Thanks for your response.

You're probably correct with leaving the routers "unfiltered". Here is what I have for telnet login in the config:

line con 0

password

login

transport input none

line aux 0

line vty 0 4

password

login

Is there a way to lock this down further. Thanks in advance, Steve

put an access group on the vty lines. I'll assume that your device is in a secure facility, if you can make sure you run tacacs to record any logins

Thanks everyone for your replies.

With regards to tacacs to record logins, what are the commands for the config file? Or is there a URL that show this setup.

Also is there a entry in the config that I can enter to specify an IP where the log files can be written?

Thanks, Steve

You can specify a Syslog server with "logging host (ip-address)". I've never used TACACS -- you should be able to find configuration information by searching for it on this site or Google.

As mentioned, you can apply an access-list to the VTY lines to that only specifics hosts/subnets can Telnet to the router. For example:

access-list 1 permit 10.1.1.0 0.0.0.255

line vty 0 4

access-class 1 in

I dont think you want to use TACACS for routers outside of your firewall. It would force you to punch an inbound hole in your firewall to access, of all things, your authentication server.

Use local authentication or better yet, do not allow telnet access to external routers. Use reverse telnet to the console ports.

I'm from the other school, which believes that every router should be locked down as far as possible to both protect the router and provide an extra layer of protection. In particular:

Routers outside the firewall should filter out all traffic coming in any port which does not make sense (inside source addresses in packets from the outside, inside destination addresses in packets from the inside, martian & broadcast source & destination addresses from anywhere, etc.)

Management traffic should only be accepted from inside addresses coming in from inside ports. Need access from the Internet? Set up an ssh server inside the firewall, ssh to it and telnet back to the router (or ssh if the router supports that). Even if the router supports ssh, force outside access to go through the firewall so you can detect someone knocking on the door.

Don't expect the router to protect you from anything, but do expect it to reduce the random noise the firewall is reporting so you can pay more attention to the firewall and have a better chance to detect real attempts to get in.

As always, your mileage may vary. For more on locking down routers, see Chapter 8 of my book, the numerous articles here on www.cisco.com, and search www.sans.org for cisco details.

Good luck and have fun!

Vincent C Jones

www.networkingunlimited.com