Router Security Configuration Guide 1.1c - National Security Agency

304 Pages·2005·1.98 MB·English

Report Number: C4-040R-02
Router Security
Configuration Guide
Principles and guidance for secure configuration of IP routers,
with detailed instructions for Cisco Systems routers

Router Security Guidance Activity
of the
System and Network Attack Center (SNAC)
Authors:
Vanessa Antoine December 15, 2005
Raymond Bongiorni Version: 1.1c
Anthony Borza
Patricia Bosmajian
Daniel Duesterhaus
Michael Dransfield
Brian Eppinger
Kevin Gallicchio
Stephen Hamilton
James Houser
Andrew Kim
Phyllis Lee
Brian McNamara
Tom Miller
David Opitz
Florence Richburg
Michael Wiacek
Mark Wilson
Neal Ziring
National Security Agency

9800 Savage Rd. Suite 6704
Ft. Meade, MD 20755-6704

[email protected]
Router Security Configuration Guide
Warnings
This document is only a guide to recommended security settings for Internet Protocol
(IP) routers, particularly routers running Cisco Systems Internet Operating System
(IOS) versions 11.3 through 12.4. It cannot replace well-designed policy or sound
judgment. This guide does not address site-specific configuration issues. Care must
be taken when implementing the security steps specified in this guide. Ensure that
all security steps and procedures chosen from this guide are thoroughly tested and
reviewed prior to imposing them on an operational network.
SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE EXPRESSLY DISCLAIMED. IN NO EVENT SHALL THE
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This document is current as of October, 2005. The most recent version of this
document may always be obtained through http://www.nsa.gov/.
Acknowledgements
The authors would like to acknowledge Daniel Duesterhaus, author of the original
NSA “Cisco Router Security Configuration Guide,” and the management and staff of
the Applications and Architectures division for their patience and assistance with the
initial development of this guide. Special thanks also go to Ray Bongiorni for quality
assurance and editorial work, and to Julie Martz and Kathy Jones for proof-reading
assistance. Additional contributors to the guide effort include Andrew Dorsett,
Charles Hall, Scott McKay, and Jeffrey Thomas. Thanks must also be given to the
dozens of professionals outside NSA who made suggestions for the improvement of
this document, especially George Jones, John Stewart, and Joshua Wright.
Trademark Information
Cisco, IOS, and CiscoSecure are registered trademarks of Cisco Systems, Inc. in the
USA and other countries. Windows 2000 and Windows XP are registered trademarks
of Microsoft Corporation in the USA and other countries. All other names are
trademarks or registered trademarks of their respective companies.
Revision History
1.0 Sep 2000 First complete draft, extensive internal review.
1.0b Oct 2000 Revised after review by Ray Bongiorni
1.0f Mar 2001 Second release version: second pre-pub review
1.0g Apr 2001 Third release version: incorporated external feedback.
1.0h Aug 2001 Fourth release version; another QA review.
1.0j Nov 2001 Fifth release version.
1.0k Mar 2002 Last release of 1.0, another pre-pub review.
1.1 Sep 2002 Major revision and expansion, another pre-pub review
1.1b Dec 2003 Minor revision, corrections, additions, fixed links
1.1c Dec 2005 Updated, fixed inconsistencies, checked links
2 Version 1.1c
Contents
Contents
Preface 5
1. Introduction 7
1.1. The Roles of Routers in Modern Networks.....................................................................7
1.2. Motivations for Providing Router Security Guidance......................................................9
1.3. Typographic and Diagrammatic Conventions Used in this Guide.................................10
1.4. Structural Overview.......................................................................................................12
2. Background and Review 15
2.1. Review of TCP/IP Networking......................................................................................15
2.2. TCP/IP and the OSI Model............................................................................................17
2.3. Review of IP Routing and IP Architectures...................................................................19
2.4. Basic Router Functional Architecture............................................................................24
2.5. Review of Router-Relevant Protocols and Layers.........................................................27
2.6. Quick “Review” of Attacks on Routers.........................................................................29
2.7. References......................................................................................................................30
3. Router Security Principles and Goals 33
3.1. Protecting the Router Itself............................................................................................33
3.2. Protecting the Network with the Router.........................................................................35
3.3. Managing the Router......................................................................................................43
3.4. Security Policy for Routers............................................................................................46
3.5. References......................................................................................................................51
4. Implementing Security on Cisco Routers 54
4.1. Router Access Security..................................................................................................55
4.2. Router Network Service Security...................................................................................70
4.3. Access Control Lists, Filtering, and Rate Limiting........................................................83
4.4. Routing and Routing Protocols....................................................................................102
4.5. Audit and Management................................................................................................139
4.6. Security for Router Network Access Services.............................................................175
4.7. Collected References....................................................................................................202
5. Advanced Security Services 204
5.1. Role of the Router in Inter-Network Security..............................................................204
5.2. IP Network Security.....................................................................................................205
5.3. Using SSH for Remote Administration Security.........................................................227
5.4. Using a Cisco Router as a Firewall..............................................................................232
5.5. Cisco IOS Intrusion Detection.....................................................................................241
5.6. References....................................................................................................................247
6. Testing and Security Validation 250
Version 1.1c 3
Router Security Configuration Guide
6.1. Principles for Router Security Testing.........................................................................250
6.2. Testing Tools................................................................................................................250
6.3. Testing and Security Analysis Techniques..................................................................251
6.4. Using the Router Audit Tool........................................................................................258
6.5. References....................................................................................................................261
7. Additional Issues in Router Security 263
7.1. Routing and Switching.................................................................................................263
7.2. IPv6..............................................................................................................................265
7.3. ATM and IP Routing....................................................................................................266
7.4. Multi-Protocol Label Switching (MPLS).....................................................................267
7.5. IPSec and Dynamic Virtual Private Networks.............................................................268
7.6. Tunneling Protocols and Virtual Network Applications..............................................269
7.7. IP Quality of Service (QoS) and RSVP........................................................................270
7.8. Secure DNS..................................................................................................................271
7.9. References....................................................................................................................272
8. Appendices 274
8.1. Top Ways to Quickly Improve the Security of a Cisco Router....................................274
8.2. Application to Ethernet Switches and Related Non-Router Network Hardware..........280
8.3. Overview of Cisco IOS Versions and Releases...........................................................283
8.4. Glossary of Router Security-related Terms..................................................................289
9. Additional Resources 295
9.1. Bibliography.................................................................................................................295
9.2. Web Site References....................................................................................................298
9.3. Tool References...........................................................................................................300
Index 302

