router-template.txt

! ===============================================================
! R O U T E R - [DEVICE-NAME]
! ===============================================================

enable
configure terminal

! Set Hostname
! ------------
hostname [HOSTNAME]


! Disable DNL
! -----------
no ip domain-lookup


! Enable Unicast Routing
! ----------------------
ipv6 unicast-routing


! Set Enable Password
! -------------------
enable secret [ENABLE-PASSWORD (cisco)]


! Set Console Password
! --------------------
line console 0
	motd-banner
	logging synchronous
	password [CONSOLE-PASSWORD (cisco)]
	exec-timeout [MINUTES (0)] [SECONDS (0)]
	login
	exit


! Configure Ports For Secure Access
! ---------------------------------
line vty [(PORT-RANGE (0 15)]
	motd-banner
	logging synchronous
	password [PORT-PASSWORD (cisco)]
	exec-timeout [MINUTES (0)] [SECONDS (0)]
	transport input [CONNECTION-TYPE (telnet) | (ssh))
	login [DB-LOCATION (local)]
	exit


! Write Banner MOTD
! -----------------
banner motd [BANNER-MODT (+This is a secure system. Authorized Access Only!+)]


! Configure (Sub-)Interface(s)
! ----------------------------
interface [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)][.SUBINTERFACE]
	description [NETWORK-DESCRIPTION]
	ipv6 enable
	encapsulation dot1Q [VLAN-ID] [native]
	ip address [(dhcp)] | [[PORT-IPv4-ADDRESS] [PORT-IPv4-SUBNET-MASK]]
	ipv6 address [(dhcp)] | [IPv6-ADDRESS/IPv6-PREFIX]
	ipv6 address [fe80::LLA-Address] link-local
	clock rate [CLOCK-RATE (64000)]
	no shutdown
	exit


! Adding Security Configurations (not available for all routers)
! --------------------------------------------------------------
! auto secure
service password-encryption
security passwords min-length [MIN-PASSWORD-LENGTH]
login block-for [TIMOUT-DURATION (180)] attempts [ATTEMPTS (3)] within [TIMESPAN (20)]


! Mitigate ARP & DHCP Attacks
! ---------------------------
ip dhcp snooping
ip dhcp snooping vlan [VLAN-ID]
ip arp inspection vlan [VLAN-ID]
ip arp inspection validate src-mac dst-mac ip


! Configure trusted (infrastructural) links
! -----------------------------------------
interface [(range)] [PORT-TYPE (gig/fa)] [PORT-NUMBER(S) (0/0, 0/1/1, ...)]
	ip dhcp snooping trust
	ip arp inspection trust
	exit


! Mitigate Reconnaisance Attacks
! ------------------------------
no cdp run
no lldp run


! Create DHCP-Pool(s)
! -------------------
ip dhcp excluded-address [START-IP-ADDRESS] [END-IP-ADDRESS(included)]
ip dhcp pool [POOLNAME]
	network [NETWORK-IP-ADDRESS] [NETWORK-IP-SUBNET-MASK]
	default-router [IP-ADDRESS]
	dns-server [IP-ADDRESS]
	domain-name [DOMAIN-NAME]
	lease [LEASE-DURATION(days hours minutes | infinite)]
	exit


! Enable DHCP-Service
! -------------------
service dhcp


! Disable Unused Services
! -----------------------
! no ip http server


! Configure Relay Agent
! ---------------------
int [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)]
	ip helper-address [IP-HELPER-ADDRESS]
	exit


! Enable OSPF Support
! -------------------
router ospf [PROCESS-ID (1)]
	router-id [RIP (IP-FORMAT)]
	network [NETWORK-ADDRESS] [WILDCARD-MASK] area [AREA-ID (0)]
	passive-interface [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)]
	default-information originate
	exit

interface [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)]
	ip ospf [PROCESS-ID (1)] area [AREA-ID (0)]
	exit


! Configure GRE Tunnels
! ---------------------
interface tunnel [TUNNEL-NR]
	tunnel mode gre ip
	tunnel source [SRC-INTERFACE]
	tunnel destination [DESTINATION-IP]
	ip address [IP-ADDRESS] [NETMASK]
	exit


