ccna 200-301 lynda

ccna 200-301 lynda.26 Chapter 2 Protecting Network Devicespersonnel must restore the configuration file within a reasonable amount of time. However, if there is no backup file, or if the backup file has elapsed, the outage will last longer.To prevent unauthorized access to infrastructure devices, appropriate security policies and controls must be implemented. While all infrastructure devices can be at risk, routers are the primary target of network attackers, due to the fact that routers are the traffic police, directing traffic into and out of the network.A border router is the last router between an internal network and an untrusted external network, such as the Internet. All traffic to and from the Internet in an organization passes through the border router, so it usually serves as the first and last line of defense for the network. The border router secures the perimeter of the protected network through initial and post-group filtering. It is also responsible for implementing a number of security features, depending on the security policy of the enterprise. For these reasons, it is essential to protect the routers in the network.2.1.1.2 Implementing SecurityDepending on the size of the enterprise and the requirements of the complexity of the network design, there are various options for implementing border routers. It can be a single router protecting the entire internal network, or the router can be used only as the first line of defense in a longitudinal defense means.Single Router ApproachIn the single router approach, a single router connects the protected network or internal LAN to the Intemeto which all security policies are configured. This is a common deployment method in small site implementations such as branch offices and SOHO sites. In smaller networks, the Integrated Services Router (ISR) is able to provide the required security features without compromising routing performance.Defense-in-Depth Approach The defense-in-depth approach is more secure than the approach that uses a single router. Traffic passes through multiple security layers before it enters the protected LAN. In this approach, the border router acts as the first line of defense, also known as the shield router, which releases all connections from the internal LAN to the firewall. The second line of defense is the firewall. The firewall does further filtering of the traffic that passes through the border router. It acts like a checkpoint (gatekeeper) device by tracking the status of each connection and providing additional access control. The border router has a set of rules to specify which traffic is allowed through and which is denied. By default, the firewall denies connections originating from external (untrusted) to internal (trusted) sources, while it allows internal users to establish connections to untrusted networks by default, and allows the returned traffic to pass through the firewall. It can also authenticate users (authentication agents) to restrict only authenticated users tocan access network resources. Routers are not the only devices used in the defense-in-depth approach; other security tools, such as IPS, can also be used. Another variation of the defense-in-depth approach to the DMZ method is to provide an intermediate zone, which is often referred to as a demilitarized zone (DMZ). DMZs can be used