• Chapter 1: Describing Network Requirements
• Chapter 2: Topologies for Teleworker Connectivity
• Chapter 3: Using Cable to Connect to a Central Site
• Chapter 4: Using DSL to Connect to a Central Site
• Chapter 5: Configuring DSL Access with PPPoE
• Chapter 6: Configuring DSL Access with PPPoA
• Chapter 7: DSL Connection Troubleshooting
• Chapter 8: The MPLS Conceptual Model
• Chapter 9: MPLS Architecture
• Chapter 10: Configuring Frame Mode MPLS
• Chapter 11: MPLS VPN Technologies
• Chapter 12: IPsec Overview
• Chapter 13: Site-to-Site VPN Operations
• Chapter 14: GRE Tunneling over IPsec
• Chapter 15: IPsec High Availability Options
• Chapter 16: Configuring Cisco Easy VPN
• Chapter 18: Cisco Device Hardening
• Chapter 19: Securing Administrative Access
• Chapter 20: Using AAA to Scale Access Control
• Chapter 21: Cisco IOS Threat Defense Features
• Chapter 22: Implementing Cisco IOS Firewalls
• Chapter 23: Implementing Cisco IDS and IPS

Chapter 18: Cisco Device Hardening

Potential Vulnerabilities

Unnecessary Services and Interfaces

• Disable unused interfaces
• Disable BOOTP server (no ip bootp server)
• Disable CDP (no cdp run)
• Disable automatic configuration download (no service config) (disabled by default)
• Disable FTP server (no ftp-server enable) (disabled by default)
• Disable TFTP server (no tftp-server enable) (disabled by default)
• Disable PAD (no service pad)
• Disable minor TCP and UDP services (no service tcp-small-servers and no service udp-small-servers)
• Disable MOP (no mop enable) (disabled by default)

Common Management Services

• Disable SNMP if not used (no snmp-server enable)
• Disable HTTP(S) if not used (no ip http server and/or no ip http secure-server)
• Disable DNS queries (no ip domain-lookup)

Path Integrity Mechanisms

• Disable ICMP redirects (no ip icmp redirect)
• Disable IP source routing (no ip source-route)

Probes and Scans

• Disable finger service (no service finger)
• Disable ICMP unreachables (no ip unreachables)
• Disable ICMP mask reply (no ip mask-reply) (disabled by default)
• Disable directed broadcasts (no ip directed-broadcast) (disabled by default)

Terminal Access Security

• Disable identd (no ip identd)
• Enable TCP keepalives (service tcp-keepalives-in and service tcp-keepalives-out)

Gratuitous and Proxy ARP

• Disable gratuitous ARP (no ip arp gratuitous)
• Disable proxy ARP (no ip arp proxy)

AutoSecure

Router# auto secure [management | forwarding] [no-interact | full] [login | ntp |
 ssh | firewall | tcp-intercept]