Технологія захист інформації в локальних мережах / security_brochure(rus)

hostname Branch-Router

! set router name

enable secret ena-secret

! priviledged access password is ena-secret

username NAS-5200 password isdnsecret

! shared password for CHAP authentication

interface Ethernet 0

! define local LAN interface

description Branch connection

! interface purpose

ip address 192.150.42.1 255.255.255.0

! assign ip address

ip access 101 in

! assign input filter

interface Bri 0

! define ISDN interface

description To The Campus

! describe interface connection

ip address unnumbered Ethernet 0

! assign address as virtual address of Ethernet0

dialer map ip 144.254.5.20 name NAS-5200

! assign dial-string and associated address

4085267170

Encapsulation ppp

! define ppp encapsulation

ppp authentication chap

! enable ppp chap authentication

ip access 102 in

! define input filter list

access-list 101 permit ip 192.150.42.0 0.0.0.255

! permit all traffic from local ethernet

any

access-list 101 deny ip any any

access-list 102 deny ip 192.150.42.0 0.0.0.255 any

! block inbound packets with internal address as

source

access-list 102 deny ip 127.0.0.0 0.255.255.255

! block inbound packets with RFC reserved

any

addresses

access-list 102 deny ip 10.0.0.0 0.255.255.255 any

! as source

access-list 102 deny ip 172.16.0.0 0.240.255.255

any

access-list 102 deny ip 192.168.0.0 0.0.255.255

any

access-list 102 permit ip any any

line con 0

login

password con-secret

! password for console access is con-secret

line aux 0

transport input none

! no telnet access via aux port

no exec

! don't get prompt on aux port

line vty 0 4

login

password vty-secret

! password for telnet access is vty-secret

interface Serial0:23

! configuring PRI

description To The Branch

ip unnumbered Loopback0

! users will be on subnet defined under loopback 0

peer default ip address pool default

! assign IP addresses from pool named 'default'

Encapsulation ppp

! specify ppp encapsulation

ppp authentication chap pap

! define chap authentication with pap as fallback

dialer map ip 192.150.42.1 name Branch-

Router

dialer-group 1

! define which packets keep link up as set by dialer-list

interface Group-Async1

! modem access configuration

ip unnumbered Loopback0

! users will be on same subnet as loopback 0

Encapsulation ppp

! define ppp encapsulation

async mode interactive

! user interactively selects to use box as

! a terminal server or a ppp router

peer default ip address pool default

! assign IP address from pool named 'default'

