CCIE – Page 7 – CCNA training CCIE training

City Year — An Education Solution at Work in Detroit

Posted on November 30, 2011 by Posted in Career, CCIE, CCNA, CCNP, Cisco

Joel Gullickson, City Year Detroit corps member Team Leader, Ford Motor Company Team at Detroit Collegiate Prep High School

Best CCIE Training and CCIE Exams and more Cisco exams log in to examkingdom.com

Every 26 seconds, someone drops out of school in America. Detroit is being called the epicenter of the urban public education crisis — Secretary of Education Arne Duncan called us “Ground Zero” for education reform. In Detroit, the dropout rates hover around 50%, and rates for African American and Hispanic males are even worse. According to recent data, almost 40% of Hispanic and African-American students fail to graduate with their class.

Based on leading research from Johns Hopkins University, we can now predict with alarming accuracy the likelihood of a student in a high-poverty school graduating from high school. By as early as the sixth grade, if a student falls off-track in either Attendance, Behavior or Course performance in math or English (the ABCs), without intervention, that child stands only a 20% chance of graduating high school. Students are failing and dropping out at alarming rates — not because they want to, but because they are not getting the supports they need to keep them on track to graduation. Some supports are coming from the top. A state-wide school district, the Educational Achievement Authority, aims to radically restructure education in the state’s lowest 5% performing schools. But the EAA is still months away from taking action. City Year Detroit has boots on the ground in classrooms right now.

At City Year Detroit, young adult leaders like Joel Gullickson are helping turn around the very real dropout crisis in Detroit. City Year’s unique approach embeds a team of corps members (up to ten young adult leaders) at high-poverty K-12 schools full-time for the entire school year, where they provide targeted tutoring, mentoring, behavior coaching, attendance incentives, and other interventions to bring the achievement of struggling students back on track. From before the first morning bell until the end of afterschool programs, corps members serve as near-peer role models and provide the extra human capital so desperately needed in high-poverty schools. This year, City Year Detroit is partnering with nine public schools in Detroit, River Rouge, Harper Woods, and Taylor, and is bringing a laser-focused dedication to moving students who have fallen off track back onto the path towards high school graduation.
Like Joel, City Year recognizes that solving the education crisis will help solve many of the other issues impacting our society. City Year’s efforts are keeping student in school and on track to graduate ready for success in college or career — which is critical to building a local pipeline of a highly educated workforce. City Year leverages the talent, energy, idealism and service of young adults (ages 17-24) who choose to serve as AmeriCorps members for a year; our focus is to help solve the dropout crisis, and it is through service that City Year demonstrates the power of these young adults to tackle critical issues in our community and their commitment to developing the next generation of educated, successful young leaders of Detroit.

Cisco Training In Your Own Home Considered

Posted on November 29, 2011 by Posted in Career, CCIE, CCNA, CCNP, Cisco

If Cisco training is your aspiration, and you’ve not yet worked with routers or network switches, you should first attempt CCNA certification. This will provide you with knowledge and skills to work with routers. The internet is made up of hundreds of thousands of routers, and large commercial ventures with many locations also need routers to allow their networks to keep in touch.

Microsoft CCNA Certification, CCNA Training and over 2000+
Exams with Life Time Access Membership at https://www.actualkey.com

It’s very probable you’ll get a job with an internet service provider or a big organisation which is located on multiple sites but still wants secure internal data communication. These jobs are well paid and in demand.

Getting your Cisco CCNA is perfectly sufficient to start with; don’t be cajoled into attempting your CCNP. Once you’ve got a few years experience behind you, you will have a feel for whether you need to train up to this level. If so, your experience will serve as the background you require to take on your CCNP – which is quite a hard qualification to acquire – and mustn’t be entered into casually.

One thing you must always insist on is 24×7 round-the-clock support with trained professional instructors and mentors. Too many companies only seem to want to help while they’re in the office (9am till 6pm, Monday till Friday usually) and nothing at the weekends.

Never buy certification programs which can only support trainees through a message system after 6-9pm in the evening and during weekends. Trainers will give you every excuse in the book why you don’t need this. The bottom line is – support is required when it’s required – not when it’s convenient for them.

We recommend that you search for training programs that have multiple support offices across multiple time-zones. Each one should be integrated to give a single entry point together with access round-the-clock, when you want it, with no fuss.

