GW2

Audit Date: Tue Oct 23 13:33:31 2001 GMT

Importance Pass/Fail Rule Name Instance Line Number.
3 pass no ip http server
3 FAIL no snmp-server n/a 453
3 pass no ip source-route
3 pass forbid SNMP community public
3 pass forbid SNMP community private
3 pass enable secret
3 FAIL Inbound antispoof ACL definition n/a 1
3 FAIL Define VTY ACL n/a 1
3 pass Apply inbound antispoof
2 pass service password-encryption
2 pass require line passwords
2 FAIL ntp source n/a 1
2 pass ntp server
2 pass no service udp-small-servers
2 pass no service tcp-small-servers
2 pass no service finger
2 pass no service config
2 FAIL no ip proxy-arp Serial6/0/1 85
2 FAIL no ip proxy-arp Serial6/0/0 77
2 pass no ip identd
2 FAIL no ip directed broadcast Serial6/0/1 85
2 FAIL no ip directed broadcast Serial6/0/0 77
2 pass no ip bootp server
2 FAIL no cdp run n/a 1
2 pass logging trap debugging
2 FAIL logging console critical n/a 1
2 pass logging buffered
2 pass vty transport telnet
2 FAIL vty login vty 472
2 FAIL vty exec-timeout vty 472
2 pass enable logging
2 FAIL console exec-timeout con 465
2 FAIL clock timezone GMT 0 n/a 1
2 pass clock summer-time
2 FAIL aux exec-timeout aux 468
2 pass set syslog server
2 FAIL set syslog facility n/a 1
2 FAIL service timestamps n/a 1
2 FAIL Apply VTY ACL vty 472
1 FAIL aux no exec-timeout aux 468
1 FAIL aux no tranport aux 468
Summary for GW2

#Rules #Passed #Failed %Passed
39 21 18 53

Perfect Weighted Score Actual Weighted Score %Weighted Score
89 48 53

Note: PerfectWeightedScore is the sum of the importance value of all rules. ActualWeightedScore is the sum of the importance value of all rules passed, minus the sum of the importance each instance of a rule failed.

Fix Script for GW2

! The following commands may be entered into the router to fix problems found.
! They must be entered in config mode (IOS).
! Fixes which require specific information (such as uplink interface device name or specific
! access list numbers) are listed bu commented out.  Examine them, edit and uncommment.
!
! THESE CHANGES ARE ONLY RECOMMENDATIONS.
! CHECK THESE COMMANDS BY HAND BEFORE EXECUTING.  THEY MAY BE WRONG.  THEY MAY BREAK YOUR ROUTER.
! YOU ASSUME FULL RESPONSIBILITY FOR THE APPLICATION OF THESE CHANGES.
!

no snmp-server
!no access-list 107
!access-list 107 deny   ip 10.0.0.0 0.255.255.255 any
!access-list 107 deny   ip 127.0.0.0 0.255.255.255 any
!access-list 107 deny   ip 172.16.0.0 0.15.255.255 any
!access-list 107 deny   ip 192.168.0.0 0.0.255.255 any
!access-list 107 deny   ip EDIT-BY-HAND any
! YOUR INTERNAL ADDRS HERE ^^^^^^^^^^^^
!access-list 107 deny   ip any 10.0.0.0 0.255.255.255
!access-list 107 deny   ip any 127.0.0.0 0.255.255.255
!access-list 107 deny   ip any 172.16.0.0 0.15.255.255
!access-list 107 deny   ip any 192.168.0.0 0.0.255.255
!access-list 107 permit ip any any
!
!no access-list 107
!access-list 92 permit ip 10.1.1.1
!access-list 92 permit ip EDIT-BY-HAND any
! YOUR INTERNAL ADDRS HERE ^^^^^^^^^^^^
!
!ntp source EDIT-BY-HAND

int Serial6/0/1
no ip proxy-arp
exit


int Serial6/0/0
no ip proxy-arp
exit


int Serial6/0/1
no ip directed-broadcast
exit


int Serial6/0/0
no ip directed-broadcast
exit

no cdp run
logging console critical

line vty 0 4
login
exit


line vty 0 4
exec-timeout 5 0
exit


line con 0
exec-timeout 5 0
exit

clock timezone GMT 0

line aux 0
exec-timeout 0 10
exit

logging facility local1
service timestamps log datetime show-timezone

line vty 0 4
access-class 92 in
exit


line aux 0
no exec
exit


line aux 0
transport input none
exit