Is the Internet Router safe in the Public?

[SagaLore]

I am relatively new to cisco routing so please bare with me.

Scenario:

The Internet T1 connects to the Internet Router, which then plugs into a swithc called Public. The PIX then plugs into the Public and then connects to the internal network.

My quesiton is, wouldn't it be safer to plug the Internet T1 into the PIX? Isn't the Internet Router at risk?

 

[IllegalOperation]

Depends what your using the router for. If it is just strictly an "internet router" that is merely acting as a CPE forwarding packets from the WAN to the PIX, then I wouldnt lose any sleep. I would just throw an access list on it.

 

[SagaLore]

But if I have a PIX, would it be more appropriate to connect the Internet T1 to the PIX instead? Or is the PIX not as efficient to handle an Internet T1 directly?

 

[dopehead]

It can't...only ethernet can terminate in a pix.

But you should enable ingress/egress filters on the router.

Jan

Network Systems Engineer
CCNA/CQS/CCSP

 

[tmt7734]

The only concerns you really have are denial of service attacks on you router or someone hacking into your router. Make sure you have vty connections disabled and an up to date IOS image and you have no worries.

 

[NetEng631]

Do you manage the router or does the ISP. If the ISP manages the router then thiers nothing you have to do. It's the ISP responsibilty to safe guard it.

NetEng

 

[SagaLore]

DoS and Hacking are THE concerns I have.

It is our own Internet Router. I always thought that the PIX was a beefy router with more features added. I thought maybe the PIX would accept a CSU/DSU module so the T1 could terminate into it. But that is just speculation...

 

[IllegalOperation]

Ive personally never tried it, but using an external CSU/DSU device to terminate into the PIX's outside ethernet interface sounds logical.


Just as a previous poster mentioned - having the vty connections disabled, and access list, and an up to date IOS image should put your concerns to rest. If for some reason a DOS attack occurs or a hacker somehow gets in the router, it can be easily detected and any damage that can be done would be minimal....

 

[dopehead]

Well, if a hacker somehow assumes control over your edge router, you have a big problem. Ip spoofing and mitm attacks come to mind. Also sniffing packets with the use of the router could be a serious issue all sorts og nasty things, Cisco have some nice guidelines for securing edge routers on their site.
You could also try the new 12.3 autosecure feature.

Jan

Network Systems Engineer
CCNA/CQS/CCSP