Never make do with a lower level of service. Direct-access 24×7 support is the only way to go when it comes to IT study. Maybe late-evening study is not your thing; often though, we’re working when traditional support if offered.

Beginning with the idea that it makes sense to home-in on the employment that excites us first, before we can even mull over which development program fulfils our needs, how can we choose the right direction?

Because without any solid background in computing, how should we possibly understand what someone in a particular job does?

Arriving at a well-informed resolution really only appears from a methodical analysis of several shifting key points:

* Personalities play an important part – what things get your juices flowing, and what are the areas that put a frown on your face.

* What time-frame are you looking at for your training?

* How highly do you rate salary – is it the most important thing, or is job satisfaction higher up on your priority-list?

* Understanding what the main IT roles and markets are – and what makes them different.

* Taking a cold, hard look at the level of commitment, time and effort you can give.

To be honest, it’s obvious that the only real way to investigate these matters tends to be through a good talk with an advisor or professional who has years of experience in IT (as well as it’s commercial requirements.)

Commercial certification is now, undoubtedly, beginning to replace the traditional academic paths into IT – but why is this?

As we require increasingly more effective technological know-how, the IT sector has moved to the specialised core-skills learning only available through the vendors themselves – in other words companies such as Microsoft, CISCO, Adobe and CompTIA. This frequently provides reductions in both cost and time.

Many degrees, for example, become confusing because of a lot of background study – with much too broad a syllabus. Students are then prevented from getting enough core and in-depth understanding on a specific area.

What if you were an employer – and you required somebody who had very specific skills. What is easier: Trawl through loads of academic qualifications from several applicants, trying to establish what they know and which vocational skills they’ve acquired, or choose particular accreditations that specifically match what you’re looking for, and make your short-list from that. Your interviews are then about personal suitability – rather than on the depth of their technical knowledge.

A study programme must provide a nationally accepted exam as an end-result – and not some unimportant ‘in-house’ diploma – fit only for filing away and forgetting.

All the major commercial players like Microsoft, Cisco, Adobe or CompTIA all have nationally recognised proficiency programmes. Huge conglomerates such as these will make your CV stand-out.

3M, Infor in legal battle over millions in software fees

Posted on November 28, 2011 by Posted in CCIE, CCNA, CCNP, Cisco, Microsoft, Tech

In a case that hinges on interpretations of software contract language and the respective rights of customers and vendors when it comes to third-party support organizations, 3M wants a court to declare that it doesn’t owe Infor millions of dollars in fees.

Best CCIE Training and CCIE Exams and more Cisco exams log in to Certkingdom.com

For more than a decade, 3M has used Infor’s BCPS and Infinium software, which is “indispensable” to its operations domestically and abroad, according to a complaint 3M filed last week in U.S. District Court for the District of Minnesota.

The relationship stems from a contract 3M initially signed in 1997 with SSA Global, which Infor later acquired, according to the suit. That pact gave 3M “a perpetual, personal, nontransferable and non-exclusive right and license to use the software,” it adds.

Over time, 3M has gained the right to 8,000 license seats, most recently adding 1,000 in December 2009 at a cost of US$1.5 million, it states. Only 7,000 of the seats are currently in use.

The deal also includes annual maintenance payments to Infor, which currently total about $1 million per year, for updates, upgrades and technical support, according to the suit. However, the contract also specified that other necessary services wouldn’t be provided by Infor, and that 3M was able to hire other companies to fulfill those needs, it adds.

But the agreement also contains a provision that bars 3M from giving access to the software “(without SSA Global’s prior written consent) to any service bureau or other agent or third party whose primary function shall be to provide [3M] with day-to-day management and support responsibility of the software.”

Meanwhile, the software has been highly customized for 3M’s needs, with only about half of the code used at 3M “original to Infor,” the suit states. Because of this, Infor employees are unable to provide much of the needed support, according to 3M.

3M signed a services agreement with Cognizant in November 2009 to help it manage the software, the suit states.

Infor “has long been aware” of 3M’s relationship with Cognizant and in fact “expressly approved of Cognizant as a third-party provider for 3M, thereby lulling 3M into a false sense of security with respect to its relationship with Cognizant,” according to the suit.

At one point, Infor sent 3M a “proposed use and confidentiality agreement” for Cognizant to sign, it adds. Cognizant kept the document “for many months without comment,” and ultimately never signed it because “Infor had not properly defined Cognizant’s duties” regarding the software.