4 Version 1.1c
Preface
Preface
Routers direct and control much of the data flowing across computer networks. This
guide provides technical guidance intended to help network administrators and
security officers improve the security of their networks. Using the information
presented here, you can configure your routers to control access, resist attacks, shield
other network components, and protect the integrity and confidentiality of network
traffic.
This guide was developed in response to numerous questions and requests for
assistance received by the NSA System and Network Attack Center (SNAC). The
topics covered in the guide were selected on the basis of customer interest,
community concensus, and the SNAC’s background in securing networks.
The goal for this guide is a simple one: improve the security provided by routers in
US Government operational networks.
Who Should Use This Guide
Network administrators and network security officers are the primary audience for
this configuration guide, throughout the text the familiar pronoun “you” is used for
guidance directed specifically to them. Most network administrators are responsible
for managing the connections within their networks, and between their network and
various other networks. Network security officers are usually responsible for
selecting and deploying the assurance measures applied to their networks. For this
audience, this guide provides security goals and guidance, along with specific
examples of configuring Cisco routers to meet those goals.
Firewall administrators are another intended audience for this guide. Often, firewalls
are employed in conjunction with filtering routers; the overall perimeter security of
an enclave benefits when the configurations of the firewall and router are
complementary. While this guide does not discuss general firewall topics in any
depth, it does provide information that firewall administrators need to configure their
routers to actively support their perimeter security policies. Section 5 includes
information on using the firewall features of the Cisco Integrated Security facility.
Information System Security Engineers (ISSEs) may also find this guide useful.
Using it, an ISSE can gain greater familiarity with security services that routers can
provide, and use that knowledge to incorporate routers more effectively into the
secure network configurations that they design.
Sections 4, 5, and 6 of this guide are designed for use with routers made by Cisco
Systems, and running Cisco’s IOS software. The descriptions and examples in those
sections were written with the assumption that the reader is familiar with basic Cisco
router operations and command syntax.
Version 1.1c 5
Router Security Configuration Guide
Feedback
This guide was created by a team of individuals in the System and Network Attack
Center (SNAC), which is part of the NSA Information Assurance Directorate. The
editor was Neal Ziring. Comments and feedback about this guide may be directed to
the SNAC (Attn: Neal Ziring), Suite 6704, National Security Agency, Ft. Meade,
MD, 20755-6704, or via e-mail to [email protected].
6 Version 1.1c
Introduction
1. Introduction
1.1. The Roles of Routers in Modern Networks
On a very small computer network, it is feasible to use simple broadcast or sequential
mechanisms for moving data from point to point. An Ethernet local area network
(LAN) is essentially a broadcast network. In larger, more complex networks, data
must be directed specifically to the intended destination. Routers direct network data
messages, or packets, based on internal addresses and tables of routes, or known
destinations that serve certain addresses. Directing data between portions of a
network is the primary purpose of a router.
Most large computer networks use the TCP/IP protocol suite. See Section 2.3 for a
quick review of TCP/IP and IP addressing. Figure 1-1, below, illustrates the primary
function of a router in a small IP network.

