2811 - Please review my work

Question

Hi. Newbie to the Cisco world.
I have a spare Cisco 2811 router from which I removed/disabled all Voice and WAN devices (VIC2-2FXS, VWIC-1MFT-T1, VIC2-4FXO, PVDM2-48). I would like to now use this router in a basic network configuration with 2 VLANs (voice and data) for a regional office. An illustration of that office network is below.
Would you please review my router config and let me know if you see any problems? Besides the requirements listed, I want to make sure that the internal network is protected from the outside. Also, please let me know if there is a way to restrict RDP to y.y.y.11 only if the incoming address is from the b.b.b.0/24 public subnet (I own this entire Class C).
Thanks in advance for your assistance.
Requirements
Allow all traffic between VLAN 1 and VLAN 100 and vice versa.
Allow both VLANs to reach the Internet
Router to provide DHCP for phones (server will provide for workstations)
Need SSH on vty 0 4
Allow RDP from outside to get to server on y.y.y.11 (would prefer to restrict this to particular subnet b.b.b.0/24)
Network Illustration

Answer 1

Hi, [email protected].
As shh5455 told it should work well. But from my point of view it's better to change line "ip nat inside source static tcp y.y.y.11 3389 interface FastEthernet0/0 3389" to "ip nat inside source static tcp y.y.y.11 3389 a.a.a.7 3389" (btw the mask for outside interface is 24? Really?)
And from securety side your router is no good. What can be good to do:
1. Turn off telnet (espessially if you want configure router from the internet. But first need configure SSH. Look at 11 point bellow):
line vty 0 4
 transport input ssh
exit
2. Make access to vty lines only from trasted IP addresses:
access-list 2 remark ----- ACL for VTY Lines -----
access-list 2 permit [permited IP address or pool of IP addresses]
access-list 2 deny any log
line vty 0 4
 access-class 2 in
exit
3. As I know 2811 has vty lines 5 - 15 too. So you need copy settings from vty 0 - 4 to 5 - 15.
4. Turn on logging information (at last for local storage. But it's better to send logged information to external device). By default it turned on but buffer size is small:
logging buffered [size_of_buffer]
no logging console
logging on
And for external device:
logging [host address]
Also add a line for logging failed authentications:
security authentication failure rate [number of failed tryes before sending a log message] log
5. Make ACL for external interface with access only for needed services (btw I prefer extended ACL for this, so example by this type of ACL):
ip access-list extended Outer_shield
 remark ------ACCESS-LIST FOR OUTER INTERFACE IN --------
 remark *** Permit access
 permit tcp b.b.b.0 0.0.0.255 host a.a.a.7 eq 3389
! If you want configure router from the internet
 permit tcp [trusted IP addresses or any] host a.a.a.7 eq 22
! If you want check your router by ICMP
 permit icmp [trusted IP addresses or any] host a.a.a.7 eq [needed parameters]
 remark *** Deny all other
 deny   ip any any [log | if you want logging all blocked connections]
exit
It's better to use CBAC to make "holes" in ACL above for the traffic that is going outside. So you can use lines:
ip inspect name IF_Outside icmp router-traffic
ip inspect name IF_Outside tcp
ip inspect name IF_Outside udp
ip inspect name IF_Outside ftp
And put this all to your outside interface:
interface FastEthernet0/0
 ip access-group Outer_shield in
 ip inspect IF_Outside out
exit
6. Turn off CDP at last at outside interface:
interface FastEthernet0/0
 no cdp enable
exit
7. It's better to turn on aaa authentication. Right now you have made athentication via password at the lines. But you can forget to install it in the future or there can be update at the new IOS (for example at 2901 router I had a situation when with new IOS I got new line (with the name line 2) and this line by default had access by all protocols and from any interface. Only thanks to logging about fail authentications I noticed it). For turning it on use:
username [username] secret [password]
aaa new-model
aaa authentication login default local
8. Somebody can use aux interface instead of console interface for configuring router. Copy settings from con 0 to aux 0.
9. Turn off source routing:
no ip source-route
10. turn off http and https servers (or at last put ACL for it):
no ip http server
no ip http secure-server
or
ip http access-class 2
ip http authentication [aaa or local] (if you configured point 7)
11. Well, I don't see settings for ssh. So you can use it:
crypto key generate rsa general-keys label [lable] modulus [size] (btw this command don't shows at "show running-config")
ip ssh rsa keypair-name [lable]
ip ssh time-out 30
ip ssh authentication-retries 2
ip ssh version 2
ip ssh logging events
You can also tune some additional settings like bunner and so. But all what listed above is better to do.