In March of this year, an Infor contact told 3M he considered the Cognizant agreement “stale,” but otherwise and since has “said nothing to indicate any objection or concern with Cognizant gaining access to the software,” 3M said in the filing.

This year, Infor conducted an audit of 3M’s software usage. In the process, Infor asked whether 3M had “outsourced the day-to-day operation and/or maintenance of the Infor software,” the suit adds. 3M responded that it had, and identified Cognizant as the provider.

“The audit did not ask whether 3M had outsourced management of the software,” it adds. “In fact, 3M has never outsourced management of the software.”

In July, Infor sent 3M a letter claiming it had breached a confidentiality clause in the companies’ contract due to Cognizant’s involvement, and demanded $20,923,526 in exchange for giving Cognizant access rights, according to the suit. Infor later dropped that amount to between $17 and $18 million, it adds.

Earlier this month, 3M dissolved its contract with Cognizant “in an effort to maintain its relationship with Infor,” believing that based on “previous representations by Infor” doing so would resolve the companies’ differences.

Yet on Nov. 10, Infor “made yet another demand that 3M pay fees based on an unexplained ‘analysis’ for ‘back usage’ by Cognizant,” it adds. In this instance, Infor asked for about $7.8 million but said it was willing to discount that amount to roughly $5.9 million, according to the suit.

3M is seeking a declaration that Cognizant “did not perform the ‘primary function’ of ‘day-to-day management and support responsibility of the software,'” and therefore 3M is not in breach of its contract with Infor, it states.

The conglomerate also wants a declaration protecting it even if Cognizant did perform such activities, as well as attorneys’ fees and other relief.

But the case could end up being settled before trial.

“Infor has a reputation for service and support excellence, and 3M is a valued Infor customer,” said Infor spokesman Dan Barnhardt in a statement. “We are currently working with 3M to bring this matter to a speedy and satisfactory resolution. All software agreements necessarily restrict access to and modification of source code by third parties to encourage and protect substantial investments in continuous innovation.”

3M’s complaint does not mention source code modification. “I don’t think that [Infor’s statement] pertains to 3M’s lawsuit at all, as 3M did not modify Infor source code,” said Wendy Wildung, an attorney for 3M, said via email on Monday.

While it’s impossible to know exactly what transpired between the companies on this front without more information, vendors have no legal claim or control over any customizations created by a customer that don’t touch the underlying source code, said analyst Ray Wang, CEO of Constellation Research.

Education, Analysis Help When Evaluating Lighting Technologies

Posted on November 25, 2011 by Posted in Career, CCIE, Cisco

Lighting efficiency options keep getting better, more complex, and tougher to sort out. There’s a lot more to consider: new metrics, too-good-to-be-true claims, and sometimes questionable analyses, to name a few. A bit of reality checking, plus some help from a few independent data sources, may help facility managers navigate this ever-growing maze.

Best CCIE Training and CCIE Exams and more Cisco exams log in to Certkingdom.com

LightFair, the annual product show of the U.S. lighting industry, is always a feast of new lighting products and services. The 2011 event was no exception. As in recent years, solid-state lighting (SSL) based on LEDs (light emitting diodes) was all the rage. It seemed like a forgone conclusion that fixtures designed around LEDs would, in the next few years, supplant even high-efficiency fluorescents. Many vendors also exhibited sophisticated lighting controls for both LED and other lighting sources.

To describe the benefits of these new options, new lingo and new ways to compare light sources have been developed. Confronted by this avalanche of new information, lingo and products, some facility managers find themselves shutting down, unable to assess the possibilities and perhaps becoming too guarded as a result.

Because LED lighting involves a very small and essentially directional source (the LED lamp), retrofit devices and fixtures designed to use them may look and act differently from other sources. In the case of street or parking lot lighting, the directionality may be a plus: instead of lighting up the sky and creating glare and light pollution, nearly all light is focused down toward the ground. This difference may complicate comparisons with a large light source having a much wider distribution. Even if efficacy (lumens per watt) is lower for the LED source, its tighter distribution may still yield the same surface brightness using fewer watts. Differences in color content may also affect the level of wattage needed to assure acceptable illuminance.
Luminaire System Application Efficacy

To address such issues, lighting manufacturers have come up with new metrics, not all of which are as yet generally accepted. Luminaire System Application Efficacy, for example, is a sophisticated way to combine all of the above to allow useful comparisons among fixtures. Determining that final number involves inputting a variety of factors into software (find it at www.lrc.rpi.edu/parkinglot/#intro). Without knowing and understanding all the inputs, however, an end user may not know whether the answer has been “cooked” by a vendor supplying the comparison.

