安全IE备考之CISCODevicesSecurity.docVIP

Introduction介绍Thisdocument lists all the optionthat is recommended to help you secureyour CISCO IOS systemdevices,which increases the overall security ofyour network这篇文档包含了建议你使用的一些安全选项，旨在帮助你加强使用CISCO IOS系统的设备的安全性，从整体上整体加强网路安全。 以下内容需要回复才能看到 service sequence-numbers Eachsystem status messages logged inthe system logging process have asequence reference number applied.This command makes that numbervisible by displaying it with themessage. The sequence number isdisplayed as the first part of thesystem status message.每个记录的系统状态信息在进行记录的时候都会有一个对应的序列号。这个命令可以使在显示这条记录的时候显示这个序列号。这个序列号在每条记录的最前面。!service sequence-numbers !clock setGenerally,if the system issynchronized by a valid outside timing mechanism, suchas a Network TimeProtocol (NTP) or VINES clock source, or if you havea router with ahardware clock, you need not set the software clock.Use this command ifno other time sources are available. The timespecified in this commandis assumed to be in the time zone specifiedby the configuration of theclock timezone command. 一般的，如果系统时间可以使用外部可用的NTP或者VINES时钟，或者你的路由器有个一硬件时钟，你不需要自己设置时钟。但是如果没有这些时钟，下面的命令可以指定系统时钟。!clock set hh:mm:ss day month year!clock timezone To set the time zone for display purposes, use the clock timezone command in global configuration mode.使用下面的命令设置时区。!clock timezone GMT +8!No Service Password-RecoveryTheNo Service Password-Recoveryfeature is a security enhancement thatprevents anyone with consoleaccess from accessing the routerconfiguration and clearing thepassword. It also prevents anyone fromchanging the configurationregister values and accessing NVRAM.No Service Password-Recovery是一个加强安全功能的命令，可以阻止任何从 console口连接到路由器的人试图删除密码，而且可以防止修改配置寄存值以及进入NVRAM。!no service password-recovery!spanning-tree portfastUsethis feature . the interface,whichis connected to an end devices,suchas a workstation,Never use thePortFast feature . switch ports thatconnect to other switches, hubs, orrouters. 在连接到终端设备的端口上打开这个功能，比如说工作站，千万不要使用在连接到其他交换机、集线器或者路由器的