Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 6: Device Monitoring and Management - Coggle Diagram

- - - - There are several consequences of routing information being spoofed:
        
        Redirecting traffic to create routing loops
        
        Redirecting traffic so it can be monitored on an insecure link
        
        Redirecting traffic to discard it
  - - - OSPF SHA authentication includes two major steps. The syntax for the commands is shown in the figure:
        
        Step 1. Specify an authentication key chain in global configuration mode:
        
        Configure a key chain name with the key chain command.
        
        Router(config)# key chain name
        
        Assign the key chain a number and a password with the key and key-string commands.
        
        Router(config-keychain)# key key-id
        Router(config-keychain-key)# key-string string
        
        Specify SHA authentication with the cryptographic-algorithm command.
        
        Router(config-keychain-key)# cryptographic-algorithm {hmac-sha-1 | hmac-sha-256 | hmac-sha-384 | hmac-sha-512 | md5}
        
        (Optional) Specify when this key will expire with the send-lifetime command.
        
        Router(config-keychain-key)# send-lifetime start-time {infinite | end-time | duration seconds}
        
        Step 2. Use the following syntax to assign the authentication key to the desired interfaces with the ip ospf authentication key-chain command.
        
        Router(config)# interface type number
        Router(config-if)# ip ospf authentication key-chain name
  - - - Enable OSPF MD5 authentication globally:
        
        ip ospf message-digest-key key md5 password interface configuration command.
        
        area area-id authentication message-digest router configuration command.
        
        This method forces authentication on all OSPF enabled interfaces. If an interface is not configured with the ip ospf message-digest-key command, it will not be able to form adjacencies with other OSPF neighbors.
      - Enable MD5 authentication on a per interface basis:
        
        ip ospf message-digest-key key md5 password interface configuration command.
        
        ip ospf authentication message-digest interface configuration command.
    - - R1# show run | begin router ospf
        router ospf 1
        passive-interface GigabitEthernet0/1
        network 10.1.1.0 0.0.0.3 area 0
        network 192.168.1.0 0.0.0.255 area 0
        !<output omitted>
        !--------------------------------
        R2# show run | begin router ospf
        router ospf 1
        passive-interface GigabitEthernet0/1
        network 10.1.1.0 0.0.0.3 area 0
        network 192.168.2.0 0.0.0.255 area 0
        !<output omitted>
    - - R1# conf t
        R1(config)# interface s0/0/0
        R1(config-if)# ip ospf message-digest-key 1 md5 cisco12345
        R1(config-if)# ip ospf authentication message-digest
        R1(config-if)#
        000209: Feb 20 13:59:35.091 UTC: %OSPF-5-ADJCHG: Process 1, Nbr 10.1.1.2 on
        Serial0/0/0 from FULL to DOWN, Neighbor Down: Dead timer expired
        R1(config-if)#
        000210: Feb 20 14:01:09.975 UTC: %OSPF-5-ADJCHG: Process 1, Nbr 10.1.1.2 on
        Serial0/0/0 from LOADING to FULL, Loading Done
        R2# conf t
        000137: Feb 20 13:59:35.091 UTC: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.1 on
        Serial0/0/0 from FULL to DOWN, Neighbor Down: Dead timer expired
        R2(config)# interface s0/0/0
        R2(config-if)# ip ospf message-digest-key 1 md5 cisco12345
        R2(config-if)# ip ospf authentication message-digest
        R2(config-if)#
        000138: Feb 20 14:01:09.975 UTC: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.1 on
        Serial0/0/0 from LOADING to FULL, Loading Done
        R2(config-if)#
- - - - get request - Used by the NMS to query the device for data.
      - set request - Used by the NMS to change configuration variables in the agent device. A set request can also initiate actions within a device. For example, a set request can cause a router to reboot, send a configuration file, or receive a configuration file.
  - - - SNMPv1 - This is the Simple Network Management Protocol, a Full Internet Standard, that is defined in RFC 1157.
      - SNMPv2c - This is defined in RFCs 1901 to 1908. It uses a community-string-based Administrative Framework.
      - SNMPv3 - This is an interoperable standards-based protocol originally defined in RFCs 2273 to 2275. It provides secure access to devices by authenticating and encrypting packets over the network. It includes these security features: message integrity to ensure that a packet was not tampered with in transit, authentication to determine that the message is from a valid source, and encryption to prevent the contents of a message from being read by an unauthorized source.
  - - - Message integrity and authentication - Ensures that a packet has not been tampered with in transit, and is from a valid source.
      - Encryption - Scrambles the contents of a packet to prevent it from being seen by an unauthorized source.
      - Access control - Restricts each principal to certain actions on specific portions of data.
- - - - IP address: 192.168.1.254
  - - - Router# auto secure {no-interact | full} [forwarding | management] [ntp | login | ssh | firewall | top-intercept]
- - - - Step 1. Reload the router using the reload command. If necessary, issue the break sequence to enter ROM monitor (ROMmon) mode.
        
