Cisco’s 3000 series VPN Concentrators continue to be one of its most popular security product offerings. Due to their reliability, fault tolerance, ease of setup, management, and monitoring, they scale well from small remote sites to large enterprise solutions. The default policies shipped with the units allow an administrator to quickly and easily place a unit into production within an hour of unpacking. But, like any sophisticated security appliance, one must carefully review the default policies and be prepared to make an informed decision about what features should remain active and which to disable | Global Knowledge Expert Reference Series ofWhite Papers Hardening Guidelines for Cisco 3000 Series VPN Concentrators 1-800-COURSES Hardening Guidelines for Cisco 3000 Series VPN Concentrators David W. Chapman Jr. Global Knowledge Instructor CISSP-ISSAP CCSI CCNP CCDP CCSP Introduction Cisco s 3000 series VPN Concentrators continue to be one of its most popular security product offerings. Due to their reliability fault tolerance ease of setup management and monitoring they scale well from small remote sites to large enterprise solutions. The default policies shipped with the units allow an administrator to quickly and easily place a unit into production within an hour of unpacking. But like any sophisticated security appliance one must carefully review the default policies and be prepared to make an informed decision about what features should remain active and which to disable. The purpose of this paper is to highlight some of the most important areas where one can increase the overall security posture of the VPN Concentrator through hardening common features such as Administrative Access User Access Network Management Access and Interface Policies. This paper assumes the reader has experience configuring the 3000 series concentrators and is familiar with navigating the menu structure in the webbased GUI and the CLI. For reference this paper was written assuming a Cisco 3005 VPN Concentrator running version of the VPN OS is used. Securing Administrative Access The first area of focus is securing console and remote administration access to the concentrator. If an intruder can sniff your username and password with a protocol analyzer your network can be easily compromised by the eavesdropper. There are two areas in the configuration tree that concern the control of local and remote access to the concentrator Administration Access Rights and Configuration System Management. Securing Access Rights On your concentrator navigate to .
