Cisco Device Security

Question 1

What mode is this in?

hostname#

Answer 1

Privileged Exec Mode

Question 2

What mode is this in?

hostname>

Answer 2

User Exec Mode

Question 3

What mode is this in?

hostname(config)#

Answer 3

Global Configuration Mode

Question 4

What three different levels are there for basic line level security?

Answer 4

• Console
• Virtual Terminal VTY
• Privileged Exec Mode

Question 5

What line number is the console at always?

Answer 5

0

Question 6

What is a basic Telnet Configuration?

Answer 6

• Switch(config)#int vlan 1 (You can use a different management VLAN here if you want)
• Switch(config-if)#ip address {ip-address} {subnet}
• Switch(config-if)#no shutdown
• Switch(config-if)#exit
• Switch(config)#ip default-gateway {default-gateway-address}
• R1(config)#line vty 0 15
• R1(config-line)#password {password}
• R1(config-line)#login

Question 7

What is the default inactivity timeout for administrators on Cisco Devices?

Answer 7

10 minutes

Question 8

How would you configure a timeout to not be enforced?

Answer 8

no-exec-timeout

Question 9

How would you configure a timeout of 15 minutes and 30 seconds?

Answer 9

exec-timeout 15 30

Question 10

What configuration can you use to control who gets access to Telnet and SSH Sessions?

Answer 10

• R1(config)#access-list 1 permit host 10.0.0.10
• R1(config)#line vty 0 15
• R1(config-line)#login
• R1(config-line)#password {password}
• R1(config-line)#access-class 1 in

Question 11

What command can you use to ensure that all passwords are encryped and not in plain text?

Answer 11

service password-encryption

Question 12

How would you configure a Telnet session to use individual usernames and passwords instead of a generic global one?

Answer 12

• R1(config)#username {username} secret {password} (This sets the username and password which we’ll use below when we invoke login local
• R1(config)#line console 0
• R1(config-line)#login local
• R1(config)#line vty 0 15
• R1(config-line)#login local

Question 13

How many privilege levels of admin access are there on Cisco devices?

Answer 13

16 (0-15)

Question 14

By default, what 3 levels of privilege are used?

Answer 14

Zero
User
Privileged

Question 15

What does zero-level access provide?

Answer 15

5 commands only (logout, enable, disable, help and exit)

Question 16

What does User Level 1 access provide?

Answer 16

Very limited read only access to the device

Question 17

What does privilege level 15 provide?

Answer 17

Complete control over the device

Question 18

What level of access would this command have?

R1(config)#username {username} secret {secret}

Answer 18

Level 1 Access

Question 19

How do you enable SSH?

Answer 19

• R1(config)#ip domain-name {domain-name}
• R1(config)#crypto key generate rsa

Question 20

How do you configure SSH after enabling it?

Answer 20

• R1(config)#line vty 0 15
• R1(config-line)#transport input ssh
• R1(config-line)#login local
• R1(config)#ip ssh version 2

Question 21

What is the command from a CMD to login via SSH

Answer 21

ssh -l {username} {ip-address}

Question 22

What AAA stand for?

Answer 22

Authentication, Authorization and Accounting

Question 23

What is Cisco’s AAA Server called?

Answer 23

ISE (Indentity Services Engine)

Question 23

Commonly used for end user level services, such as VPN

Answer 23

Radius

Question 23

What are the protocols used for AAA?

Answer 23

RADIUS and TACACS+

Question 23

Commonly used for administrator access on Cisco devices as it has more granular authorization capabilities

Answer 23

TACACS+

Question 23

How would you configure a RADIUS configuration for older IOS Versions?

Answer 23

- R1(config)#username {username} secret {password} - This is configuring a local user in case connectivity to the AAA server is lost - R1(config)#aaa new-model - This command is just configuring AAA on this device - R1(config)#radius-server host {ip-address} key {key} - R1(config)#radius-server host {ip-address} key {key} - Redundancy is being used here. You don't have to put this command in twice. - The keys need to be configured the same in this command as on the AAA server - This allows them to connect to each other - R1(config)#aaa group server radius {group-name} - This command is optional - R1(config-sg-radius)#server {ip-address} - R1(config-sg-radius)#server {ip-address} - Again, redundant servers here - These are the servers that are being into the group you just created - Again, this optional - R1(config)#aaa authentication login default group radius local - Use all RADIUS servers configured on this particular device - OR - R1(config)#aaa authentication login default group {group-name} local - Use servers in specified group

Question 23

How would you configure a TACACS+ configuration for old IOS Versions?

Answer 23

- R1(config)#username {username} secret {password} - Creating our backup user in case AAA server isn't available - R1(config)#aaa new-model - R1(config)#tacacs-server host {ip-address} key {key} - You can also add another one here for redundancy as well - R1(config)#aaa group server tacacs+ {group-name} - R1(config-sg-tacacs+)#server {ip-address} - R1(config)#aaa authentication login default group {group-name} local

Question 23

What are some services you should disable on Cisco devices?

Answer 23

HTTP Server, CDP, etc

Question 23

How would you configure a RADIUS configuration for new IOS Versions?

Answer 23

- R1(config)#radius-server host {ip-address} - R1(config)#aaa new-model - R1(config)#radius server {server-name} - R1(config-radius-server)#address ipv4 {ip-address} - R1(config-radius-server)#key {key} - Again, this should match the key configured on the AAA Server - You can also configure a redundant server using different variables - Configuring the Radius Group to group those servers together - R1(config-radius-server)#aaa group server radius {group-name} - R1(config-sg-radius)#server name {server-name} - R1(config-sg-radius)#aaa authentication login default group {group-name} local

Question 23

How would you configure a TACACS+ configuration for new IOS Versions?

Answer 23

- R1(config)#tacacs-server host {ip-address} - R1(config)#username {username} secret {password} - R1(config)#aaa new-model - R1(config)#tacacs server {server-name} - R1(config-server-tacacs)#address ipv4 {ip-address} - R1(config-server-tacacs)#key {key} - You can configure redundancy here as well with the same commands - R1(config-radius-server)#aaa group server tacacs+ {group-name} - R1(config-sg-tacacs+)#server name {server-name} - Don't forget to include the other server here if you've added it for redundancy - R1(config-sg-tacacs+)#aaa authentication login default group {group-name} local

Question 23

What does NTP stand for?

Answer 23

Network Time Protocol

Question 24

How do you configure a device to be an NTP Client?

Answer 24

- R1(config)#clock timezone {timezone} {- how many hours it's behind UTC} - Example: clock timezone PST -8 - R1(config)#ntp server {ip-address-of-NTP-server}

Question 25

What commands would you use to verify NTP?

Answer 25

- R1#show clock - R1#show ntp status