Part-3 : Network Security Fundamentals

Device Access Control

Securing network devices themselves is a foundational element of overall network security. Unauthorized access to routers, switches, firewalls, and other infrastructure components can lead to configuration changes, data breaches, or complete network disruption. This chapter focuses on the essential mechanisms for controlling and monitoring access to these critical devices.

2.1 Configuring and Verifying Local Passwords

Local passwords are the most basic form of device access control. They are configured directly on the device and are used to authenticate users attempting to access the device's command-line interface (CLI) via console, Telnet, or SSH. While simple, their proper configuration is vital.

Console Port Security

The console port provides direct, out-of-band access to a device. It is crucial to secure this port to prevent unauthorized physical access.

Router(config)# line console 0

Router(config-line)# password ciscoconsole

Router(config-line)# login

Router(config-line)# exec-timeout 5 0

Router(config-line)# logging synchronous

Router(config-line)# exit

password ciscoconsole: Sets the password for console access.
login: Enables password authentication for the console line.
exec-timeout 5 0: Sets the console session timeout to 5 minutes and 0 seconds of inactivity.
logging synchronous: Prevents console messages from interrupting command input.

VTY (Telnet/SSH) Port Security

Virtual Teletype (VTY) lines are used for remote access to the device via Telnet or SSH. SSH is highly recommended over Telnet due to its encryption capabilities.

Telnet Configuration (Not Recommended for Production):

Router(config)# line vty 0 4

Router(config-line)# password cisconet

Router(config-line)# login

Router(config-line)# transport input telnet

Router(config-line)# exit

SSH Configuration (Recommended):

To enable SSH, you need to configure a hostname, domain name, generate RSA keys, and set local usernames and passwords.

Router(config)# hostname R1

R1(config)# ip domain-name thenetworkdna.com

R1(config)# crypto key generate rsa modulus 1024

R1(config)# username admin secret ciscopass

R1(config)# line vty 0 4

R1(config-line)# transport input ssh

R1(config-line)# login local

R1(config-line)# exit

hostname and ip domain-name: Required for RSA key generation.
crypto key generate rsa: Generates the cryptographic keys for SSH.
username admin secret ciscopass: Creates a local user account for authentication.
transport input ssh: Configures the VTY lines to accept only SSH connections.
login local: Authenticates users against the local username database.

Verification Commands

show running-config | section line: Verifies line configurations.
show users: Shows active console and VTY sessions.
show ssh: Displays SSH status and connections.

Part-3 : Network Security Fundamentals