The Cisco IOS resilient configuration feature allows for faster recovery if someone maliciously or unintentionally reformats flash memory or erases the startup configuration file in nonvolatile random-access memory (NVRAM). The feature maintains a secure working copy of the router IOS image file and a copy of the running configuration file. These secure files cannot be removed by the user and are referred to as the primary bootset.

• The configuration file in the primary bootset is a copy of the running configuration that was in the router when the feature was first enabled.
• The feature secures the smallest working set of files to preserve persistent storage space. No extra space is required to secure the primary Cisco IOS image file.
• The feature automatically detects image or configuration version mismatch.
• Only local storage is used for securing files, eliminating scalability maintenance challenges from storing multiple images and configurations on TFTP servers.
• The feature can be disabled only through a console session.
• The feature is only available for systems that support a PCMCIA Advanced Technology Attachment (ATA) flash interface.

Enable the IOS image resilience feature

To secure the IOS image and enable Cisco IOS image resilience, use the secure boot-image global configuration mode command. When enabled for the first time, the running Cisco IOS image is secured and a log entry is generated. The Cisco IOS image resilience feature can only be disabled through a console session using the no form of the command.

This command functions properly only when the system is configured to run an image from a flash drive with an ATA interface. Additionally, the running image must be loaded from persistent storage to be secured as primary. Images that are loaded from a remote location, such as a TFTP server, cannot be secured.

To take a snapshot of the router running configuration and securely archive it in persistent storage, use the secure boot-config global configuration mode command.

The configuration archive is hidden and cannot be viewed or removed directly from the CLI prompt. You can use the secure boot-config command repeatedly to upgrade the configuration archive to a newer version after new configuration commands have been issued.

Secured files do not appear in the output of a dir command that is issued from the CLI. This is because the Cisco IOS file system prevents secure files from being listed. The running image and running configuration archives are not visible in the dir command output. Use the show secure bootset command to verify the existence of the archive.

The primary bootset image

Configuring Secure Copy

Recovering a router password

If someone gained physical access to a router, they could potentially gain control of that device through the password recovery procedure. This procedure, if performed correctly, leaves the router configuration intact. If the attacker makes no major changes, this type of attack is difficult to detect. An attacker can use this attack method to discover the router configuration and other pertinent information about the network, such as traffic flows and access control restrictions.

An administrator can mitigate this potential security breach by using the no service password-recovery global configuration mode command. This command is a hidden Cisco IOS command and has no arguments or keywords. If a router is configured with the no service password-recovery command, all access to ROMmon mode is disabled.

When the no service password-recovery command is entered, a warning message displays and must be acknowledged before the feature is enabled

NTP

Many of the things involved in the security of a network, such as security logs, depend on an accurate date and timestamp. Seconds matter when dealing with an attack because it is important to identify the order in which a specified attack occurred. Ensure that log messages are accurately time stamped by maintaining the synchronization of clocks on hosts and network devices.

NTP Server

When determining whether to use a private clock for synchronization versus a public clock, it is necessary to weigh the risks and benefits of both.

If a private master clock is implemented, the administrator must ensure that the time source is valid and from a secure site. Vulnerabilities may be introduced if the site is not secure. For example, an attacker can launch a DoS attack by sending bogus NTP data across the Internet to the network in an attempt to change the clocks. This attack could possibly cause digital certificates to become invalid. An attacker could attempt to confuse a network administrator during an attack by disrupting the clocks on network devices. This scenario would make it difficult for the network administrator to determine the order of syslog events on multiple devices.

Getting clock time from the Internet means that unsecured packets are allowed through the firewall. Many NTP servers on the Internet do not require any authentication of peers. Therefore, the network administrator must trust that the clock itself is reliable, valid, and secure.

The communications (known as associations) between machines that run NTP are usually statically configured. Each device is given the IP address of NTP masters. Accurate time keeping is possible by exchanging NTP messages between each pair of machines with an association.

In an NTP configured network one or more routers are designated as the master clock keeper (also known as an NTP master) using the ntp master global configuration mode command.

r1(config)# ntp master [stratum]

The stratum number is the number of hops away from an authoritative source such as an atomic clock.

NTP clients either contact the master or listen for messages from the master to synchronize their clocks. Contact the master by using the ntp server ip-address command.

ntp server {ip_address | hostname} [version number] [key keyid] [source interface] [prefer]

In a LAN environment, NTP can be configured to use IP broadcast messages by using the ntp broadcast client interface configuration mode command.

Router(config-if)# ntp broadcast client

NTP authentication

ROUTER R1 CONFIGURATION
R1# conf term
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)# ntp authentication-key 1 md5 $3cretKEY
R1(config)# ntp authenticate
R1(config)# ntp trusted-key 1
R1(config)# ntp master 1

ROUTER R2 CONFIGURATION
R2# conf term
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)# ntp authentication-key 1 md5 $3cretKEY
R2(config)# ntp authenticate
R2(config)# ntp trusted-key 1
R2(config)# ntp server 172.16.0.1 key 1