Đang chuẩn bị liên kết để tải về tài liệu:
cisco press router security strategies phần 8

: Để vô hiệu hóa các máy chủ NTP, sử dụng không có lệnh NTP trong IOS chế độ cấu hình toàn cầu. NTP được kích hoạt theo mặc định trong Cisco IOS. NTP vô hiệu hóa lệnh IOS có thể được sử dụng để vô hiệu hóa NTP xử lý trên giao diện cụ thể như giao diện bên ngoài. NTP là rất hiệu quả và được triển khai rộng rãi cho tương ứng mạng | 448 Chapter 9 Service Provider Network Case Studies other Customer A sites via the Internet. For both connections of CPE-A0 and CPE-A1 the associated edge router PE interfaces are assumed to be Serial0 0 0. The IP addresses assigned to these PE-CE links are shown in Figure 9-2. For all external PE-CE links 30 subnet masking is assigned. Internal Internal interfaces connect network infrastructure wholly within one administrative domain. All SP edge and core routers shown in Figure 9-2 include at least two internal interfaces. Interfaces Serial1 0 0 and Serial2 0 0 of PE-00 are considered internal to the SP network. All internal interfaces within this case study are assigned from the 172.30.0.0 15 address block. The IP subnets associated with these internal interfaces are carried within the SP IGP OSPF in this case study . Loopback All SP edge and core routers shown in Figure 9-2 implement a single loopback interface that is used for control and management plane traffic. All loopback interfaces within this case study are assigned from the 192.168.1.0 24 address block as shown in Figure 9-2. The 32 IP subnets associated with these internal interfaces are also carried within the SP IGP OSPF in this case study . Receive All routers include by default a receive interface that logically represents the slow path to the IOS process level on the RP. The receive path applies to any ingress packets that must be punted from the CEF fast path to be processed locally by the router s CPU whether transit or receive adjacency packets. Because the receive path represents an exception packet processing path between the CEF fast path and IOS process level it is not assigned or associated with a specific IP subnet. However as you will see control plane security features are applied to these logical interfaces. Figure 9-3 highlights in particular the router of focus for this case study PE-00 and illustrates the relationship among its interfaces. This router is also the focus for the .