* Help Desk columnist Ron Nutter helps a reader secure his router when moving to a managed service offering
Nutter helps a reader secure his router when moving to a managed service offering
Due to increased Internet usage, my company will be upgrading from our 3 NxT1 configuration to a fractional DS-3. Against my recommendation, management elected to go with a “managed” service offering, which means I won’t have any access to the router. My concern is that I spent a considerable amount of time going through a book from O’Reilly Press “Hardening Cisco Routers” (https://www.amazon.com/exec/obidos/ASIN/0596001665/fusion0e), and I ‘m concerned the ISP may not have its router locked down to the level our current router is. With our current configuration, our firewall connects on the public side to a switch along with our two external DNS servers. What are some options to maintain the work I have done as we make the change to the new ISP/Internet connection?
Via the Internet
There are several ways you can address this. The first would be to talk to a tech rep from the ISP, probably someone in the provisioning or NOC group. Show them a copy of your current router configuration (sans passwords!) and see if they are willing/interested in duplicating your configuration in the router they will now be managing. If they aren’t familiar with the book you used, suggest they get a copy. If they aren’t willing/interested to duplicate your configuration, all is not lost.
With the way the O’Reilly book uses access control lists to control access to your network, you will need to look at putting in a Layer 3 switch so you’ll have the same functionality. Layer 3 switches won’t be cheap, so this may cost a little bit. You might have some luck purchasing a used switch, but make sure you can get it under some type of maintenance so it can be easily replaced if there’s a problem. If you elect to use a Cisco switch, you can save a little bit by going to a CatOS-based switch as opposed to the new IOS-based switches, but this will be a little different in configuration from what you’re used to.
Another option is to move your external DNS servers inside the firewall and put them alone on their own subnet and NAT them to the outside world. Depending on the particular firewall you have, you can also put the DNS servers in a DMZ and not bring traffic all the way inside your network. With either of these last two options, you can then create additional rules in the firewall to block the subnets and traffic types (i.e., ICMP, ping) from coming into either the DMZ or the network as a whole.
These are just a few ways you can address your concerns. With the current environment of hackers/viruses/Trojans, you have to look at things from the perspective that the world is out to get you. You can’t have enough protection on the network to prevent unwelcome visitors coming in from the outside.
