Configure HSRP protections

보통레벨 1수동 검토cisco-nxos

설명

HSRP is a valuable redundancy protocol, but like many protocols discussed in this document can be attacked and compromised. HSRP Authentication is recommended to protect against such attacks. CIS assessment: Manual. Reported as SKIP with review instructions.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

CIS assessment: Manual. The "show running-config hsrp" shows all HSRP configurations. Ensure that MD5 authentication is configured for each HSRP configuration. switch# sho run hsrp !Command: show running-config hsrp !Running configuration last done at: Wed May 20 17:24:20 2020 !Time: Wed May 20 17:25:33 2020 version 9.3(3) Bios:version feature hsrp interface Vlan1 hsrp version 2 hsrp 1 authentication md5 key-chain HSRP-KEYCHAIN name HSRPVLAN1 preempt priority 110 ip 10.10.10.1

조치 방법

조치 방식: 가이드 또는 인프라 패치

! First, enable HSRP feature hsrp set the HSRP version to "2" to allow for MD5 encryption (per interface) int vlan 1 hsrp version 2 Finally, configure the remainder of that interfaces HSRP setup. The key command is of course the "authentication md5" clause hsrp 1 authentication md5 key-chain <HSRP-KEYCHAIN> name HSRPVLAN1 preempt priority 110 ip 10.10.10.1

속성

운영 체제: 모두
태그: cisco-nxosnetworkrouting
참고 자료: CIS Cisco NX-OS Benchmark v1.2.0 - 3.1.4.4 Configure HSRP protections