SysAdmin Valley

Here’s an example config for configuring an Cisco ASA5505 with primary and backup ISP’s.

ASA5505(config)# interface ethernet 0/0
ASA5505(config-if)# switchport access vlan 2
ASA5505(config-if)# no shutdown

ASA5505(config)# interface ethernet 0/1
ASA5505(config-if)# switchport access vlan 1
ASA5505(config-if)# no shutdown

ASA5505(config)# interface ethernet 0/2
ASA5505(config-if)# switchport access vlan 3
ASA5505(config-if)# no shutdown

ASA5505(config)# interface vlan 1
ASA5505(config-if)# nameif inside
ASA5505(config-if)# security-level 100
ASA5505(config-if)# ip address 192.168.1.1 255.255.255.0
ASA5505(config-if)# no shutdown

ASA5505(config)# interface vlan 2
ASA5505(config-if)# nameif primary-isp
ASA5505(config-if)# security-level 0
ASA5505(config-if)# ip address 100.100.100.1 255.255.255.0
ASA5505(config-if)# backup interface vlan 3
ASA5505(config-if)# no shutdown

ASA5505(config)# interface vlan 3
ASA5505(config-if)# nameif backup-isp
ASA5505(config-if)# security-level 1
ASA5505(config-if)# ip address 200.200.200.1 255.255.255.0
ASA5505(config-if)# no shutdown

ASA5505(config)# route primary-isp 0.0.0.0 0.0.0.0 100.100.100.2 1
ASA5505(config)# route backup-isp 0.0.0.0 0.0.0.0 200.200.200.2 2

Here’s a sample config you might use for a Cisco 2600 router for a point to point T1. The Cisco would need to have a built in CSU/DSU for this configuration.

Router#sh run
Building configuration...

Current configuration : 1158 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ip subnet-zero
!
ip cef
!
interface FastEthernet0/0
 no ip address
 shutdown
!
interface Serial0/0
 description outside interface
 ip address 100.100.100.1 255.255.255.252
 no ip directed-broadcast
 service-module t1 timeslots 1-24
 set cdp disable
 no shutdown
 no fair-queue
!
interface FastEthernet0/1
 description inside interface
 ip address 200.200.200.1 255.255.255.0
 speed 100
 full-duplex
!
ip default-gateway 100.100.100.2
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 100.100.100.2
!
line con 0
line aux 0
line vty 0 4
 login
!
!
end

Here is a basic configuration for a Cisco 2621 using interface FastEthernet0/0 to connect to your ISP, and FastEthernet0/1 to connect to your local network.

Router#sh run
Building configuration...

Current configuration : 1158 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ip subnet-zero
!
ip cef
!
interface FastEthernet0/0
 description outside interface
 ip address 100.100.100.1 255.255.255.252
 speed 100
 full-duplex
!
interface Serial0/0
 no ip address
 shutdown
 no fair-queue
!
interface FastEthernet0/1
 description inside interface
 ip address 200.200.200.1 255.255.255.0
 speed 100
 full-duplex
!
ip default-gateway 100.100.100.2
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 100.100.100.2
!
line con 0
line aux 0
line vty 0 4
 login
!
!
end

Network security is a hot topic today, and will only increase in importance in the months and years ahead.

While most of the attention is paid to exterior threats, there are some steps you can take to prevent unwanted Cisco router access from within your organization.

Whether you want to limit what certain users can do and run on your routers, or prevent unauthorized users in your company from getting to config mode in the first place, here are four important yet simple steps you can take to do so.

Encrypt the passwords in your running configuration.

This is a basic Cisco router security command that is often overlooked. It doesn’t do you any good to set passwords for your ISDN connection or Telnet connections if anyone who can see your router’s running configuration can see the passwords. By default, these passwords are displayed in your running config in clear text.

One simple command takes care of that. In global configuration mode, run service password-encryption. This command will encrypt all clear text passwords in your running configuration.

Set a console password.

If I walked into your network room right now, could I sit down and start configuring your Cisco routers?

If so, you need to set a console password. This password is a basic yet important step in limiting router access in your network. Go into line configuration mode with the command “line con 0″, and set a password with the password command.

Limit user capabilities with privilege level commands.

Not everyone who has access to your routers should be able to do anything they want. With careful use of privilege levels, you can limit the commands given users can run on your routers.

Privilege levels can be a little clumsy at first, but with practice you’ll be tying your routers down as tight as you like. Visit www.cisco.com/univercd for documentation on configuring privilege levels.

Configure an “enable secret” password.

It’s not uncommon for me to see a router that has an enable mode password set, but it’s in clear text.

By using “enable secret”, the enable mode password will automatically be encrypted. Remember, if you have an enable password and enable secret password set on the same router, the enable secret password takes precedence.

These four basic steps will help prevent unwanted router access from inside your network. If only preventing problems from outside your network was as simple!

Here is an example ISDN config for a Cisco 801 router

version 12.0
!
no ip domain-lookup
isdn switch-type basic-net3
!
!
!
interface Ethernet0
ip address 172.16.1.1 255.255.255.0
no ip directed-broadcast
ip nat inside
!
interface BRI0
ip address negotiated
no ip directed-broadcast
ip nat outside
encapsulation ppp
dialer string (put ISDN phone number here)
dialer-group 1
isdn switch-type basic-net3
no cdp enable
ppp chap hostname (Put username here)
ppp chap password (Put password here)
!
router rip
network 172.16.0.0
!
ip nat translation timeout 180
ip nat inside source list 1 interface BRI0 overload
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 BRI0
!
access-list 1 permit 172.16.0.0 0.0.255.255
access-list 100 deny ip any host 172.16.255.255
access-list 100 permit ip any any
dialer-list 1 protocol ip list 100
alias exec u undebug all
!