ROUTER 1 HARDENING #enable #config #hostname R1 #username Admin privilege 15 secret adminpa55 #enable secret ciscoenpa55 #line con

0 #password ciscoconpa55 #login #ip domain-name ccnasecurity.com #ip ssh versin 2 #crypto key generate rsa #1024 #line vty 0 4 #transport input ssh #line vty 5 15 #transport input ssh #login block-for 30 attempts 3 within 60

ROUTER 3 #username radius password radius #username Admin privilage 15 secret adminpa55 #enable secret ciscoenpa55 #aaa new-model #radius-server host 10.0.3.1 #radius-server key radiuspa55 #aaa authentication login default group radius local enable #line con 0 login authe default #line vty 0 4 login authe default #ntp server 10.0.3.2

#service timestamps log datetime msec #logging trap #logging host 10.0.3.2 (opcional)

ROUTER 1 #access-list permit tcp 10.0.4.1 255.255.255.0 any eq 80 (http) #access-list permit icmp 10.0.4.1 255.255.255.0 any #access-list permit tcp 10.0.4.1 255.255.255.0 any eq ftp (http) #access-list ip deny any any #interface serial0/2/0 #ip access-group 101 in #interface serial0/2/1 #ip access-group 101 in #interface FastEthernet0/0 #ip access-group 101 in #inspect name TRAFICO tcp #inspect name TRAFICO icmp #interface FastEthernet0/0 #ip inspect TRAFICO in

SWITCH #interface range fastEthernet0/1-3 #spanning-tree portfast #spanning-tree bpduguard enable #spanning-tree guard root #switchport mode access #switchport port-segurity #switchport port-segurity mximum 2 #switchport port-segurity violation shutdown #switchport port-segurity mac-address sticky

#interface range fastEthernet0/4-24 #shutdown #switchport mode trunk #switchport nonegotiate #switchport mode trunk native vlan 2

VPN SITE-TO-SITE RO #access-list 120 permit tcp 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0 R2 #access-list 120 permit tcp 10.0.2.0 255.255.255.0 10.0.1.0 255.255.255.0 R0 #crypto isakmp policy 10 #encryption aes 256 #hash sha (md5) #authentication pre-share #group 2 #lifetime 3600 #crypto isakmp key vpnpass101 address 10.0.2.2

R2

#crypto isakmp policy 10 #encryption aes 256 #hash sha #authentication pre-share #group 2 #lifetime 3600 #crypto isakmp key vpnpass101 address 10.1.0.1

R0

#crypto ipesec transform-set VPN-SET esp-3des esp-sha-hmac #crypto map VPN-MAP 10 ipsec-isakmp #set peer 10.0.2.2

#set transform-set VPN-SET #match address 120

R2

#crypto ipesec transform-set VPN-SET esp-3des esp-sha-hmac #crypto map VPN-MAP 10 ipsec-isakmp #set peer 10.1.0.1 #set transform-set VPN-SET #match address 120

R0

#interface serial0/2/0 #crypto map VPN-MAP

R2

#interface serial0/0/0 #crypto map VPN-MAP