dialer-group 1

! define which packets keep link up as set by dialer-list

ppp authwentication pap chap

! pap authentication with chap as fallback

group-range 1-48

! define all asynch lines to belong to this interface

line 1 48

! modem RS-232 interface configuration

autoselect during-login

! present a login prompt but monitor packets

autoselect ppp

! if ppp packet detected, shift automatically into ppp mode

login local

! use local database to authenticate username

modem InOut

! selects state machine for CD and DTR modem signals

transport input all

! allow connections to modem using any transport

ip

local

pool

default

144.254.20.1

! default address pool

144.254.20.48

dialer list 1 protocol ip permit

! permit dialing and keep line up for IP traffic

line con 0

login

password con-secret

!password for console access is con-secret

transport input none

! no telnet into the box

no exec

! don't get a prompt on this port

line vty 0 4

login

password vty-secret

! password for telnet access is vty-secret

Switch Configuration Commands

set authentication enable local

! default - local privileged authentication

set authentication login local

! default - local telnet authentication

hostname Perimeter-Router

! router name

enable secret ena-secret

! priviledged access password is ena-secret

interface serial 0

! define interface

description To The Internet

! describe it's purpose

ip address 161.71.73.33 255.255.255.248

! set ip address

ip access-list 101 in

! define inbound filter

ip access-list 102 out

! define outbound filter

access-list 101 permit tcp any any established Note 1

! allow all incoming tcp traffic where session was

initiated

! within the campus network

access-list 101 deny ip 192.168.0.0 0.0.255.255

any

access-list 101 deny icmp any any echo-reply

! deny any echo reply

access-list 101 deny icmp any any host-

! deny any host unreachable

unreachable

access-list 101 deny udp any any eq snmp

! deny incoming snmp

access-list 101 deny udp any eq 2000

! deny incoming openwindows

access-list 101 deny udp any any gt 6000

! deny incoming X-windows

access-list 101 deny tcp any any eq 2000

! deny incoming openwindows

access-list 101 deny tcp any any gt 6000

! deny incoming X-windows

access-list 101 deny udp any any eq 69

! deny incoming tftpd

access-list 101 deny udp any any eq 111

! deny incoming SunRPC

access-list 101 deny udp any any eq 2049

! deny incoming NFS

access-list 101 deny tcp any any eq 111

! deny incoming SunRPC

access-list 101 deny tcp any any eq 2049

! deny incoming NFS

access-list 101 deny tcp any any eq 87

! deny incoming link

access-list 101 deny tcp any any eq 512

! deny incoming BSD UNIX "r" commands

access-list 101 deny tcp any any eq 513

! deny incoming BSD UNIX "r" commands

access-list 101 deny tcp any any eq 514

! deny incoming BSD UNIX "r" commands

access-list 101 deny tcp any any eq 515

! deny incoming lpd

access-list 101 deny tcp any any eq 540

! deny incoming uucpd

access-list 101 permit ip any any

! permit all else

access-list 102 permit ip 144.254.0.0 0.0.255.255

! allow only packets with source

any

access-list 102 deny ip any any

! address of campus network to the Internet

aaa new-model

! enable AAA globally

aaa authentication login default tacacs+

! default login method is via tacacs+

aaa authentication login staff tacacs+ local

! username staff authenticates via tacacs+...if server

is

! not available, fallback method is local authentication

aaa authorization exec tacacs+ local

! Authorize to run exec shell when authenticated

aaa authorization commands 0 tacacs+ none

! authorization for exec mode commands associated

with

aaa authorization commands 1 tacacs+ none

! a specified privilege level - if tacacs+ server is not

aaa authorization commands 15 tacacs+ local

! available commands with priviledge level 15 require

local

! authentication, the others don't require any

authentication

aaa accounting update newinfo

! interim accounting records will be sent to server

every

! time there is new accounting info to report

aaa accounting exec start-stop tacacs+

! accounting for exec terminal sessions

aaa accounting network start-stop tacacs+

! accounting for all PPP, SLIP and ARAP connections

username staff password 7 staffpassword

! create local password and store in encrypted format

tacacs-server host 144.254.5.9

! define tacacs+ server address

tacacs-server key thisisasecret

! define shared tacacs+ secret

line con 0

exec-timeout 5 30

! ensure console session times out

login authentication staff

! only username staff can gain cosole access

line aux 0

transport input none

! no telnet into the box

no exec

! don't get a prompt on this port

line vty 0 3

exec-timeout 5 30

! ensure telnet session times out

login authentication default

! authenticate via tacacs+ login

privilege level 15

! gain priviledge 15 level

line vty 4

exec-timeout 5 30

! ensure telnet session times out

login authentication staff

! authenticate as staff

rotary 1

privilege level 1

logging on

! turn on syslog

logging 144.254.5.5

! define syslog server address

logging console information

! define what is to be logged

ip

address

inside

144.254.5.1

! define interface connected to internal campus

255.255.255.0

Ip

address

outside

144.254.1.2

! define interface connected to perimeter routr

255.255.255.0

Route 0.0.0.0 0.0.0.0 144.254.1.1 1

! specify default route

Password secretpw encrypted

! specify password for telnet seeions to be stored encrypted

Enable password ena-password encrypted

! specify enable password to be stored encrypted

Telnet 144.254.5.0 255.255.255.0

! specify hosts from specific subnet to have telnet access

Tacacs-server host 144.254.5.9 secretkey

! specify tacacs+ server and shared secret

Nat 0 0.0.0.0 0.0.0.0

! no address translation

Outbound 1 permit 144.254.0.0 255.255.0.0

! permit web traffic

80

Outbound 1 deny 144.254.0.0 255.25.0.0

! deny java applets

java

Apply 1 outgoing_src

! define global addresses

Static 144.254.9.11 144.254.9.11 500 50

! define static to web server with 500 open connection

! here we only allow web traffic to be initiated from outside

Syslog output 23.4

! define syslog messages logged (local7, warning messages)

Syslog host 144.254.5.5

! define syslog host

hostname Branch_Router

interface Ethernet 0

ip address 192.150.42.1 255.255.255.0

ip access-group 107 out

! access-list to prevent packet spoofing from branch

interface BRI 0

ip address unnumbered Ethernet 0

Encapsulation ppp

dilaer map ip 144.254.5.20 name NAS

dialer-group 1

ppp authentication chap

ip access-group 106 in

! access-list to allow lock&key traffic

access-list 106 permit tcp any host 144.254.5.20 eq

! allow telnet to remote router

telnet

access-list 106 dynamic usrauth timeout 5 permit ip

any any

access-list 107 permit ip host 192.150.42.0

! allow only packets with source

0.0.0.255 any

access-list 107 deny ip any any

! address of branch network to the campus

dialer-list 1 protocol ip permit

! defines traffic to dial or keep up isdn line