        Router# reload
      - Step 2. From ROMmon mode, enter the dir command to list the contents of the device that contains the secure bootset file.
        
        rommon 1 > dir flash0:
      - Step 3. Boot the router with the secure bootset image using the boot command followed by the flash memory location (e.g. flash0), a colon, and the filename found in Step 2.
        
        rommon 2 > boot flash0:c2900-universalk9-mz.SPA.154-3.M.bin
      - Step 4. Enter global configuration mode and restore the secure configuration to a filename of your choice using the secure boot-config restore command followed by the flash memory location (e.g. flash0), a colon, and a filename of your choice. In the figure, the filename rescue-cfg is used.
        
        Router(config)# secure boot-config restore flash0:rescue-cfg
      - Step 5. Exit global configuration mode and issue the copy command to copy the rescued configuration file to the running configuration.
        
        Router# copy flash0:rescue-cfg running-config
  - - - Relies on
        
        SSH: Secures the communication.
        
        AAA: Provides authentication and authorization.
      - Steps to Configure SCP on a Router
        
        Step 1: Configure SSH
        Ensure SSH is set up if not already configured.
        
        Step 2: Create a Local Database User
        Configure at least one local user with privilege level 15 (for full access).
        
        R1(config)# username Bob privilege 15 algorithm-type scrypt secret cisco12345
        
        Step 3: Enable AAA
        Use the command aaa new-model to activate AAA services.
        
        R1(config)# aaa new-model
        
        Step 4: Configure AAA Authentication
        Use aaa authentication login default local to specify local authentication.
        
        R1(config)# aaa authentication login default local
        
        Step 5: Configure AAA Authorization
        Set command authorization with aaa authorization exec default local for EXEC commands.
        
        R1(config)# aaa authorization exec default local
        
        Step 6: Enable SCP Functionality
        Use ip scp server enable to activate the SCP server on the router.
        
        R1(config)# ip scp server enable
        
        Example Configuration on R1
        
        R1(config)# ip domain-name span.com
        R1(config)# crypto key generate rsa general-keys modulus 2048
        R1(config)# username Bob privilege 15 algorithm-type scrypt secret cisco12345
        R1(config)# aaa new-model
        R1(config)# aaa authentication login default local
        R1(config)# aaa authorization exec default local
        R1(config)# ip scp server enable
        
        Copying a File to the SCP Server
        
        Source Router (R2)
        
        R2# copy flash0:R2backup.cfg scp:
        Address or name of remote host []? 10.1.1.1
        Destination username [R2]? Bob
        Destination filename [R2backup.cfg]?
        Writing R2backup.cfg
        Password: <cisco12345>
        !
        1381 bytes copied in 8.596 secs (161 bytes/sec)
  - - - Step 1. Connect to the console port.
      - Step 2. Use the show version command to display the configuration register setting and document the value (e.g., 0x2102).
      - Step 3. Power cycle the router.
      - Step 4. Issue the break sequence (e.g., CTRL-BREAK) to enter ROMMON mode.
      - Step 5. Change the default configuration register with the confreg 0x2142 command.
      - Step 6. Reboot the router by using the reset command in ROMMON mode.
      - Step 7. Press Ctrl-C to skip the initial setup procedure.
      - Step 8. Enter privileged EXEC mode.
      - Step 9. Copy the startup configuration to the running configuration using the copy startup-config running-config command.
      - Step 10. Verify the configuration.
      - Step 11. Change the enable secret password.
      - Step 12. Enable all interfaces using the no shutdown command.
      - Step 13. Return the configuration register setting to the original setting that was documented in Step 2 with the config-register global configuration command. On the next reboot, the router will use these settings and load the new startup configuration file that contains the changed password.
      - Step 14. Save the configuration changes.
  - - - ATA Interface Needed
        