One area that remains controversial, for example, is the claimed scotopic/photopic (S/P) ratio for various light sources, or even such ratios within a type of light source. An S/P ratio describes the output of a given light source with regard to optical characteristics that may make an area appear brighter or darker, irrespective of a standard foot-candle measurement. If one claims a better S/P ratio for a source, the answer may favor that source. Department of Energy (DOE)’s Lighting Facts Label does not include an S/P ratio, and does not require testing by an independent lab to verify the S/P number.

With regard specifically to LED lighting, another factor that may be both useful and a bit enigmatic is Duv. Loosely described as color consistency, this factor indicates how consistently the light from an LED source matches a known and precisely quantified color standard: the higher the number, the less consistent the match. In a row of many LED wall washers, for example, a high Duv could yield noticeable variations in wall color among fixtures, even if all contained lamps having the same coordinated color temperature (CCT).

Cisco computer game lets you play CEO

Posted on November 19, 2011 by Posted in Career, CCIE, Cisco

If you want to be a CEO but not have any of the real responsibilities of one, you could try to play a new online game being offered by Cisco. The company this week posted myPlanNet, a computer game that lets anyone be a broadband executive making network deployment decisions.

Best CCIE Training and CCIE Exams and more Cisco exams log in to examkingdom.com

Cisco says of the myPlanNet game: “You manage your business as it evolves from the stone age of dial-up, through the broadband and mobile connected eras, and into the dawning of the medianet age.” That means you get to pick and choose everything from routers to networked-applications to help your company grow. The Game even has a Facebook page.

NetworkWorld Extra: 12 mad science projects that could shake the world

Cisco created the game for the company’s network certification site, the Learning Network. That site features a number of computer games such as The Cisco Mind Share Game that let you play and learn the content of the CCENT/ CCNA exam. If that’s possible.

From the company’s Web site: “In myPlanNet v1.0, we included some events that present players with challenges or opportunities. Think of these like Chance or Community Chest cards in Monopoly. Events include things like threats from competitors, initiating marketing programs, and even coping with disasters. These events may affect cash amounts, population size, happiness, service adoption, among other things. We admit that what’s in there is a little basic, so there’s lots of room for improvement. That’s where you come in.”

The game begins when you download a 40mb file to a Windows only machine. On the myPlanNet site the company says it has no plans right now to offer a Linux or other version of the game.

acebook places third: Companies young people want to work for

Posted on November 14, 2011 by Posted in Career, CCIE, CCNA, CCNP, Cisco

Facebook is the third company that Americans want to work for. Only two other companies were ranked higher by young professionals this year: Google and Apple.

Best CCNA Training and CCNA Certification and more Cisco exams log in to Certkingdom.

Facebook placed third this year in a ranking of how attractive an employer is among professionals in the US. This is a huge win for the social networking giant, considering it is just a 7-year-old company.

The results, which reveal how working professionals perceive organizations as employers, are based on a survey conducted by employment data and consulting firm Universum. The company asked 6,698 young professionals with one to eight years of experience between June 17, 2011 and September 30, 2011.

Respondents were asked to pick as many as five ideal employers out of a list of about 200. They could also write in candidates, and a total of 17,950 companies were evaluated. You can see the top 15 in the table above.

8.90 percent of young workers said they wanted to work for Facebook. Only two companies ranked higher: Google (19.67 percent) and Apple (12.74 percent).

Microsoft released its first tablet 10 years ago. So why did Apple win with the iPad?

Posted on November 11, 2011 by Posted in Career, CCIE, CCNA, CCNP, Cisco

Ten years ago Microsoft released its Tablet PC, with Bill Gate saying “within five years I predict it will be the most popular form of PC sold in America.” Things didn’t work out that way — the Tablet PC died, and the iPad eventually took the world by storm. What went wrong?

Cisco CCNA Training, Cisco CCNA Certification 2000+ Exams at Examkingdom.com

Gates showed off a prototype of Microsoft’s Tablet PC at the COMDEX Fall 2001 computer show in Los Vegas. Manufacturers including Acer, Compaq, Fujitsu, and Toshiba said they would release Tablet PCs in the second half of 2002.

