RTD Embedded Technologies, Inc.
|
www.rtd.com
24
IDAN-
ID5915 User’s Manual
Figure 19: Loading Defaults
Cisco Software Updates
The IDAN-ID5915 includes one year of technical support and software updates from Cisco for the 5915 Embedded Services Router. Software
updates for the 5915 ESR may be downloaded from Cisco, as long as a valid support agreement is in place. Visit
http://support.cisco.com
for
more information.
After the first year, customers are responsible for renewing their support agreement with Cisco (SMARTnet or Smart Net Total Care). RTD
recommends that customers do not allow their Cisco support to lapse, so they will have access to the latest version of IOS, including security
updates and bug fixes.
Once a new version of the IOS binary has been downloaded from Cisco web site, it is typically transferred onto the router via TFTP. Consult
Cisco’s documentation for more information.
Network Security Considerations
Since the Cisco 5915 ESR is an “active” device on the network, care must be taken to
ensure that is properly secured against network threats.
An improperly-configured router can leave an entire network vulnerable. Some basic security precautions include:
1.
Set passwords on
all
management interfaces (serial console and network). Use passwords that are long, complex, and unique. Do
not re-use passwords between systems.
2.
Use the configuration command
service password-encryption
to prevent passwords from being visible as plain text.
3.
Only use encrypted protocols for network management (SSH, HTTPS). Do not allow management via unencrypted protocols
(Telnet, HTTP, SNMPv1, etc).
Note that most encrypted protocols are not available unless using the Advanced Enterprise
version of IOS, refer to the
Cisco’s 5915
ESR datasheet for details.
4.
Disable network services that are not required (e.g. SNMP) to reduce the attack surface.
5.
Block all network management on “untrusted” network interfaces, such as the routed WAN ports.
Also disable any protocols on
“untrusted” interfaces that can
disclose
information about the “trusted” portion of the network (CDP, Spanning Tree, etc).
6.
Enable rate limiting on logons and temporary account lockout to prevent password brute force attacks.
7.
Enable session timeouts to prevent an attacker from taking over a session if the previous user forgot to log out.
8.
Configure logging to the flash filesystem or to an external logging server, so the log messages will still be visible after a router crash
or reboot.
9.
Configure the router to use synchronize its date and time with an available Network Time Protocol (NTP) server. This ensures the
timestamps in the log are accurate, and also assists with validating PKI certificates.
10.
Make sure the Cisco IOS version installed on the router is up-to-date to protect against security vulnerabilities and other bugs. The
customer is responsible for tracking Cisco security bulletins, and installing IOS updates accordingly. Customers are strongly urged
to maintain an active support agreement with Cisco (SMARTnet or Smart Net Total Care) or to ensure access to the latest IOS
updates.
The above steps are basic best practices, not an exhaustive list. Customers are responsible for determining the
proper security settings for their network. For additional resources, refer to C
isco’s guidelines for hardening IOS
devices.
