The safe configuration recommendations are general and suitable for most installations. These recommendations greatly improve the safe operation of the unit, but are not exhaustive. Depending on the application of the device, other safety parameters must also be configured. In some specific cases, the implementation of these recommendations may result in a non-functional network. When configuring the device, firstly it is necessary to follow the technical requirements and regulations of the networks in which the device will be used.

General recommendations

  • It is recommended to always disable unused physical interfaces with the shutdown The command is described in detail in the Interface monitoring and configuration section of the CLI Command Reference.
  • It is recommended to always set the system clock to synchronize with trusted network time sources (NTP). The NTP setup algorithm is described in the NTP configuration section of this manual. For detailed information on the NTP configuration commands, see System timer management in the CLI Command Reference.
  • It is recommended to disable the NTP broadcast client, which is enabled by default in the factory configuration.
  • It is not recommended to use the ip firewall disable command that disables firewalling. Always assign appropriate security zones to interfaces and configure the correct firewall rules. The firewall configuration algorithm is described in the Firewall configuration section of this manual. For detailed information on the Firewall configuration commands, see Firewall management in the CLI Command Reference.

Event logging system configuration

Event logging system configuration algorithms are described in the 'Syslog configuration' subsection of the Monitoring section of this manual.

For detailed information on the Event logging system configuration commands, see SYSLOG management section in the CLI Command Reference.

Recommendations

  • It is recommended to configure the event message storage in a syslog file on the device and transfer these events to an external syslog server.
  • It is recommended to limit the size of the syslog file on the device.
  • It is recommended to configure syslog file rotation on the device.
  • It is recommended to enable syslog message enumeration.
  • It is recommended that timestamp msec tags be added to syslog messages on ESR-1500 and ESR-1511.

Warnings

  • The data stored in the tmpsys:syslog file system is not saved when the device is rebooted. This type of file system is recommended for storing operational logs.
  • It is not recommended to use the flash:syslog file system to store logs, as it may cause premature ESR device failure.

Configuration example

Objective:

Configure the storage of event messages of info level and higher in a syslog file on the device and configure transmission of these events to an external syslog server. Limit the file size to 512 KB. Enable rotation of 3 files. Enable syslog message enumeration.

Solution:

Configure the storage of syslog messages in the file:

esr(config)# syslog file tmpsys:syslog/default info
CODE

Configure size limitation and file rotation:

esr(config)# syslog max-files 3
esr(config)# syslog file-size 512
CODE

Configure the transmission of messages to an external server:

esr(config)# syslog host mylog 192.168.1.2 info udp 514
CODE

Enable syslog message enumeration:

esr(config)# syslog sequence-numbers
CODE

Password usage policy configuration

The configuration algorithms for the password usage policy are described in the AAA configuration section of this manual.

For detailed information on the configuration commands for the password usage policy, see AAA configuration in the CLI Commands Reference.

Recommendations

  • It is recommended to always enable the default password change request for the admin user.
  • It is recommended to limit the lifetime of passwords and prohibit reusing at least the previous password.
  • It is recommended to set the minimum password length requirement greater than 8 characters.
  • It is recommended to set requirements for the use of lowercase and uppercase letters, numbers and special characters.

Configuration example

Objective:

  • Configure a password policy with a requirement to change the default password, a password validity period of 1 month, and a ban on using the last 12 passwords.
  • Set the minimum password length to 16 characters, the maximum to 64 characters.
  • The password must contain at least 3 uppercase letters, at least 5 lowercase letters, at least 4 digits and at least 2 special characters. The password must contain all 4 types of characters.

Solution:

Enables the default password reset request for admin user:

esr(config)# security passwords default-expered
CODE

Set the password lifetime to 30 days and prohibit the use of the previous 12 passwords:

esr(config)# security passwords lifetime 30
esr(config)# security passwords history 12
CODE

Set a limit to the password length:

esr(config)# security passwords min-length 16
esr(config)# security passwords max-length 64
CODE

Set a limit on the minimum number of characters of the respective types:

esr(config)# security passwords upper-case 3
esr(config)# security passwords lower-case 5
esr(config)# security passwords special-case 2
esr(config)# security passwords numeric-count 4
esr(config)# security passwords symbol-types 4
CODE

AAA policy configuration

The algorithms for AAA policy are described in the AAA configuration section of this manual.

