Cisco is the worldwide leader in IT, networking, and cybersecurity solutions. We help companies of all sizes transform how people connect, communicate, and collaborate. Cisco CLI Analyzer. The Cisco CLI Analyzer (formerly ASA CLI Analyzer) is a smart SSH client with internal TAC tools and knowledge integrated. It is designed to help troubleshoot and check the overall health of your Cisco supported software. My Notifications.

To reset your router configurations back to the original factory settings, follow the steps below. This will delete any configuration you have on your router.

The steps below assume you have connected your router to a console and have accessed your router’s command line interface.

Turn off your router.
Turn on your router and within the first 20 seconds of startup send a break character to the terminal.
- Windows – If you are using PuTTY, on your keyboard press Ctrl + Break at the same time; or you right click on the bar at the top of the PuTTY window and select Special Command > Break.
- Mac – If you are using terminal, on your keyboard press Control + A, then Control + B.
- You may also refer to the Cisco page on Standard Break Key Sequence Combinations During Password Recovery.
You will immediately be taken to the prompt.
At the prompt, type the following command to tell the router to skip the existing configuration on startup: confreg 0x2142.
At the prompt, type the following command to restart the router: reset.
The router will restart.
If you are prompted for initial configuration dialogue, type no.
After the loading has stopped, press Return to be taken to the main prompt.
At the prompt:
- Type en to enter privileged mode
- Type write erase to issue the erase comment
- Type y to confirm erase command
- Type configure t
- Type config-register 0x2102 this tells the router to process existing config on startup
- Type end
Turn off your router and then turn it back on. Your router has now been restored to the original factory settings.

Contents

Overview
Three Components of Security
Operational Threats
Operational Security Measures
Defense in Depth
Complexity and Security
Regulation and Compliance
Cisco Products Covering Operational Security
Summary
Acknowledgments
References

In multiprotocol label switching (MPLS) VPN security discussions, the general statement often heard is, “MPLS is not secure, because a simple operator mistake (such as the misconfiguration of a route target) can break VPN isolation.” Such statements display some fundamental misunderstandings, which this white paper will attempt to explain.

Another similar example may illustrate why operational mistakes are not an argument against a certain technology. Assume an operator makes a mistake in a firewall configuration that accidentally leaves a security hole open. Nobody would argue that firewalls are insecure due to such an act. Since the operator has the authority to make changes, the operator implicitly has the authority to make mistakes. These examples help to show why operational problems are a different category of security. Strictly speaking, you cannot trust your network operators, which can present a very difficult problem.

Security depends on three components, each of which is independent of the others:

Architecture (or algorithm) set in place: This is the formal specification. In cryptography it is the algorithm itself, in the case of MPLS VPNs, it is the formal specification (as defined in RFC4364).
Implementation of the architecture or algorithm: Refers to how the architecture or algorithm is actually being implemented. Programming mistakes, such as buffer overflows, can affect this component.
Operation thereof: This includes operator issues, such as choosing weak passwords on routers or workstations, or accidental disclosure of a shared key. For example, configurations could be sent to untrusted third parties.

Note that these components are not specific to networking or even computing. Physical security has the same three fundamental properties and the possibility of failing any of them. A door lock for example, can have weaknesses in the design (for instance, constructed using the wrong material), manufacturing mistakes (for instance, not fixed properly to the door), or operational mistakes (for instance, leaving the key under the doormat).

The main conclusion is that an operational mistake, such as a misconfiguration in an MPLS provider edge (PE) router, does not automatically imply that the architecture is insecure. Misconfigurations can happen in any technology, which means operational security measures need to be in place to catch such issues.

There are two types of operational security problems:

Accidental misconfigurations: These are accidental in nature, and are by far the most frequent type of operational issues. Mistyping a value (such as the route target in MPLS VPNs) is one example, or forgetting statements in a firewall is another example.
Deliberate misconfigurations: These are deliberate in nature but vary in their degree of maliciousness. For example, violation of the security policy to allow an operator's home system access through the corporate firewall is not as likely to be as severe as acts of sabotage by a disgruntled employee.

The impact of misconfigurations of either type can range from little or no effect to catastrophic. This is especially true in the case of accidental misconfigurations, where there is a reasonable chance that the true extent of the resulting security breach is not even discovered. It should also be noted that only a minor fraction of possible misconfigurations will actually result in a security breach. Naturally, deliberate misconfigurations will be more likely to result in a breach, since there is malicious intent with a goal to break the security policy.

Currently, in the case of MPLS VPNs, the biggest concern in the industry is accidental misconfigurations. The likelihood that an operator mistypes a route target, or makes other configuration mistakes cannot be overlooked. This type of mistake could cause a given VPN site to become part of another VPN, breaking the separation of both VPNs. When this happens by accident, it is unlikely that either side will discover the true nature of the incident. The misplaced site will usually realize that it cannot reach its business applications any longer, while the other VPN may not notice the breach at all, unless there is address space overlap or some routing issues due to the new prefixes. This issue is a serious concern of VPN users.

The typical reaction when looking for a solution to a security problem is to look for features to configure. It is important to understand that operational problems cannot be fully solved by features, because the person making the misconfiguration may also remove the feature that is meant to protect against misconfigurations. Operational problems require operational solutions, and operational competence of the organization.
Operational solutions include:

Operational security policy: There should be clear guidelines on what operators are allowed to do and what they are not allowed to do. Escalation paths need to be defined that outline the steps to follow if an operator does not have the authorization required for a specific action. The operational security policy should clearly define the responsibilities and authorization, as well as disciplinary actions in case of breaches. The policy also acts as a deterrent against deliberate misconfiguratio

Control Break Cisco