! Add Static Routes
! -----------------
ip route 0.0.0.0 0.0.0.0 [IPv4-GATEWAY-OF-LAST-RESORT]
ip route ::/0 [IPv6-GATEWAY-OF-LAST-RESORT]


! Enable RIP Support
! ------------------
router rip
	version 2
	no auto-summary
	network [IP-NETWORK-ADDRESS]
	passive-interface [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)]
	default-information originate
	exit


! Enable BGP Support
! ------------------
router bgp [AS-NUMBER]
	bgp router-id interface [ROUTER-ID]
	network [NETWORK-ADDRESS] mask [NETMASK]
	! iBGP
	neighbor [NEIGHBOR-IP] remote-as [LOCAL-AS-NUMBER]
	neighbor [NEIGHBOR-IP] update-source [LOOPBACK-INTERFACE]
	! eBGP
	neighbor [PEER-IP] remote-as [REMOTE-AS-NUMBER]
	neighbor [PEER-IP] ebgp-multihop [MAX-HOP-COUNT (3)]
	exit
	

! Configure SSH-Access
! --------------------
ip domain-name [DOMAIN-NAME]
username [USERNAME] secret [SSH-PASSWORD]
username [USERNAME] privilege [PRIVILEGE-LEVEL (0-16)]
crypto key generate rsa general-keys modulus [MODULUS-LENGTH (2048)]
ip ssh version 2


! Add HSRP Redundancy
! -------------------
interface [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)]
	standby version 2
	standby [GROUP-ID] ip [IPv4-ADDRESS]
	standby [GROUP-ID] priority [PRIORITY (100)]
	standby [GROUP-ID] preempt
	exit


! Add NAT Service
! ---------------
! SNAT
ip nat inside source static [IP-INSIDE-ADDRESS] [IP-OUTSIDE-ADDRESS]

! DNAT (PAT-Option)
ip nat pool [NAT-POOLNAME] [START-IP-ADDRESS] [END-IP-ADDRESS] netmask [NETMASK] [overload]
access-list [ACL-NR] [permit | deny] [NETWORK-ADDRESS] [WILDCARD-MASK]
ip nat inside source list [ACL-NR] pool [NAT-POOLNAME]

! PAT
ip nat inside source list [ACL-NR] interface [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)] overload

interface [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)]
	ip nat [inside | outside]
	exit


! Define ACLs & Device Access
! ---------------------------
! Standard
ip access-list standard [ACL-NUMBER (1-99) | ACL-NAME]
	remark [ACL-REMARK]
	[SEQ-NUMBER] [deny | permit] [any | host [HOST-IP] | [NETWORK-ADDRESS] [WILDCARD MASK]] [any | host [HOST-IP] | [NETWORK-ADDRESS] [WILDCARD MASK]]
	deny any any
	exit

! Extended
ip access-list extended [ACL-NUMBER (100-199) | ACL-NAME]
	remark [ACL-REMARK]
	[SEQ-NUMBER] [deny | permit] [icmp | ip | tcp | udp | ospf] [any | host [HOST-IP] | [NETWORK-ADDRESS] [WILDCARD MASK]] [any | host [HOST-IP] | [NETWORK-ADDRESS] [WILDCARD MASK]] eq [PORT-NUMBER]
	deny ip any any
	exit

interface [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)]
	ip access-group [ACL-NUMBER | ACL-NAME] [in | out]
	exit

line vty [(PORT-RANGE(0 15)]
	ip access-class [ACL-NAME] [in | out]
	exit

! CBAC Configuration
ip access-list extended CBAC_ACL
	remark BLOCK_ALL_TRAFFIC
	deny ip any any
	exit

ip inspect name CBAC_INSPECTION [(icmp) | (tcp) | (udp) | (http)]

interface [OUTSIDE-INTERFACE]
	ip access-group CBAC_ACL in
	ip inspect CBAC_INSPECTION out
	exit


! Save Configuration
! ------------------
do write memory