Here’s how a Microsoft press release described the Tablet PC:

The size of a legal notepad and half the weight of most of today’s laptop PCs, the Tablet PC is a full-powered, full-featured PC that runs Windows XP and combines the power of desktop computing with the flexibility and portability of a pen and paper notepad.

It was touted to run Autodesk’s CAD software, versions of Microsoft Office, and Groove, collaboration software which Microsoft bought from Ray Ozzie, the creator of Lotus Notes. The press release also noted that in his presentation, Gates:

emphasized that because it runs Windows XP, the Tablet PC is a fully-fledged, secure Microsoft .NET client machine that natively supports the .NET Framework.

All that tells you all you need to know about why the Tablet PC died. Rather than envision what people would really want to do with a tablet and then design the hardware for that, Microsoft instead force-fit Windows XP onto it. Windows XP was a great desktop operating system, but it was bloated overkill for a tablet.

Microsoft also decided that people would want to do the exact same things with a Tablet PC as they would with a desktop or a laptop. Here’s what Gates said at the announcement:

“The Tablet takes cutting-edge PC technology and makes it available wherever you want it, which is why I’m already using a Tablet as my everyday computer. It’s a PC that is virtually without limits — and within five years I predict it will be the most popular form of PC sold in America.”

Because Microsoft envisioned it as a full-fledged PC and equipped it accordingly, it was expensive — typically $2,000 or more. Despite that price tag, it couldn’t really replace a desktop or laptop. It only found use in niche markets.

There were other problems as well. As TabTimes notes, the heavy use of a stylus was also a mistake.

Steve Jobs recognized that the tablet should be a consumer device and not a replacement for a desktop or laptop PC. He saw that it would require a different operating system, one designed for tablets, not traditional computers.

Will Microsoft learn from its mistakes when it releases tablets based on Windows 8? It’s not quite clear yet. The Windows 8 metro interface is well-suited for tablets, although the Windows 8 Desktop isn’t. If Windows 8 tablets are essentially hybrid tablet-PCs, it’s unlikely they’ll succeed.

BlackBerry finds safe haven in UK, despite a fall in sales

Posted on November 10, 2011 by Posted in Career, CCIE, CCNA, CCNP, Cisco

While BlackBerry sales continues to suffer across the U.S and Canada, the smartphone has found safe haven in the UK, of all places.

Microsoft MCTS Certification, MCITP Certification and over 2000+
Exams with Life Time Access Membership at https://www.actualkey.com

BlackBerrys, despite their once popular status across the U.S., Canada and Europe, have found a safe haven in exile in the United Kingdom, of all places.

It has been only a month since the BlackBerry global outage, which spread across four days and affected over half its worldwide user base, an estimated 50 million users. The press alone ripped a hole in Research in Motion’s communications strategy, which left BlackBerry users in some cases more frustrated than the outage itself.

But despite the odds, BlackBerrys retained high status and stormed ahead of both Nokia and Apple in the UK market, despite shipments declining 2 percent, as Apple’s iPhone fell by just over a quarter.

On a bright side, Samsung jumped 178 percent to 1.1 million shipments, and HTC grew by nearly half to 800,000 shipments.

While Nokia’s sales slumped the most by 87 percent to a meagre 130,000 shipments, Sony Ericsson fell 32 percent to just 300,000 shipments, after it was announced last month that Sony would buy out Ericsson’s share to take the venture into its wholly-owned arms.

Nokia hopes that, as many consider the company’s Symbian mobile operating system of choice is outdated or “perceived as dead”, Canalys senior analyst Tim Shepherd said, the Finnish phone giant is hoping to regroup with its Microsoft partnership as it rolls out Windows powered phones.

One of the reasons for Apple’s loss could be the lacking availability of the new iPhone 4S smartphone, with mobile phone contract renewal or upgrade dates falling at an inconvenient time. It is thought however that the Christmas holiday period will boost smartphone sales.

Plus, as many had hoped that the next-generation iPhone 5 would be out in September, many are still holding out for the model next year, skipping the iPhone 4S altogether.

Statistics from analytics firm Canalys show smartphone shipments declined by 7 percent to 5.3 million, with a mediocre performance across the major manufacturers.

Research in Motions’ marketshare has fallen below 10 percent, according to Shepherd, noting its 58 percent year-over-year drop in North America.

But in areas of high wealth, the United Arab Emirates for example showed a massive strong quarter of growth, up 181 percent to 1.4 million units shipped in the region.

