常规路由器安全配置

安全方面的一些建议：

• no ip directed-broadcast    （因为容易被denial-of-service attacks使用）
• no ip proxy-arp
• no service tcp-small-servers
• no service udp-small-servers

   只permit一些icmp 的回包

inteface fa 0/1
  ip access-group 100 in

access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded 
access-list 100 permit icmp any any traceroute    
access-list 100 permit icmp any any unreachable   
access-list 100 permit icmp any any packet-too-big

   防止源内部地址spoon
access-list 111 deny ip 209.165.202.128 0.0.0.31 any log      
      
    防止源RFC-1918地址欺骗
access-list 111 deny ip 10.0.0.0 0.255.255.255 any log             
access-list 111 deny ip 172.16.0.0 0.15.255.255 any log
access-list 111 deny ip 192.168.0.0 0.0.255.255 any log


   防止源well-known欺骗

access-list 105 deny ip host 255.255.255.255 any	防止源广播 spoon deny (host 255.255.255.255)
access-list 111 deny ip host 0.0.0.0 any	防止源 0 spoon  (deny host 0.0.0.0)
access-list 111 deny ip 127.0.0.0 0.255.255.255 any log	防止源127spoon       (deny 127.0.0.0/8 注意，不是host 127.0.0.1) 127.0.0.1是microsoft的 loop地址
access-list 111 deny ip 224.0.0.0 0.255.255.255 any	防止源224 spoon
169.254.0.0 0.0.255.255	微软用于失败的DHCP

      
   DNS spooning (三句)

no ip domain-lookup
ip dns server	使ROUTER作为DNS SERVER
ip dns spooning  [acl]	enable使ROUTER对DNS query , request做应答 [acl]  缺省是针对所有主机，可用acl 定义具体主机

   
    Firewall Websense URL Filtering

ip urlfilter server ...

enables your Cisco IOS firewall to interact with the Websense URL filtering software （cisco支持websense的一些功能， 两个公司的合作功能）