前兩天在路由器試用了一個命令:auto secure，這個命令用起來比較方便，而且可以關閉一些不安全的服務和啟用一些安全的服務。然後對這個命令做了一個總結。(注:好像ios版本為:12.3(1)以上才支持使用)
總結如下:
1、關閉一些全局的不安全服務如下:
finger
pad
small servers
bootp
http service
identification service
cdp
ntp
source routing
2、開啟一些全局的安全服務如下:
password-encryption service
tuning of scheduler interval/allocation
tcp synwait-time
tcp-keepalives-in and tcp-kepalives-out
spd configuration
no ip unreachables for null 0
3、關閉接口的一些不安全服務如下:
icmp
proxy-arp
directed broadcast
disables mop service
disables icmp unreachables
disables icmp mask reply messages.
4、提供日誌安全如下:
enables sequence numbers & timestamp
provides a console log
sets log buffered size
provides an interactive dialogue to configure the logging server ip address.
5、保護訪問路由器如下:
checks for a banner and provides facility to add text to automatically configure:
login and password
transport input & output
exec-timeout
local aaa
ssh timeout and ssh authentication-retries to minimum number
enable only ssh and scp for access and file transfer to/from the router
6、保護轉發forwarding plane
enables cisco express forwarding (cef) or distributed cef on the router， when available
anti-spoofing
blocks all iana reserved ip address blocks
blocks private address blocks if customer desires
installs a default route to null 0， if a default route is not being used
configures tcp intercept for connection-timeout， if tcp intercept feature is available and the user is interested
starts interactive configuration for cbac on interfaces facing the internet， when using a cisco ios firewall image，
enables netflow on software forwarding platforms