For detailed information on the commands for AAA policy, see AAA configuration in the CLI Commands Reference.

Recommendations

  • It is recommended to use a role-based access model on the device.
  • It is recommended to use personal accounts to authenticate on the device.
  • It is recommended to enable logging of commands entered by the user.
  • It is recommended to use several authentication methods for logging in to devices via console, remote login to devices and privilege escalation. A combination of RADIUS/TACACS/LDAP authentication and local authentication is considered optimal.
  • It is recommended to lower the built-in admin account privileges to 1.
  • It is recommended to configure logging of changes of local accounts.
  • It is recommended to configure AAA policy change logging.

Warnings

  • The built-in admin account cannot be deleted.
  • The no username admin command does not remove the admin user, it resets his configuration to defaults. After applying this command, the admin user will not appear in the configuration.
  • The no password command for the admin user also does not remove the admin user's password, but resets it to its default value. After applying this command, the admin user password is no longer displayed in the configuration and becomes 'password'.
  • User with privilege level 15 or an ENABLE password must be configured before setting the admin user to downgrade privileges.

Configuration example

Objective:

Configure AAA policy:

  • Use RADIUS authentication for remote login via SSH.
  • Use RADIUS authentication for local console login, use local authentication if there is no connection to RADIUS servers.
  • Use ENABLE password set via RADIUS, if there is no connection to RADIUS servers, use local ENABLE password.
  • Set the admin user to a reduced privilege level.
  • Configure logging of changes of local accounts.
  • Configure AAA policy changes logging.
  • Configure the logging of entered commands.

Solution:

Create a local-operator user with privilege level 8:

esr(config)# username local-operator
esr(config-user)# password Pa$$w0rd1
esr(config-user)# privilege 8 
esr(config-user)# exit
CODE

Set local ENABLE password:

esr(config)# enable password $6e5c4r3e2t!
CODE

Lower the privileges of the admin user:

esr(config)# username admin
esr(config-user)# privilege 1 
esr(config-user)# exit
CODE

Configure the connection to the two RADIUS servers, the primary 192.168.1.11 and the backup 192.168.2.12:

esr(config)# radius-server host 192.168.1.11
esr(config-radius-server)# key ascii-text encrypted 8CB5107EA7005AFF
esr(config-radius-server)# priority 100 esr(config-radius-server)# exit
esr(config)# radius-server host 192.168.2.12
esr(config-radius-server)# key ascii-text encrypted 8CB5107EA7005AFF
esr(config-radius-server)# priority 150
esr(config-radius-server)# exit
CODE

Configure AAA policy:

esr(config)# aaa authentication login CONSOLE radius local 
esr(config)# aaa authentication login SSH radius 
esr(config)# aaa authentication enable default radius enable
esr(config)# aaa authentication mode break
esr(config)# line console
esr(config-line-console)# login authentication CONSOLE 
esr(config-line-console)# exit esr(config)# line ssh 
esr(config-line-ssh)# login authentication SSH 
esr(config-line-ssh)# exit
CODE

Configure logging:

esr(config)# logging userinfo 
esr(config)# logging aaa
esr(config)# syslog cli-commands
CODE

Remote management configuration 

For more information on remote access configuration commands, see SSH, Telnet access configuration in the CLI command reference.

Recommendations

  • It is recommended to disable remote control via telnet.
  • It is recommended to use crypto-resistant sha2-512 authentication algorithms and disable all others.
  • It is recommended to use crypto-resistant aes256ctr encryption algorithms and disable all others.
  • It is recommended to use dh-group-exchange-sha256 crypto-proof encryption key exchange algorithm and disable all others.
  • It is recommended to use crypto-resistant Host-Key verification algorithm for SSH rsa and disable all others.
  • It is recommended to allow access to remote control of the device only from certain IP addresses;
  • It is recommended to regenerate the encryption keys before starting operation.

Configuration example

Objective:

Disable telnet. Generate new encryption keys. Use crypto-resistant algorithms.

