Euphrates
join:2007-04-30
Bellingham, WA
| reply to Toma
Re: [Config] Quick check of my security settings?
It seems to be a matter of preference. I know if you run Cisco's SDM on a router and you don't have the inspection outbound on the Outside interface, it tells you you don't have a firewall configured.
I inspect inbound on the inside interface. It's something I've read on these forums actually. If you are going to manipulate traffic, you want to do so as close to the source of the traffic as possible. With that said you would inspect inbound on the inside interface.
Also, you do want to have an access-list on the outside interface denying all inbound traffic (again, manipulating the data at the source interface). I don't remember off the top of my head if you have to allow anything in the access-list first for PPPoE/DHCP client to work correctly but if so, make sure you have that configured as well.
When I configure an access-list inbound on the outside interface, I go by the "allow what's needed and deny everything else" rule of thumb. The fact is, you are probably only going to be required to allow a few things into the router and a "deny ip any any" statement should take care of everything else. I'm not sure if others would agree with me on this type of configuration. Again, my take on it is that if you put a whole bunch of deny statements on your inbound access-list then the router has to parse through each and every rule before it finally matches a rule that's just going to deny that traffic anyway. This can cause performance issues. Everyone will have their preference, you will find out over time which one works for you.
For general security settings, there are a lot of things you can do but may be limited to the IOS version on this router.
Here is a Cisco document on the subject of securing your router:
»www.cisco.com/en/US/tech/tk648/t···48.shtml |
