Tag Info

Hot answers tagged

5

As an Information Assurance (IA) principle, the less unnecessary services running on a device, the lower the attack surface. To mitigate issues, proper configuration and patching levels are key. Changing ports is one of many elements you can do to lower the potential security risk. Cisco has an excellent guide for proper implementation of the HTTP/HTTPS ...


4

It appears that someone can't spell phoneproxy correctly when they typed it in setting it up. Regardless it's for CUCM's phone proxy feature on an ASDM firewall. See here: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/unified_comm_phoneproxy.html Here's the gist of it: The Cisco Phone Proxy on the ASA bridges IP ...


3

One potential problem with HTTPS is that lazy people (like me) may not set up a Kerberos certificate on the device to ensure that connections to it are secure. Your certificate would have to come from one of 3 sources: a commercial certificate authority like Verisign (expensive), setup your own CA using a Windows or Linux server (not that hard, but time ...


2

Enabling HTTPS and changing the port number is actually very common practice. Using a secure password for the login will also increase the security. Of course, you should always use HTTPS over HTTP. But ultimately to answer your question, no it's not insecure. The web management interface is just a user friendly way to configure the settings, but if ...


2

If you want it to learn a new MAC and make it sticky you'll to remove the old one: no switchport port-security mac-address mac_address in the relevant interface. The docs here have some useful info but you might want to consult the docs your specific IOS version.


1

First let me start out by adding just a bit of info. It looks like you intend all IPs to be private network addresses. The IPs that start with 172 must belong to 172.16.x.x - 172.31.x.x for them to be considered private. Since this is just a packet tracer lab, this doesn't really matter. Some of the commands I am entering might be unnecessary if you don't ...


1

Every open port on your device or server increase the attack surface, certainly. That said, enabling HTTPS would be more secure than enabling a non-encrypted protocol like Telnet or HTTP. You mention changing the port number. Be careful with that, you may prevent the Cisco Network Assistant from finding/managing the device. (Does CNA let you specify a ...


1

There are many tools but I recommend to using Expect ( http://en.wikipedia.org/wiki/Expect ) Expect has main advantage that it completely simulates command prompt interaction and is very easy to learn and implement. Not mentioning fact it is completely free under GNU/GPL license. Example: expect "*assword: " send "$Password\r" expect "#" send "conf t\r"


1

{Disclaimer - I work for an HP partner} What I see most often is the use of a tool like HP Network Automation (which does far more than merely push IOS updates to Cisco devices - it supports all kinds of network devices, does configuration management, can be used for audit compliance, etc). You might also consider some of the Open Source products like ...


1

I ended up using PySNMP. It wasn't clear that SNMP v3 has pretty encryption and it also allows not only to gather data but also manipulate the device.


1

Try show running-config | section ? e.g. show running-config | section router bgp It works similar to the include statement, but also lists all the sub-commands.



Only top voted, non community-wiki answers of a minimum length are eligible