Proper authentication model

Tue Jan 11 09:17:55 UTC 2005

Hello,
I'd like everyones 2 cents on the BCP for network management of an ISP
PoPs, with a non-security oriented NOC,

Most of my routers doesnt have crypto IOS images, 
couldnt agree with core members to do a major upgrade, just a promise
of doign that when other needs to an IOS upgrade come up,
So i need to workaround it and secure management traffic somehow,

Usually the NOC logs to the PoPs 24x7, so i definitely need to hit a
balance between encryption/security and usability,
thats why i excluded OTP, 

My homework concluded:

1) Establishing an ipsec tunnel from each NOC Pc to a VPN
concentrator, and of course on every PC, there would be static routes
injected to take management traffic through the tunnel,

Major advantage is usability and transperancy to the user,
One major pitfall here is when ipsec tunnels break, my presence would
be needed to troubleshoot that,

2) An OpenBSD bastion host(s), where the NOC would ssh in, get
authenticated from TACACS+ or ssh certs, and then just telnet from
there all day,

One major advantage here is the heavy monitoring/limiting i can do on
a *nix box, systrace their login shell to a policy
(telnet/ping/traceroute only)

3) Or just an IOS based bastion router that also runs ssh, 

This has the advantage of IOS limitations in a way, not much
maintaining is needed but being limited with 16 vtys is a problem,
also vtys may get stuck and all these ssh sessions would kill the
memory of the router,

I would of course have multiple setups one at the Datacenter, another
at some PoP, redundant solutions incase one fails,

and For the record, I do run rancid, syslogging and we do AAA, so its
just down to whats others experiences/ideas about secure management?