Cisco ISR 4000 Family Routers Administrator Guidance
Page
14
of
66
3.
Secure Installation and Configuration
3.1
Physical Installation
Follow the Cisco Hardware Installation Guide for the Cisco Integrated Services Routers (ISR)
4000 Family
[2]
for hardware installation instructions.
3.2
Initial Setup via Direct Console Connection
The Integrated Services Routers (ISR) 4000 Family must be given basic configuration via console
connection prior to being connected to any network.
3.2.1 Options to be chosen during the initial setup of the
ISR 4000
Family Routers
The setup starts automatically when a device has no configuration file in NVRAM. When setup
completes, it presents the System Configuration Dialog. This dialog guides the administrator
through the initial configuration with prompts for basic information about the TOE and network
and then creates an initial configuration file. After the file is created, an authorized administrator
can use the CLI to perform additional configuration.
Performing Basic System Management
in
[6]
describes how to use Setup to build a basic configuration and to make configuration changes.
The
following items must be noted during setup:
It should be noted that the account created during the initial installation of the TOE is considered
the privileged administrator and has been granted access to all commands on the TOE.
The term “authorized administrator” is used in this document to refer to any administrator that has
successfully authenticated to the switch and has access to the appropriate privileges to perform the
requested functions.
Refer to the IOS Command Reference Guide for available commands, associated roles and
privilege levels as used in the example above
[3]
[6] [8] [13]
.
1 – Enable Secret – The password must adhere to the password complexity requirements as
described in the relevant section below in this document. This command ensures that the enable
password is not stored in plain text. To configure, use the
enable secret 5
as described in Cisco
IOS Security Command Reference: Commands D to L -> E -> enable secret ->
[8]
, Note that this
setting can be confirmed after initial configuration is complete by examining the configuration file
and looking for “enable secret 5”
.
2 – Enable Password – The password must adhere to the password complexity requirements as
described in the relevant section below in this document. This command is used to control access
to various privilege levels. See above how access is controlled when this command has been
configured. Note that this password should be set to something different than the enable secret
password. To configure refer to Cisco IOS Security Command Reference: Commands D to L -> E
-> enable password
[8]
3 – Virtual Terminal Password - Must adhere to the password complexity requirements. Note that
securing the virtual terminal (or vty) lines with a password in the evaluated configuration is
suggested, though not a requirement for the evaluated configuration. This password allows access
to the device through only the console port. Later in this guide, steps will be given to allow ssh
