Discussion on:

DOWNLOAD: Cisco IOS router: Lock it down in 10 steps

.
http://techrepublic.com.com/5138-6240-5577625.html

After you take a look at this download, please post your feedback, ideas for future improvements, or further thoughts on this topic.

Thanks,
TechRepublic Downloads Team

I don't have as many acronyms after my title as you guys so I may be totally wrong but I'm wondering if the section about blocking private IPs from Internet-facing interfaces is entirely correct. In that section it is noted that you should block requests originating from 192.168.0 with a wildcard mask of 0.0.0.255. According to the IETF website though the range is from 192.168.0.0 - 192.168.255.255. So shouldn't the wildcard mask be 0.0.255.255 instead?

Also, wouldn't it be wise to include the range of reserved addresses for Automatic Private IP Addressing (169.254.0.0 - 169.254.255.255) ?

When I first took over the network responsibilities at my current position, I set up my Internet-facing routers to pull time from trusted servers. Then I attended a SANS class where we talked about an optional strategy to have one key device poll an outside server and the routers then all pull from that controlled device. First advantage is to the outside service, since this changed 57 requests to 1, and I think it makes the routers less visible to the Internet. This is one of those 'IMHO' type choices, but anything that makes my routers less visible (less chatty on the outside interface) makes them less of a target.

Hi, here is a link of a folder full of Cisco IOS, http://www.megaupload.com/?f=NAAUJN6G