Next, you must specify a routing protocol: in this case, Enhanced Interior Gateway Routing Protocol (EIGRP). To do so, use the following command:

router eigrp 2

The last step is to apply the configured access list. Use the distribute−list command to interface g0/0 to filter outbound traffic from network 192.129.0.0:

distribute−list 2 out g0/0

Security at the Access Layer

The Access layer has very few policies to apply. The switches at this layer should rely on port−level security and passwords required on the network interfaces. The Access layer policy controls physical access to the components of the network. Physical access involves the following:

∙Configuring users and passwords on the physical devices

∙Limiting Telnet access

∙Limiting access to network switches by implementing privilege levels

∙Configuring banner messages

∙Securing physical devices

∙Implementing port security

∙Managing VLANs

Configuring Passwords

Passwords can be configured on every access method to a Cisco Catalyst switch, by the VTY line, console, Web access, and auxiliary (AUX) ports.

Limiting Telnet Access

VTY access can be secured with a password—but when a careless administrator walks away from a

logged−in Telnet session, the door is open with full access to the entire network. This situation allows anyone to access the open Telnet session and bring the network to its knees.

To lower the chances for this type of vulnerability, you may want to configure a time−out condition and apply it to unused VTY sessions. Cisco IOS calculates unused sessions in seconds or minutes, depending on the IOS version. Should the session not receive a character input from the administrator’s session for the configured amount of time, the session is closed, and the administrator using the session is logged out.

Implementing Privilege Levels

Privilege levels can be assigned to limit switch users’ abilities to perform certain commands or types of commands. You can configure two types of levels in the IOS: user levels and privilege levels. A user level allows a user to perform a subset of commands that does not allow for configuration changes or debug functions. A privilege level, on the other hand, allows the user to use all the available commands, including configuration change commands.

You can assign a user 16 different levels, from level 0 to level 15. Level 1 is set to User EXEC mode by default. This level gives the user very limited access, primarily to show commands. Level 15 defaults to the Privileged EXEC mode, which gives the user full access to all configuration commands in the IOS (including the debug command).

261

Privilege level 0 is a special level that allows the user to use a more specific defined set of commands. As an example, you could allow a certain user to use only the show arp command. This command is useful when a third party is using a sniffer on your network and needs to match a MAC address to an IP address and vice versa.

Configuring Banner Messages

You have probably messed around on a non−production router or switch and placed your own saying or name in a banner. In a production environment, your switch or router greets potential threats to your network with a banner message.

Physical Device Security

Physical access to all devices on your network should be included in your access policy. Because of all types of vulnerabilities and back doors that might be available, protecting the physical access of a machine on your network is extremely important. Any one person with physical access and the correct knowledge can easily apply known techniques on a given device and gain access. Therefore, it is important to have some physical barrier between your devices and the average user. In addition, passwords should be applied to all access points that are open via the network.

Port Security

The Cisco IOS provides a feature called port security that lets you limit the MAC addresses that are allowed to use the ports on a switch. MAC addresses come pre−configured on a Network Interface Card (NIC), and because of applied industry−wide standards, no two NIC cards have the same MAC address. By configuring certain MAC addresses to use a switch port, you greatly increase control over which PCs can access the switch.

Here is how port security works: When a port on the switch receives data frames, it will compare the source MAC address to the secure source address learned by the switch. If a port receives data from a MAC address that has not yet been previously identified, the switch will lock that port and mark the port as disabled. A light on that port will then turn orange, indicating that the port has been disabled.

Note A trap link down message will automatically be sent to the SNMP manager if SNMP has been configured.

You should know a few things before trying to apply port security:

∙Do not apply port security to trunk links, because they carry data from multiple VLANs and MAC addresses.

∙Port security cannot be enabled on a Switched Port Analyzer (SPAN) source or destination port.

∙You cannot configure dynamic or static Content Addressable Memory (CAM) entries on a secure port.

262