路由器速查表.docxVIP

路由器安全配置速查表 来源：FUMTEK Blog 作者：FUMTEK Specific Recomme ndati ons: Router Access Shut dow n unn eeded services on the router. Servers that are not running cannot break. Also, more memory and processor slots are available. Start by running the show proc comma nd on the router, the n turn off clearly unn eeded facilities and services. Someservers that should almost always be turned off and the corresponding comma nds to disable them are listed below. Small services (echo, discard, charge n, etc.) no service tcp-small-servers no service udp-small-servers BOOTP - no ip bootp server Fin ger - no service fin ger HTTP - no ip http server SNMP - no sn mp-server Shut down unneeded services on the routers. These services allow certain packets to pass through the router, or send special packets, or are used for remote router con figurati on. Some services that should almost always be turned off and the corresp onding comma nds to disable them are listed below. CDP - no cdp run Remote con fig. - no service config Source routi ng - no ip source-route The in terfaces on the router can be made more secure by using certa in comma nds in the Con figure In terface mode. These comma ndsshould be applied to every in terface. Unu sed in terfaces - shutdow n No Smurf attacks - no ip directed-broadcast Mask replies - no ip mask-reply Ad-hoc rout ing - no ip proxy-arp The con sole li ne, the auxiliary line and the virtual termi nal lines on the router can be made more secure in the Con figure Line mode. The con sole line and the virtual terminal lines should be secured as show n below. The Aux line should be disabled, as show n below, if it is not being used. Con sole Line - li ne con 0 exec-timeout 5 0 logi n Auxiliary Line - line aux 0 no exec exec-timeout 0 10 tran sport in put none VTY lines - li ne vty 0 4 exec-timeout 5 0 logi n tran sport in put telnet ssh Passwords can be con figured more securely as well. Con figure the En able Secret password, which is protected with an MD5-based al