This guide was developed in response to numerous questions and requests for assistance received by the NSA System and Network Attack Center (SNAC). The  topics covered in the guide were selected on the basis of customer interest, community concensus, and the SNAC’s background in securing networks. The goal for this guide is a simple one: improve the security provided by routers in US Government operational networks.

Who Should Use This Guide

Network administrators and network security officers are the primary audience for this configuration guide, throughout the text the familiar pronoun “you” is used for guidance directed specifically to them.  Most network administrators are responsible for managing the connections within their networks, and between their network and various other networks.  Network security officers are usually responsible for selecting and deploying the assurance measures applied to their networks.  For this audience, this guide provides security goals and guidance, along with specific examples of configuring Cisco routers to meet those goals. Firewall administrators are another intended audience for this guide.  Often, firewalls are employed in conjunction with filtering routers; the overall perimeter security of an enclave benefits when the configurations of the firewall and router are complementary.  While this guide does not discuss general firewall topics in any depth, it does provide information that firewall administrators need to configure their routers to actively support their perimeter security policies. Section 5 includes information on using the firewall features of the Cisco Integrated Security facility.

Information System Security Engineers (ISSEs) may also find this guide useful. Using it, an ISSE can gain greater familiarity with security services that routers can provide, and use that knowledge to incorporate routers more effectively into the secure network configurations that they design.

Sections 4, 5, and 6 of this guide are designed for use with routers made by Cisco Systems, and running Cisco’s IOS software. The descriptions and examples in those sections were written with the assumption that the reader is familiar with basic Cisco router operations and command syntax.

Feedback

This guide was created by a team of individuals in the System and Network Attack Center (SNAC), which is part of the NSA Information Assurance irectorate.  The editor was Neal Ziring.  Comments and feedback about this guide may be directed to the SNAC (Attn: Neal Ziring), Suite 6704, National Security Agency, Ft. Meade, MD, 20755-6704, or via e-mail to SNAC.Guides@nsa.gov.

Source: “Router Security Configuration Guide” developed by Router Security Guidance Activity of the Systems and Network Attack Center – National Security Agency (SNAC-NSA) – December 15th, 2005 (Version 1.1c)