CCNA Security Certification And CCNP ISCW Tutorial:

SDM And One-Step Lockdown (Part 3)

Previous SDM/ Lockdown Installments: Part 1 Part 2

Chris Bryant, CCIE #12933

In the previous two installments of this tutorial, we saw how to use SDM to configure one-step lockdown...but lockdown may be a little too severe for our network.

If you've ever seen any of the many "prison shows" on MSNBC or NatGeo (or TLC, or SPIKE TV, or truTV, or...), you know that a prison lockdown is a serious situation. Basically, the prisoners are secured in their cells and there's very little they can do.

When you perform a lockdown on a Cisco router, there are plenty of things the router can no longer do - and you may need some of those things done!

The One-Step Lockdown is a pretty drastic configuration, and you may want to take an incremental approach to securing your router.   In that case, click the Security Audit button.  

(I've removed the previous configurations to give the Security Audit something to audit.)

After you click the Perform security audit button, SDM then presents us with a summary of the Security Audit feature.

After the audit runs, we're presented with a long list of potential security issues, along with passed or not passed.

A few points in particular to watch here:

Line 7 - Cisco Discovery Protocol will be disabled.

Line 9 - service password-encryption will be enabled.

Line 15 - A minimum password length of 6 characters is set (not 8, as some non-Cisco documentation states)

Line 18 - A banner will be set

Line 19 - Logging is set

Line 20 - An enable secret is configured

Line 37 - SSH is enabled for router access

The next screen gives us the option to fix the not passed issues on a per-issue basis, or to undo the passed issues.

Selecting Fix the Security problems presents us with a list of those perceived problems, and the option to fix them.  There is a Fix All option, but you can fix each individually as well.

After selecting Fix All and clicking Next, we're "prompted for more information to fix certain settings".  We now have to set an enable password and a login banner.

After this screen, I was prompted to configure the IOS Firewall.  Since we're covering that in depth in another CCNA Security tutorial, I won't show that config here. 

Finally, we arrive at the Summary window.   Here's just a part of that window:

Clicking Finish (not shown) delivers the config, and we're done!

A whopping 89 commands have just been delivered to the router!

Now, what if you change your mind about some or all of the config you just created?

If you need to go back and change any of these settings, that's no problem - just go right back into Security Audit.  Run the audit, and then select Close to close the window with the passed / not passed messages.  On the next screen, select Undo Security Configurations.

You can then undo any of the listed settings on an individual basis, or you can choose Undo All.

For plenty of additional CCNA Security exam tutorials, just click that link -- and be sure to take advantage of our CCNP Guaranteed Pass and $20 CCNA Security certification offers.

Thanks for making The Bryant Advantage part of your CCNA and CCNP studies!

Chris Bryant

CCIE #12933

"The Computer Certification Bulldog"

chris@thebryantadvantage.com

I'm Paying It Forward Bigger Than Ever.

My Famous CCNA Study Package Is Now $25.

No Gimmicks -- Just Results.

Get CCNA Security Certified Today For $20.