificatication
- ensuring confidentiality of data
- Encrypting and securing access of information
- Implementing and monitoring logging and accounting information on cisco routers
I will share lab demonstrated tutorials showcasing secure administrative access of cisco routers in next series.
Bookmark this article on your Browser:
- Chrome
- Safari
- Mozilla
- Microsoft edge
In this Article, I am sharing one LAB Tutorial on implementing password on cisco routers and securing them.
Router Administrative access methods
There are two ways to access cisco router enforcing authorization access policies.
- Locally
- Remote
Cisco Router Locally Access
All network infrastructure devices can be accessed locally.
Local access to a Cisco router usually requires a serial connection to a console port on the Cisco router, and using a computer that is running terminal emulation software. An example of emulation software is Putty.
The administrator must have physical access to the router and use a console cable to connect to the console port. Local access is typically used for initial configuration of the device.
Remote Access
Securing Cisco Router with Login Password
In this short tutorial/article, I am sharing CCNA Security password implementation blog article using cisco packet tracer lab simulation.
Tutorial showcases:
- Adding Cisco Router in Packet Tracer
- Implementing login password on Cisco Router
As you can see the image above.
To add password for cisco router login, follow these series of commands.
Router>
Router> enable
Router#configure terminal
Router(config)#line console 0
Router(config-line)#password cisco
Router(config-line)#login
router(config-line)#end
After implementing these commands, you have successfully added password when logging into cisco router.
This verifies that the password implementation has been successfully.
As you can see here above, after entering the password you have acccess to cisco router ios and privilege mode.
Now to further secure and limit access to privilege mode, you can add and implement another command to limit privilege access.
Password implementation to secure and limit privellege mode on Cisco Router IOS
Follow these series of commands:
Router > Enable
Configure terminal
enable secret “password”
enable secret cisco
end
Verify the commands by refering the image below.
As you can see we have secured cisco isr router and cisco ios access.
A network admin must login two times to gain access to
- Cisco IOS
- Cisco IOS Privilege Mode
