- This lesson examines what you can do
to protect the management access and management protocols
used on the network.
As mentioned earlier,
the management plan is covered first in this discussion,
after all, without a configured router
whether configured through the console port
or through an IP address with a secure remote access tool
such as SSH, the network device is not much good
without a working configuration
that either an administrator
or some other type of management system,
such as Cisco DNA center has put in place.
A basic layer two switch with all ports
in the same VLAN would be functional
but this is unlikely to be desired configuration
for that device.
To secure the management plane
you should adhere to these best practices.
First, enforce password policy
including features such as maximum number of login attempts
and minimum password length.
Second implement role-based access control or RBAC.
This concept has been around for a long time
in relation to groups.
By creating a group that has specific rights
and then placing users in that group,
you can more easily manage and allocate administrators.
With RBAC, we can create a role like a group
and assign that role to the users
who will be acting in that role.
With the role comes the permissions and access.
Ways to implement RBAC include using access control server
or ACS and CLI parser views,
which restrict the commands that can be issued
in the specific view of an administrator is in.
Custom privilege level assignments are also an option
to restrict what a specific user may do
while operating at that custom privilege level.
Third, use AAA services and centrally manage those services
on an authentication server,
such as the Cisco identity services engine or ice.
With AAA a network router or a switch can interact
with a centralized server before allowing any ask access,
before allowing any command to be entered
and while keeping an audit trail that identifies
who has logged in and what commands they executed
while they were there.
Your policies about who can do what
can be configured on that central server.
And then you can configure the routers and switches
to act as clients to the server as they make their request
asking whether it's okay for a specific user to log in
or if it's okay for a specific user
to issue a specific command.
Fourth, keep accurate time across all network devices
using secure network time protocol or NTP.
Fifth use encrypted and authenticated versions of SNMP
which includes version three
and some features from version two.
Six, control which IP addresses
are allowed to initiate management sessions
with the network device.
Seven, on the infrastructure of your network,
only permit this type of traffic
between the network device IP addresses
and the destinations that the network device
is configured to send syslog messages to.
In practice, not too many people are going to encrypt
syslog data, although it is better to do so.
Short of doing encryption,
we could use an out of band method
to communicate management traffic
between our network devices and the management stations.
An example is a separate VLAN
that user traffic never goes on to.
And using that separate VLAN
just for the management traffic.
If management traffic is sent in band,
which means the management traffic
is using the same networks, same VLANs, for instance,
all management traffic needs to have encryption
either built in or have it protected by encryption,
such as using IP SEG.
Finally disable any unnecessary services
especially those that use user datagram protocol or UDP.
These are infrequently used for legitimate purposes
but can be used to launch denial of service attacks.
The following are some services that should be disabled
if they're not needed.
TCP and UDP small services,
finger, BOOTP, DHCP,
maintenance operation protocol or MOP, DNS,
packet assembler/disassembler or PAD,
HDP server and secure HDP server,
CDP, and LLDP.