But the outage alone did not deter loyal followers of the BlackBerry brand. The popular BlackBerry Messenger service was still a unique selling point for particularly the younger generation across Europe, though now rivalled by Apple’s iMessage service, which offers vastly the same function amongst iPhone and iOS 5 users.

Forbes places Mark Zuckerberg in top 10 most powerful people

Posted on November 6, 2011 by Posted in Career, CCIE, CCNA, CCNP, Cisco

Forbes has ranked Facebook co-founder and CEO Mark Zuckerberg as the ninth most powerful person in the world this year. He was number 40 last year.

Best CCIE Training and CCIE Exams and more Cisco exams log in to Certkingdom.com

Forbes has released its list of “The World’s Most Powerful People.” The annual ranking, which compares politicians, religious leaders, self-made billionaires, major philanthropists, and celebrities, has listed Facebook co-founder and CEO Mark Zuckerberg as number nine this year.

At age 27, Zuckerberg is not only the youngest person on the list, but he is also the biggest gainer this year, jumping 31 spots from number 40 in 2010. Forbes estimates his net worth at $17.5 billion.

Unsurprisingly, US president Barack Obama tops the list. The only technology-related figure above Zuckerberg is Microsoft founder Bill Gates, at fifth place (up from 10th last year).

The next technology figures don’t appear till number 30: Google co-founders Sergey Brin and Larry Page are tied for the spot, having slipped from number 22 last year. Other tech gurus this year include Amazon CEO Jeff Bezos in 40th place (up from 66th), Baidu CEO Robin Li in 42nd, and Apple CEO Tim Cook in 58th.

Forbes takes into account four factors for its ranking. It measures how many people a person has power over, the financial resources controlled by each candidate, whether his or her influence affects more than one arena, and considers how actively they wield their power. This cuts the list down to 70 people, or one for every 100 million people on the planet.

CCNA SEC: Router Hardening

Posted on November 5, 2011 by Posted in Career, CCIE, CCNA, CCNP, Cisco

Hardening a router means that the router is secured against attacks as best as possible. This article discusses various means of making sure your routers are set up with maximum security, including manually hardening the router and router hardening with Cisco SDM.

Cisco CCNA Training, Cisco CCNA Certification 2000+ Exams at Examkingdom.com

We don’t tend to like people that are hardened. They can be cold and unsympathetic, and generally morose. We do, on the other hand, love it when our Cisco routers are hardened, especially when these routers live at the perimeter of our internal networks.

What exactly do we mean by router hardening? It means that the router is secured against attacks as best as possible. From secure, tough-to-crack passwords that are encrypted in the configurations, to the shutting down of unnecessary ports and services, the router has few vulnerabilities for would-be attackers to exploit.

For example, the router has built-in web server capabilities. That’s right. Your Cisco router can actually function as a web server on your network. Don’t plan on using the router as a web server? Be sure that this functionality is disabled.

In addition to web services, the Cisco router of today’s networks can provide many, many other potential services to the network. A key element to hardening the router is to find all of these services you are not using, and to disable them.
Manually Hardening the Router

Feel like going “old school” with your perimeter router security? Well, here is what you can do for configurations manually on the device in order to help secure (harden) it:

Disable unused router interfaces—that’s right, find ANY interface that is not in use and make sure you issue the shutdown command
Disable unused services—these typically include:
BOOTP
CDP
Configuration autoloading
FTP
TFTP
PAD
TCP and UDP minor services
DEC MOP
Disable management protocols that you are not using—these typically include:
SNMP
HTTP or HTTPS
DNS
Disable features that are techniques for re-directing your traffic:
ICMP Redirects
IP Source routing
Disable features that are techniques for probes and scans in reconnaissance attacks:
Finger
ICMP unreachables
ICMP mask reply
Ensure security of terminal connections:
IP identification service
TCP keepalives
Disable gratuitous ARP and proxy ARP
Disable IP-directed broadcasts

You also should inspect the network management protocols in use in your network infrastructure. Remember the following:

SNMP version 1 and 2c transfer passwords (called community strings) in clear text—if security is required—consider SNMP version 3.
HTTP authentication also sends clear text passwords—when needed, use HTTPS instead.
Attackers can respond to broadcast DNS lookups—disable DNS when not in use or configure securely.
Telnet is a clear text protocol—do not use it; instead, use SSH.