        System must run an image from a flash drive with an ATA interface.
      - Image Must Be Loaded from Persistent Storage
        
        Images loaded from remote locations (e.g., TFTP servers) cannot be secured.
      - Console Session Required to Disable
        
        Feature can only be turned off through a console session using no form of the command.
    - - View Secure Files Using
        
        Command: show secure bootset
        Displays information about the secured IOS image and configuration archive.
      - Secured Files Information Includes
        
        IOS image details (file type, size, entry point).
        Configuration archive details (file name, size).
    - - Enabling image resilience
        
        R1(config)# secure boot-image
        %IOS_RESILIENCE-5-IMAGE_RESIL_ACTIVE: Successfully secured running image
      - Enabling configuration resilience
        
        R1(config)# secure boot-config
        %IOS_RESILIENCE-5-CONFIG_RESIL_ACTIVE: Successfully secured config archive [flash0:.runcfg-20200922-124717.ar]
      - Verifying secured files
        
        R1# show secure bootset
        IOS resilience router id FTX1449AJBJ
        IOS image resilience version 15.4 activated at [date/time]
        Secure archive flash0:c2900-universalk9-mz.SPA.154-3.M.bin
    - - Configuration Archive Characteristics
        
        Archive is hidden; not visible from CLI using the dir command.
        Secure files are protected by the Cisco IOS file system.
      - Updating the Archive
        
        Use the secure boot-config command to update the configuration archive with new changes.
    - - Secure IOS Image
        
        Command: secure boot-image
        Secures the running IOS image.
        Generates a log entry when enabled for the first time.
      - Secure Running Configuration
        
        Command: secure boot-config
        Takes a snapshot of the current running configuration.
        Archives the configuration in persistent storage.
  - - - Disable Password Recovery
        
        Use the no service password-recovery command to disable password recovery.
        
        R1(config)# no service password-recovery
  - - - Efficient Use of Storage
        
        Secures the smallest set of files to save storage space.
        Requires no extra space for securing the IOS image.
      - Version Mismatch Detection
        
        Automatically detects mismatches between image or configuration versions.
      - Configuration File in Primary Bootset
        
        Is a snapshot of the running configuration when the feature was first enabled.
    - - Provides faster recovery if flash memory is reformatted or the startup configuration is erased.
        Maintains a secure working copy of the IOS image and running configuration.
    - - Feature Disablement:
        Can only be disabled via a console session.
      - Compatibility:
        Available only on older routers with PCMCIA ATA flash interface.
        Not supported on newer routers like the ISR 4000 series.
    - - Uses Only Local Storage:
        Avoids maintenance challenges related to storing multiple images/configurations on external servers.
      - No TFTP Server Dependency:
        Files are secured locally on the router.
    - - Primary Bootset
        
        Secure files consisting of
        
        Cisco IOS image file.
        
        Running configuration file at the time the feature was enabled.
        
        Cannot be removed by the user
- - - - This identifies a device providing the most authoritative time source. Stratum 0 devices including atomic and GPS clocks are the most accurate authoritative time sources.
    - - NTP stratum 1 devices are network devices that are directly connected to the authoritative time sources. They function as the primary network time standard to stratum 2 devices.
    - - NTP stratum 2 servers are connected on a network to a stratum 1 device. Stratum 2 devices are NTP clients and synchronize their time by using the NTP packets from a stratum 1 server such as a router. They in turn can be NTP servers for stratum 3 devices.