Cisco Router Basic Setup Template

Recently, Cisco routers (mostly 800–1800 series) for my company's branches often have to be configured from scratch so as not to recruit one and the same team a dozen times for myself has compiled a small template for various settings. I’ll say right away that I didn’t receive any certificates from Cisco, I didn’t read any books on these routers, I gained all my experience using scientific method, smoking manuals on cisco.com and some thoughtful borrowing of pieces of other configs ...



So, unpack the router, upload the latest firmware (for SSH, a minimum of Advanced Security is required), do

#erase startup-config

in order to get rid of pre-configured garbage and overload.

Configure authorization and access via SSH

! enable password encryption

service password-encryption

! use the new AAA model and local user base

aaa new-model

aaa authentication login default local

! we get the user with the maximum rights

username admin privilege 15 secret PASSWORD



! give the name of the router

hostname <...>

ip domain-name router.domain

! we generate a key for SSH

crypto key generate rsa modulus 1024

! SSH tuning

ip ssh time-out 60

ip ssh authentication-retries 2

ip ssh version 2

! and enable it on the remote console

line vty 0 4

transport input telnet ssh

privilege level 15

Setting up routing

')

! enable accelerated packet switching

ip cef

Time setting

! GMT + 2 time zone

clock timezone Ukraine 2

clock summer-time Ukraine recurring last Sun Mar 2:00 last Sun Oct 2:00

! NTP system clock update

ntp update-calendar

! It is better to set the ntp server by ip, because if the DNS server is not available when the DNS server is overloaded, then the settings by the names go off ...

ntp server NTP.SERVER.1.IP

ntp server NTP.SERVER.2.IP

Archiving Configs

! we include archiving of all changes of a config, hiding passwords in logs

archive

log config

logging enable

hidekeys



! history of config changes can be viewed by the command

show archive log config all

DNS setup

! enable name resolution

ip domain-lookup

! turn on the internal DNS server

ip dns server

! we register DNS provider

ip name-server XXX.XXX.XXX.XXX

! just in case we add several public DNS servers

ip name-server 4.2.2.2

ip name-server 208.67.222.222

ip name-server 208.67.220.220

LAN setting

! usually the internal switch ports on the router are combined in Vlan1

interface Vlan1

description === LAN ===

ip address 192.168.???.1



! we include on the interface counting of packets transmitted to customers - it is convenient to see who eats up traffic

ip accounting output-packets



! see the statistics can be a team

show ip accounting

! to clear

clear ip accounting

Setting up a DHCP server

! we exclude some addresses from a pool

ip dhcp excluded-address 192.168.???.1 192.168.???.99

! and configure the address pool

ip dhcp pool LAN

network 192.168.???.0 255.255.255.0

default-router 192.168.???.1

dns-server 192.168.???.1

Internet and Firewall Setup

! we configure the filter of the entering traffic (by default everything is prohibited)

ip access-list extended FIREWALL

permit tcp any any eq 22



! enable inspection of traffic between the local network and the Internet

ip inspect name INSPECT_OUT dns

ip inspect name INSPECT_OUT icmp

ip inspect name INSPECT_OUT ntp

ip inspect name INSPECT_OUT tcp router-traffic

ip inspect name INSPECT_OUT udp router-traffic

ip inspect name INSPECT_OUT icmp router-traffic



! set up a port on the Internet and put some protection on it

interface FastEthernet0/0

description === Internet ===

ip address ???.???.???.??? 255.255.255.???

ip virtual-reassembly

ip verify unicast reverse-path

no ip redirects

no ip directed-broadcast

no ip proxy-arp

no cdp enable

ip inspect INSPECT_OUT out

ip access-group FIREWALL in



! and finally, the default gateway

ip route 0.0.0.0 0.0.0.0 ???.???.???.???

NAT Setup

! on the internet interface

interface FastEthernet0/0

ip nat outside



! on the local interface

interface Vlan1

ip nat inside



! we create the list of IP having access to NAT

ip access-list extended NAT

permit ip host 192.168.???.??? any



! enable NAT on the external interface

ip nat inside source list NAT interface FastEthernet0/0 overload



! add inspection of popular protocols

ip inspect name INSPECT_OUT http

ip inspect name INSPECT_OUT https

ip inspect name INSPECT_OUT ftp

Disable unnecessary services

no service tcp-small-servers

no service udp-small-servers

no service finger

no service config

no service pad

no ip finger

no ip source-route

no ip http server

no ip http secure-server

no ip bootp server



UPD. Removed too much on the advice of habrouser

UPD2. Added disable unnecessary services

UPD3. Changed firewall setting (thanks to Fedia )