Management Options and CIS Benchmark Hardening

What it is

This page covers how you manage security devices, and how you harden them against attack.

Management choices affect scale, resilience and risk. The management plane is a prime target, because whoever controls it controls the device. A hardening baseline such as a CIS benchmark gives you a checklist of settings to apply.

How it works

Decide on the manager type, the path to it and where it runs, then harden the device.

Single device or multidevice manager

A single device manager runs on the device, and manages only that device. Cisco Secure Firewall Device Manager (FDM) is a web interface on the firewall itself, and ASDM plays this role for ASA. It is quick to start and needs no separate server.

A multidevice manager controls many devices from one place. Cisco Secure Firewall Management Center (FMC) is the on-premises example. It supports shared policy, central event storage, correlation and consistent updates.

A Threat Defense device is managed by either FDM or FMC at one time, not both.

On-premises or cloud management

Management can run in your own data centre, or be delivered from the cloud. A cloud delivered FMC is hosted by Cisco, and removes the need to maintain a management server. Cisco Security Cloud Control is Cisco's cloud management service for security devices, and the cloud delivered FMC is provided through it.

Cloud management reduces upgrade effort and gives access from anywhere. On-premises management keeps data inside your network, and suits strict data residency rules. Some designs combine both.

In-band or out-of-band

In-band management uses the same network that carries production traffic. It needs no extra cabling, but management fails if the production network fails, and it exposes the management plane to user traffic.

Out-of-band management uses a separate dedicated network and a dedicated management interface. It is more resilient and more secure, because users cannot reach it. It is the recommended approach where it is practical.

On a Threat Defense device, you register it to an FMC from the device CLI.

> configure manager add FMC_ADDRESS REGISTRATION_KEY
> show managers

CIS benchmarks

The Center for Internet Security publishes consensus based configuration benchmarks. Each lists settings, a reason and how to audit them. Benchmarks exist for Cisco IOS XE and for Cisco firewall platforms, and their names and versions change over time, so check the CIS site for the current list.

Recommendations are grouped by level. Level 1 is a practical baseline with little impact on operations. Level 2 is stricter, for higher security environments, and may reduce functionality.

Typical hardening themes

For IOS XE, benchmark sections follow the planes of the device. The management plane covers AAA, passwords, SSH, logging, NTP and SNMP. The control plane and data plane cover items such as disabling unneeded services and filtering.

Router(config)# aaa new-model
Router(config)# no ip http server
Router(config)# ip http secure-server
Router(config)# ip ssh version 2
Router(config)# service password-encryption
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# exec-timeout 5 0
Router(config-line)# access-class MGMT-ACL in

For Cisco Secure Firewall, the same ideas apply: limit which addresses can reach management, use strong authentication and role based accounts, send logs to a central server, synchronise time and keep software current. The benchmark is a baseline, so adapt it to your policy and test before you roll it out.