Router Hardening with the Cisco Router and Security and Device Manager (SDM)

Now one of the reasons that we love Cisco is that they are always trying to make it easy on us. We see this in the area of router hardening. In the Graphical User Interface for managing your perimeter routers, Cisco provides a Security Audit feature. This feature provides two “modes” of operation. The first is the Security Audit Wizard and the second is the One-step Lockdown mode.

The Security Audit Wizard examines your router and then lets you choose which potential security flaws you want to correct. The One-step Lockdown mode automatically makes the router hardening configurations that Cisco would recommend.

Here are the steps of the Security Audit Wizard:

Within the Cisco SDM, choose Configure then Security Audit.
Click the Perform Security Audit button.
Click Next and the Security Audit Interface Configuration page appears —here you are presented with your router interfaces. It is up to you to select which of the interfaces connect to your internal networks, and which of the interfaces connect to your external networks. After you select these options, choose Next.
The security audit now runs. When it is complete, the SDM presents you with a report of potential security vulnerabilities on your device. You can click Save Report in order to save it. If you select Close, the Security Audit Wizard continues to the next phase.
In the final phase of the Security Audit Wizard, you can check or uncheck the vulnerabilities that you want the wizard to automatically repair. Notice there is even an option for Fix All.

As you might guess, using the One-step Lockdown mode is even easier!

Within the Cisco SDM, choose Configure then Security Audit.
Click the One-step Lockdown button.
Click the Yes button that you want to continue and the SDM goes about its business of locking down the device for you.

What exactly does the One-step lockdown do on your device? Well, it is very busy indeed. Here is a list of the changes made by this GUI:

Disable Finger Service
Disable PAD Service
Disable TCP Small Servers Service
Disable UDP Small Servers Service
Disable IP BOOTP Server Service
Disable IP Identification Service
Disable CDP
Disable IP Source Route
Enable Password Encryption Service
Enable TCP Keepalives for Inbound Telnet Sessions
Enable TCP Keepalives for Outbound Telnet Sessions
Enable Sequence Numbers and Time Stamps on Debugs
Enable IP CEF
Disable IP Gratuitous ARPs
Set Minimum Password Length to Less Than 6 Characters
Set Authentication Failure Rate to Less Than 3 Retries
Set TCP Synwait Time
Set Banner
Enable Logging
Set Enable Secret Password
Disable SNMP
Set Scheduler Interval
Set Scheduler Allocate
Set Users
Enable Telnet Settings
Enable NetFlow Switching
Disable IP Redirects
Disable IP Proxy ARP
Disable IP Directed Broadcast
Disable MOP Service
Disable IP Unreachables
Disable IP Mask Reply
Disable IP Unreachables on NULL Interface
Enable Unicast RPF on Outside Interfaces
Enable Firewall on All of the Outside Interfaces
Set Access Class on HTTP Server Service
Set Access Class on VTY Lines
Enable SSH for Access to the Router

Router Hardening with the Cisco’s AutoSecure

Cisco also provides a One-step lockdown-like feature at the command line! This feature is called AutoSecure. It uses the command shown below:

Notice that this command can run fully automated like the One-step Lockdown mode of the Security Audit feature in SDM. You would issue the command auto secure no-interact. You should notice also that you can run “subsets” of the command’s full capabilities. For example, you could run auto secure management in order to just harden the network management capabilities of the router.

You might not be surprised to learn that the Command Line AutoSecure feature is capable of doing a bit more than the graphical user interface counterpart. Specifically, Cisco SDM does not implement these Cisco AutoSecure features:

Disabling NTP
Configuring AAA
Setting SPD values
Enabling TCP intercepts
Configuring antispoofing ACLs on outside interfaces

The Cisco SDM also implements some of the Cisco AutoSecure features differently. For example:

The SDM disables SNMP but does not configure SNMPv3 (on some routers).
The SDM enables and configures SSH on crypto Cisco IOS images, but does not enable SCP or disable other access and file transfer services, such as FTP for example.

Conclusion

As we have seen, there is more than one option when it comes to ensuring that your Cisco router is well protected against security vulnerabilities. Essentially, two GUI options exist within the Cisco SDM, and a very powerful command line option exists. Of course, administrators can always walk through configuration manually. Whatever you choose, progress with a plan of carefully testing to ensure your router hardening configurations do not cause disruptions within your production network. It is wonderful to be secure, but you do not want this security at the risk of a lack of functionality. We love the help desk phones to remain quiet!

« Previous Page