Cisco Guide to Harden Cisco IOS Devices

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml

SSH v2 Minimum Key Size

For SSH Version 2, the modulus size must be at least 768 bits.


http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gt_ssh2.html#wp1055056

TACACS Summary

• Authentication and Authorisation are done at different stages
• TCP port 49
• Encrypt the entire payload
• Cisco proprietary

SNMPv3 Encryption Algorithms

In the AES and 3-DES Encryption Support for SNMP Version 3 feature the Cipher Block Chaining/Data Encryption Standard (CBC-DES) is the privacy protocol. Originally only DES was supported (as per RFC 3414). This feature adds support for AES-128 (as per RFC 3826) and AES-192, AES-256 and 3-DES

http://www.cisco.com/en/US/docs/ios/12_4t/12_4t2/snmpv3ae.html#wp1053786

Access List Entry log and log-input

The log and log-input options apply to an individual ACE and cause packets that match the ACE to be logged. The log-input option enables logging of the ingress interface and source MAC address in addition to the packet's source and destination IP addresses and ports.



http://www.cisco.com/web/about/security/intelligence/acl-logging.html#2

IP Source Guard and DHCP Snooping with Option 82

When IP source guard is enabled in IP and MAC filtering mode, the DHCP snooping option 82 must be enabled to ensure that the DHCP protocol works properly. Without option 82 data, the switch cannot locate the client host port to forward the DHCP server reply. Instead, the DHCP server reply is dropped, and the client cannot obtain an IP address.

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/31sga/configuration/guide/dhcp.html#wp1083306

https://supportforums.cisco.com/thread/145470

port-filter Class-map Type

You can apply the port-filter policy feature to the control-plane host subinterface to block traffic destined to closed or nonlistened TCP/UDP ports.

Closed-ports—Matches automatically on all closed-ports on the router.

show control-plane host open-ports

http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/htcpp.html#wp1109374

Hash Value Generation for Access Control Entry

ip access-list logging hash-generation

Cisco IOS routers generate syslog entries for log-enabled ACEs. The system appends a tag (either a user-defined cookie or a router-generated MD5 hash value) to ACE syslog entries. This tag uniquely identifies the ACE, within an access control list (ACL), that generated the syslog entry.


http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_i1.html#wp1042763