Central(config)# logging on

Central(config)# logging 14.2.9.1

Central(config)# logging buffered

Central(config)# logging console critical

Central(config)# logging trap informational

Central(config)# logging facility local1

East(config)# service timestamps log datetime localtime show-timezone msec

East(config)# clock timezone GMT 0

East(config)# ntp server 14.1.1.250

East(config)# ntp server 14.2.9.1

East(config)# no snmp community public ro

East(config)# no snmp community private rw

East(config)# no access-list 51

East(config)# access-list 51 permit 14.2.9.1

East(config)# snmp community BTRl8+never ro 51

Router Security Checklist

Router security policy written, approved, distributed. 

Router IOS version checked and up to date. 

Router configuration kept off-line, backed up, access to it limited. 

Router configuration is well-documented, commented. 

Router users and passwords configured and maintained. 

Password encryption in use, enable secret in use. 

Enable secret difficult to guess, knowledge of it strictly limited. 

(if not, change the enable secret immediately).  

Access restrictions imposed on Console, Aux, VTYs.  

Unneeded network servers and facilities disabled.  

Necessary network services configured correctly (e.g. DNS)  

Unused interfaces and VTYs shut down or disabled.  

Risky interface services disabled.  

Port and protocol needs of the network identified and checked.  

Access lists limit traffic to identified ports and protocols.  

Access lists block reserved and inappropriate addresses.  

Static routes configured where necessary.  

Routing protocols configured to use integrity mechanisms.  

Logging enabled and log recipient hosts identified and configured.  

Router’s time of day set accurately, maintained with NTP.  

Logging set to include consistent time information.  

Logs checked, reviewed, archived in accordance with local policy.  

SNMP disabled or enabled with good community strings and ACLs.