On router platforms having software-only forwarding (e.g., Cisco 7200) most traffic handling, including access control list filtering and forwarding, is performed at interrupt level utilizing Cisco Express Forwarding (CEF) or dCEF (Distributed CEF). This implies that IOS does not need to perform a process context switch to forward a packet. Routing functions like OSPF or BGP run at the process level. In routers having hardware-based forwarding, like the Cisco 12000 series, IOS calculates the FIB in software and loads it into the forwarding hardware (like an ASIC or network processor), which completes the actual packet forwarding function.
Cisco IOS possesses a “monolithic” architecture, which implies that it runs as a single image and all processes will be sharing the same memory space. There is no memory protection amongst the processes, which implies that any bugs in IOS code can possibly corrupt data being utilized by other processes. It also comes with a run to completion scheduler, which implies that the kernel does not preventively stop a running process — the process must perform a kernel call before other processes get an opportunity to run. For Cisco equipment which needed very high availability, like the Cisco CRS-1, these restrictions were not satisfactory. In addition, competitive router operating systems which appeared 10 to 20 years after IOS, like Juniper’s JUNOS, were developed not to have these restrictions.
Cisco’s reply was to design a new version of Cisco IOS named IOS XR which provided modularity and memory protection amongst processes, lightweight threads, preventive scheduling and the capability to autonomously restart failed processes. IOS XR employs a third party real-time operating system microkernel (QNX), and a huge part of the current Cisco IOS code was re-written to benefit from the features provided by the new kernel. But the microkernel architecture eliminates from the kernel all processes which are not completely needed to run in the kernel, and implements them as processes comparable to the application processes. Via this method, IOS XR is able to attain the high availability necessary for the new router platform. Therefore, Cisco IOS and IOS XR are very dissimilar codebases, although they are actually interrelated in their functionality and design. In 2005, Cisco launched IOS XR for the Cisco 12000 series platform, extending the microkernel architecture from the CRS-1 to Cisco’s extensively installed core router.
In 2006, Cisco has presented IOS Software Modularity which extends the QNX microkernel into a more old-style IOS environment, but still supplying the software upgrade abilities which clients are demanding. It is presently obtainable on the Cisco Catalyst 6500 enterprise switch.
Cisco IOS – Security and Vulnerabilities
Due to the fact that Cisco IOS has to know the cleartext password for specific uses, (e.g., CHAP authentication) passwords entered into the CLI by default are feebly encrypted as ‘Type 7’ ciphertext, like “Router(config)#username jdoe password 7 0832585B1910010713181F”. This is developed to pre-empt “shoulder-surfing” attacks when studying router configurations and is not a safe method – they can be easily decrypted utilizing software known as “getpass” obtainable as of 1995, or “ios7crypt”, a current variant, even though the passwords can be decoded by the router by utilizing the “key chain” command and entering the type 7 password as the key, and then delivering a “show key” command; the above example decrypts to “stupidpass”. However, the program will not be able to decrypt ‘Type 5’ passwords or passwords set with the enable secret command, which utilizes salted MD5 hashes.
Cisco strongly recommends that all Cisco IOS equipment implement the authentication, authorization, and accounting (AAA) security model. AAA can use local, RADIUS, and TACACS+ databases. Nevertheless, a local account is normally still needed for emergency circumstances.
At the Black Hat Briefings conference held back in July 2005, Michael Lynn, while employed by Internet Security Systems at the time, presented proof of a possible vulnerability in Cisco IOS. Cisco had previously released a patch, but requested that this flaw not be made public. Cisco henceforth filed a lawsuit, but later settled this after an injunction was issued to pre-empt future disclosures.
Need more guidance? Just contact us today. We are a 100% Cisco-Certified partner and can assist you with all of your Cisco support questions.