Securing the Router

What this chapter covers

This chapter shows how to protect the ways that an administrator logs in to the router.

The router itself is a target, so its management services need extra care. You will learn how to hide a service with port knocking, how to use the encrypted management services, and which port each service uses. The last topic shows how SSH can carry other traffic safely.

The earlier chapters gave you the firewall and the cryptography. Here you apply both to the router's own management plane.

How the topics fit together

The pages move from hiding, to choosing safe services, to using SSH as a carrier.

Port knocking keeps a service invisible until the client proves that it knows a secret sequence. It is a light layer that sits in front of the real login.

The second page lists the management services, their default ports and which ones are encrypted. It then shows how to limit each service. The last page shows SSH port forwarding, which protects a clear text service by wrapping it in SSH.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and console examples.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Learn the default port numbers by heart, because they appear in many questions. Then practise the rules on a lab router. Always keep a second session open while you change management settings.

If you work on a remote router, add a way back in before you make a change. A console connection or safe mode is a good choice.