Please enable JavaScript.
Coggle requires JavaScript to display documents.
CHAPTER 26: NETWORK DEVICE ACCESS CONTROL AND INFRASTRUCTURE SECURITY…
CHAPTER 26:
NETWORK DEVICE ACCESS CONTROL AND INFRASTRUCTURE SECURITY
Access Control Lists (ACLs)
Sequence of ACE that perform permit or deny packet classification.
Numbered Standard
(1-100, 1300-1999)
Numbered Extended
(100-199, 2000-2699)
Named ACL
Port ACL:
MAC ACL to filter traffic on Layer 2 ports
VACL:
MAC ACL to filter traffic on VLANs
Bridged Traffic Order:
Inbound PACL -> Inbound VACL -> Outbound VACL
Routed Traffic Order:
Inbound PACL -> Inbound VACL -> Inbound ACL -> Outbound ACL -> Outbound VACL
Terminal Lines and Password Protection
Methods to gain access
Console line
AUX line
Virtual line
Protection Mechanisms
Inline Password
Type 0
like
'enable password'
Type 5
like
'enable secret'
Type 7
use Vigenere cypher encryption with
'service password-encryption'
Type 8
use
PBKDF2
and
Type 9
use
SCRYPT
Username-based authentication
with:
'username {username} algorithm-type {md5|sha256|scrypt} secret {password}'
AAA
Role-Based Access Control (RBAC)
Privilege levels
Level 0:
'disable', 'enable', 'exit', 'help', and 'logout'
Level 1:
EXEC Mode (R1>)
Level 15:
Privileged EXEC Mode (R#)
Level 2-14:
Customized with 'privilege {mode} level {level} [command string]
AAA
Architectural framwork for enabling AAA functions
Functions
Authentication
Identifies a user prior to being granted access to a network
Authorization
Defines access privileges add restrictions
Accounting
Track and log user access events (start-stop, executed commands, so on)
AAA Servers
TACACS+
Cisco protocol that uses TCP 49 with the capability to separate authentication, authorization, and accounting.
RADIUS
IETF protocol that supports EAP for dot1x
Zone Based Firewall (ZBFW)
Stateful that provides security by stablishing zones
Sytem Built-in Zones
The Self Zone
The Default Zone
Control Plane Policing (CoPP)
QoS policy map to limit the traffic from/to router's control-plane
Device Hardening
Disable CDP/LLDP
Enable TCP keepalives
Disable IP redirects
Disable proxy ARP
Disable service configuration
Disable MOP
Disable PAD