Basic Router and Switch Hardening

Nerd Cafe | نرد کافه

Objective

Implement essential security hardening on Cisco routers and switches to protect the network infrastructure from unauthorized access, mitigate basic attacks, and adhere to CIS Benchmark recommendations.

Topology

IP Addressing

Device	Interface	IP Address	Subnet
Router1	Fa0/0	192.168.1.1	255.255.255.0
Switch1	VLAN1	192.168.1.2	255.255.255.0
PC1	NIC	192.168.1.10	255.255.255.0
PC2	NIC	192.168.1.11	255.255.255.0
PC3	NIC	192.168.1.20	255.255.255.0
PC4	NIC	192.168.1.21	255.255.255.0

Practical Scenario

You are a network administrator tasked to secure a small branch office network. You must implement security best practices on the router and switch to prevent unauthorized access, ensure safe management, and mitigate attacks like ARP spoofing and IP spoofing.

The goal is to:

1. Secure device access (console, VTY, and enable passwords).

2. Disable unused services and interfaces.

3. Protect against common Layer 2 attacks.

4. Log all security-related events.

5. Apply Cisco CIS Benchmark recommendations for basic hardening.

Step 1: Secure Device Access

Router1

• Secure console access

Router(config)#line console 0
Router(config-line)#password Cisco123!
Router(config-line)#login
Router(config-line)#logging synchronous

• Secure VTY access

Router(config)#line vty 0 4
Router(config-line)#password Cisco123!
Router(config-line)#login
Router(config-line)#transport input ssh
Router(config-line)#logging synchronous

• Set the encrypted enable password for privileged exec mode

Router(config)#enable secret Cisco123!

• Encrypt all plaintext passwords in the configuration

Router(config)#service password-encryption

• Set the hostname of the device

Router(config)#hostname Router1

Switch1

Do the same for switch.

Switch(config)#line console 0
Switch(config-line)#password Cisco123!
Switch(config-line)#login
Switch(config-line)#logging synchronous
Switch(config-line)#exit
Switch(config)#line vty 0 4 
Switch(config-line)#password Cisco123!
Switch(config-line)#login
Switch(config-line)#transport input ssh
Switch(config-line)#logging synchronous
Switch(config-line)#exit
Switch(config)#enable secret Cisco123!
Switch(config)#service password-encryption
Switch(config)#hostname Switch1

CIS Benchmark: Disable insecure protocols (like Telnet) and enable encrypted passwords.

Step 2: Configure SSH for Secure Management

• Set the domain name for the router, required for generating RSA keys for SSH

Router1(config)#ip domain-name nerd-cafe.local

• Generate RSA key for SSH

Router1(config)#crypto key generate rsa
The name for the keys will be: Router1.nerd-cafe.local
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...[OK]

• Create a local user account with full administrative privileges (level 15) and store the password as a hashed secret for secure SSH authentication

Router1(config)#username admin privilege 15 secret Admin123!
*Mar 1 0:23:25.687:  %SSH-5-ENABLED: SSH 1.99 has been enabled

• Apply SSH version 2

Router1(config)#ip ssh version 2

Step 3: Disable Unused Services and Interfaces

• Disable unused router services

Router1(config)#no ip http server
Router1(config)#no ip http secure-server
Router1(config)#no cdp run
Router1(config)#no ip bootp server
Router1(config)#no service finger
Router1(config)#no service tcp-small-servers
Router1(config)#no service udp-small-servers

• Shutdown unused router interfaces

Router1#show ip interface brief 
Interface              IP-Address      OK? Method Status                Protocol
 
FastEthernet0/0        unassigned      YES unset  administratively down down
 
FastEthernet0/1        unassigned      YES unset  administratively down down
 
Vlan1                  unassigned      YES unset  administratively down down
Router1#configure terminal
Router1(config)#interface fastEthernet 0/1
Router1(config-if)#shutdown 

• Shutdown unused switch interfaces

Switch1(config)#interface range fastEthernet 0/6-24
Switch1(config-if-range)#sh
Switch1(config-if-range)#shutdown 

CIS Benchmark: Disable unnecessary services to reduce attack surface.

Step 4: Implement Layer 2 Security on Switch

• Disable unused ports and assign them to an unused VLAN

Switch1(config)#vlan 99
Switch1(config-vlan)#name BLACK-HOLE
Switch1(config-vlan)#exit
Switch1(config)#interface range fastEthernet 0/6-24
Switch1(config-if-range)#switchport mode access 
Switch1(config-if-range)#switchport access vlan 99

• Enable port security

Switch1(config)#interface range fastEthernet 0/1-5
Switch1(config-if-range)#switchport mode access
Switch1(config-if-range)#switchport port-security
Switch1(config-if-range)#switchport port-security maximum 2
Switch1(config-if-range)#switchport port-security violation restrict
Switch1(config-if-range)#switchport port-security mac-address sticky

• Disable DTP to prevent VLAN hopping

Switch1(config-if-range)#switchport nonegotiate

Step 5: Enable Logging and Monitoring

• Enable local logging and store log messages in the device buffer (4 KB size)

• "informational" level includes severity 6 and more critical messages (0–6)

Router1(config)# logging buffered 4096 informational

• Add date, time, and millisecond precision timestamps to log messages

• Improves forensic analysis and troubleshooting accuracy

Router1(config)# service timestamps log datetime msec

Step 6: Configure Router ACLs for Basic Protection

• Prevent private (RFC1918) addresses from entering from the Internet

Router1(config)#ip access-list extended ANTI-SPOOF
Router1(config-ext-nacl)#

• Block internal network addresses coming from WAN

Router1(config-ext-nacl)#deny ip 192.168.1.0 0.0.0.255 any

• Block other RFC1918 ranges

Router1(config-ext-nacl)#deny ip 10.0.0.0 0.255.255.255 any
Router1(config-ext-nacl)#deny ip 172.16.0.0 0.15.255.255 any

• Permit all other traffic

Router1(config-ext-nacl)#permit ip any any

• Apply it on WAN:

Router1(config)#interface fastEthernet 0/1
Router1(config-if)#description Internet-facing interface
Router1(config-if)#ip access-group 10 in

CIS Benchmark: Use ACLs to prevent spoofed traffic.

Step 7: Save Configuration

Router1#write memory
Building configuration...
[OK]
Router1#

💖 Support Our Work

If you find this post helpful and would like to support my work, you can send a donation via TRC-20 (USDT). Your contributions help us keep creating and sharing more valuable content.

TRC-20 Address: TAAVVf9ZxUpbyvTa6Gd5SGPmctBdy4PQwf

Thank you for your generosity! 🙏

Keywords

Router hardening, Switch hardening, Cisco IOS security, CCNA Security, CIS Benchmark, SSH configuration, Port security, Access control list, Extended ACL, Anti-spoofing, uRPF, Disable unused services, Secure management, Logging configuration, Password encryption, Enable secret, VTY security, DTP disable, VLAN security, Network device protection, nerd cafe , نرد کافه

Channel Overview

🌐 Website: www.nerd-cafe.ir

📺 YouTube: @nerd-cafe

🎥 Aparat: nerd_cafe

📌 Pinterest: nerd_cafe

📱 Telegram: @nerd_cafe

📝 Blog: Nerd Café on Virgool

💻 GitHub: nerd-cafe