LAN 1
190.20.2.0
Router 1
User Host
190.20.2.12
Wide Area
Network
LAN 2
14.2.6.0 LAN 3
Router 2 14.2.9.0
File Server
14.2.9.10
Figure 1-1 – A Simple Network with Two Routers
If the user host (top left) needs to send a message to the file server (bottom right), it
creates a packet with address 14.2.9.10, and sends the packet over LAN 1 to its
gateway, Router 1. Consulting its internal route table, Router 1 forwards the packet
to Router 2. Consulting its own route table, Router 2 sends the packet over LAN 3 to
the File Server. In practice, the operation of any large network depends on the route
tables in all of its constituent routers. Without robust routing, most modern networks
cannot function. Therefore, the security of routers and their configuration settings is
vital to network operation.
Version 1.1c 7
Router Security Configuration Guide
In addition to directing packets, a router may be responsible for filtering traffic,
allowing some data packets to pass and rejecting others. Filtering is a very important
responsibility for routers; it allows them to protect computers and other network
components from illegitimate or hostile traffic. For more information, consult
Sections 3, 4, and 5.
8 Version 1.1c
Introduction
1.2. Motivations for Providing Router Security Guidance
Routers provide services that are essential to the correct, secure operation of the
networks they serve. Compromise of a router can lead to various security problems
on the network served by that router, or even other networks with which that router
communicates.
• Compromise of a router’s route tables can result in reduced performance,
denial of network communication services, and exposure of sensitive data.
• Compromise of a router’s access control can result in exposure of network
configuration details or denial of service, and can facilitate attacks against
other network components.
• A poor router filtering configuration can reduce the overall security of an
entire enclave, expose internal network components to scans and attacks,
and make it easier for attackers to avoid detection.
• On the other hand, proper use of router cryptographic security features can
help protect sensitive data, ensure data integrity, and facilitate secure
cooperation between independent enclaves.
In general, well-configured secure routers can greatly improve the overall security
posture of a network. Security policy enforced at a router is difficult for negligent or
malicious end-users to circumvent, thus avoiding a very serious potential source of
security problems.
There are substantial security resources available from router vendors. For example,
Cisco offers extensive on-line documentation and printed books about the security
features supported by their products. These books and papers are valuable, but they
are not sufficient. Most vendor-supplied router security documents are focused on
documenting all of the security features offered by the router, and do not always
supply security rationale for selecting and applying those features. This guide
attempts to provide security rationale and concrete security direction, with pertinent
references at the end of each section identifying the most useful vendor
documentation. This guide also provides pointers to related books, vendor
documents, standards, and available software.
Version 1.1c 9
Router Security Configuration Guide
1.3. Typographic and Diagrammatic Conventions Used in this Guide
To help make this guide more practical, most of the sections include extensive
instructions and examples. The following typographic conventions are used as part
of presenting the examples.
• Specific router and host commands are identified in the text using Courier
bold typeface: “to list the current routing table, use the command show ip
route.” Command arguments are shown in Courier italics: “syntax for a
simple IP access list rule is access-list number permit host
address.”
• Sequences of commands to be used in a configuration are shown
separately from the text, using Courier typeface. The exclamation point
begins a comment line, usually a remark about the line that follows it.
! set the log host IP address and buffer size
logging 14.2.9.6
logging buffered 16000

• Transcripts of router sessions are shown separately from the text, using
Courier typeface. Input in the transcript is distinguished from output, user
input and comments are shown in Courier bold typeface. Elision of long
output is denoted by two dots. In some cases, output that would be too
wide to fit on the page is shown with some white space removed, to make
it narrower.
Central> enable
Password:
Central# ! list interfaces in concise format
Central# show ip interface brief
Interface IP Address OK? Method
Ethernet 0/0 14.2.15.250 YES NVRAM
Ethernet 0/1 14.2.9.250 YES Manual
.
.
Central# exit
• IP addresses will be shown in the text and in diagrams as A.B.C.D, or as
A.B.C.D/N, where N is the number of set bits in the IP netmask. For
example, 14.2.9.150/24 has a netmask of 255.255.255.0. (In general, this
classless netmask notation will be used where a netmask is relevant.
Otherwise, the bare address will be used.)
• Cisco IOS accepts the shortest unique, unambiguous abbreviation for any
command or keyword. For commands that are typed very frequently, this
guide uses many abbreviations commonly employed in the Cisco
documentation and literature. For example, the interface name ethernet
is commonly abbreviated “eth” and the command configure terminal
is commonly abbreviated “config t”.
10 Version 1.1c