Solution:

Disable remote telnet control:

esr(config)# no ip telnet server
CODE

Disable outdated and not crypto-resistant algorithms:

esr(config)# ip ssh server
esr(config)# ip ssh authentication algorithm md5 disable
esr(config)# ip ssh authentication algorithm md5-96 disable
esr(config)# ip ssh authentication algorithm ripemd160 disable
esr(config)# ip ssh authentication algorithm sha1 disable
esr(config)# ip ssh authentication algorithm sha1-96 disable
esr(config)# ip ssh authentication algorithm sha2-256 disable
esr(config)# ip ssh encryption algorithm 3des disable
esr(config)# ip ssh encryption algorithm aes128 disable
esr(config)# ip ssh encryption algorithm aes128ctr disable
esr(config)# ip ssh encryption algorithm aes192 disable
esr(config)# ip ssh encryption algorithm aes192ctr disable
esr(config)# ip ssh encryption algorithm aes256 disable
esr(config)# ip ssh encryption algorithm arcfour disable
esr(config)# ip ssh encryption algorithm arcfour128 disable
esr(config)# ip ssh encryption algorithm arcfour256 disable
esr(config)# ip ssh encryption algorithm blowfish disable
esr(config)# ip ssh encryption algorithm cast128 disable
esr(config)# ip ssh key-exchange algorithm dh-group-exchange-sha1 disable
esr(config)# ip ssh key-exchange algorithm dh-group1-sha1 disable
esr(config)# ip ssh key-exchange algorithm dh-group14-sha1 disable
esr(config)# ip ssh key-exchange algorithm ecdh-sha2-nistp256 disable
esr(config)# ip ssh key-exchange algorithm ecdh-sha2-nistp384 disable
esr(config)# ip ssh key-exchange algorithm ecdh-sha2-nistp521 disable
esr(config)# ip ssh host-key algorithm dsa disable
esr(config)# ip ssh host-key algorithm ecdsa256 disable
esr(config)# ip ssh host-key algorithm ecdsa384 disable
esr(config)# ip ssh host-key algorithm ecdsa521 disable
esr(config)# ip ssh host-key algorithm ed25519 disable
CODE

Generate new encryption keys:

esr# update ssh-host-key rsa
esr# update ssh-host-key rsa 2048
CODE

Configuration of protection against network attacks mechanisms

The algorithms for configuring the network attack protection mechanisms are described in the Logging and network protection configuration section of this manual.

For detailed information about the commands to configure the password policy, see Management of logging and protection against network attacks in the CLI Command Reference.

Recommendations

  • It is recommended to always enable protection against ip spoofing.
  • It is recommended to always enable protection against TCP packets with incorrectly set flags.
  • It is recommended to always enable protection against fragmented TCP packets with the SYN flag set.
  • It is recommended to always enable protection against fragmented ICMP packets.
  • It is recommended to always enable protection against large ICMP packets.
  • It is recommended to always enable protection against unregistered IP protocols.
  • It is recommended to enable logging of the protection mechanism against network attacks.

Configuration example

Objective:

Configure the protection mechanism against network attacks in accordance with the recommendations.

Solution:

Enable protection against ip spoofing and logging of the protection mechanism:

esr(config)# ip firewall screen spy-blocking spoofing
esr(config)# logging firewall screen spy-blocking spoofing
CODE

Enable protection against TCP packets with incorrectly set flags and logging of the protection mechanism:

esr(config)# ip firewall screen spy-blocking syn-fin
esr(config)# logging firewall screen spy-blocking syn-fin
esr(config)# ip firewall screen spy-blocking fin-no-ack
esr(config)# logging firewall screen spy-blocking fin-no-ack
esr(config)# ip firewall screen spy-blocking tcp-no-flag
esr(config)# logging firewall screen spy-blocking tcp-no-flag
esr(config)# ip firewall screen spy-blocking tcp-all-flags
esr(config)# logging firewall screen spy-blocking tcp-all-flags
CODE

Enable protection against fragmented ICMP packets and protection mechanism logging:

esr(config)# ip firewall screen suspicious-packets icmp-fragment
esr(config)# logging firewall screen suspicious-packets icmp-fragment
CODE

Enable protection against large ICMP packets and logging of the protection mechanism:

esr(config)# ip firewall screen suspicious-packets large-icmp
esr(config)# logging firewall screen suspicious-packets large-icmp
CODE

Enable protection against unregistered ip-protocols and logging protection mechanism:

esr(config)# ip firewall screen suspicious-packets unknown-protocols
esr(config)# logging firewall screen suspicious-packets unknown-protocols
CODE