R3#auto secure

	              --- AutoSecure Configuration ---
*** AutoSecure configuration enhances the security of
the router, but it will not make it absolutely resistant
to all security attacks ***

AutoSecure will modify the configuration of your device.
All configuration changes will be shown. For a detailed
explanation of how the configuration changes enhance security
and any possible side effects, please refer to Cisco.com for
Autosecure documentation.
At any prompt you may enter '?' for help.
Use ctrl-c to abort this session at any prompt.

Gathering information about the router for AutoSecure

Is this router connected to internet? [no]: yes
Enter the number of interfaces facing the internet [1]: 
Interface              IP-Address      OK? Method Status                Protocol 
GigabitEthernet0/0/0   172.16.3.1      YES manual up                    up 
GigabitEthernet0/0/1   unassigned      YES unset  administratively down down 
GigabitEthernet0/0/2   unassigned      YES unset  administratively down down 
Serial0/2/0            10.2.2.1        YES manual up                    up 
Serial0/2/1            unassigned      YES unset  administratively down down 
Vlan1                  unassigned      YES unset  administratively down down

Enter the interface name that is facing the internet: s0/2/0
Invalid interface
Enter the interface name that is facing the internet: serials0/2/0
Invalid interface
Enter the interface name that is facing the internet: serial0/2/0

Securing Management plane services...

Disabling service finger
Disabling service pad
Disabling udp & tcp small servers
Enabling service password encryption
Enabling service tcp-keepalives-in
Enabling service tcp-keepalives-out
Disabling the cdp protocol

Disabling the bootp server
Disabling the http server
Disabling the finger service
Disabling source routing
Disabling gratuitous arp

Here is a sample Security Banner to be shown
at every access to device. Modify it to suit your
enterprise requirements.

Authorized Access only
  This system is the property of So-&-So-Enterprise.
  UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED.
  You must have explicit permission to access this
  device. All activities performed on this device
  are logged. Any violations of access policy will result
  in disciplinary action.


Enter the security banner {Put the banner between
k and k, where k is any character}:#  Unauthorized Access Prohibited #
Enable secret is either not configured or
 is the same as enable password
Enter the new enable secret: cisco12345
Confirm the enable secret: cisco12345
Enter the new enable password: cisco12345
Choose a password that's different from secret
Enter the new enable password: cisco567890
Confirm the enable password: cisco567890

Configuration of local user database
Enter the username: admin01
Enter the password: cisco12345
Confirm the password: cisco12345

Configuring AAA local authentication
Configuring Console, Aux and VTY lines for
local authentication, exec-timeout, and transport
Securing device against Login Attacks
Configure the following parameters

Blocking Period when Login Attack detected: 60

Maximum Login failures with the device: 2

Maximum time period for crossing the failed login attempts: 30

Configure SSH server? [yes]: 

Enter the host name: R3
Enter the domain-name: ccnasecurity.com
Disabling mop on Ethernet interfaces

Securing Forwarding plane services...

Enabling CEF (This might impact the memory requirements for your platform)
Enabling unicast rpf on all interfaces connected
to internet

Configure CBAC Firewall feature? [yes/no]: no
Tcp intercept feature is used prevent tcp syn attack
on the servers in the network. Create autosec_tcp_intercept_list
to form the list of servers to which the tcp traffic is to
be observed
Enable tcp intercept feature? [yes/no]: no

This is the configuration generated:

!
service password-encryption
no cdp run
access-list 100 permit udp any any eq bootpc
banner motd #  Unauthorized Access Prohibited #
enable secret 5 $1$mERr$WvpW0n5HghRrqnrwXCUUl.
enable password 7 0822455D0A16504145535554
username admin01 password 7 0822455D0A165445415F59
aaa new-model
aaa authentication login local_auth local
line con 0
 login authentication local_auth
 exec-timeout 5 0
 transport output telnet
line vty 0 4
 login authentication local_auth
 transport input telnet
service timestamps debug datetime msec
service timestamps log datetime msec
logging trap debugging
logging console
logging buffered
line vty 0 4
 transport input ssh
 transport input telnet
hostname R3
ip domain-name ccnasecurity.com
ip access-list extended 100
 permit udp any any eq bootpc

 Apply this configuration to running-config? [yes]: yes
Applying the config generated to running-config
The name for the keys will be: test.test

% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be non-exportable...
*Mar  1 22:56:41.001: %SYS-3-CPUHOG: Task is running for (2007)msecs, more than
(2000)msecs (0/0),process = crypto sw pk proc.
-Traceback= 0x824198E0 0x82419FC4 0x8283C238 0x82866AD8 0x828667A8 0x82865D34 0x
828660F4 0x82866510 0x802335D4 0x80236D80 [OK]