! PermitANY — Cisco IOS Security Hardening
! CIS Benchmark and NSA/NIST-aligned security hardening checklist for Cisco IOS/IOS-XE. Covers AAA, SSH, login protection, management plane, and service hardening.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
hostname RTR-EDGE-01
ip domain-name corp.example.com
!
! ── Enable Secret ───────────────────────────────────────────────────
enable algorithm-type scrypt secret Sup3rS3cr3t!
!
! ── AAA ──────────────────────────────────────────────────────────────
aaa new-model

aaa group server tacacs+ AAA-SERVERS
 server-private 10.0.0.50 key TacacsKey2023!
!
aaa authentication login default group AAA-SERVERS local
aaa authentication enable default group AAA-SERVERS enable
aaa authorization exec default group AAA-SERVERS local
aaa authorization commands 15 default group AAA-SERVERS local
aaa accounting exec default start-stop group AAA-SERVERS
aaa accounting commands 15 default start-stop group AAA-SERVERS


!
! ── Password Policy ─────────────────────────────────────────────────
password encryption aes
service password-encryption
security passwords min-length 10
!
! ── Login Protection ────────────────────────────────────────────────
login block-for 60 attempts 5 within 30
login quiet-mode access-class ACL-MGMT-ACCESS
login on-failure log
login on-success log
!
! ── Management ACL ──────────────────────────────────────────────────
ip access-list standard ACL-MGMT-ACCESS

 permit 10.0.0.0 0.0.0.255

 deny any log
!
! ── SSH Hardening ───────────────────────────────────────────────────
crypto key generate rsa modulus 4096
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
ip ssh server algorithm authentication publickey keyboard password
ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr
no ip ssh server algorithm encryption 3des-cbc
ip ssh server algorithm mac hmac-sha2-256
!
! ── Banner ──────────────────────────────────────────────────────────
banner login ^
AUTHORIZED ACCESS ONLY. Unauthorized access is prohibited and will be prosecuted.
^
!
! ── Line Hardening ──────────────────────────────────────────────────
line con 0
 exec-timeout 10 0
 login authentication default
 transport input none
 logging synchronous
line vty 0 15
 exec-timeout 10 0
 login authentication default
 transport input ssh
 access-class ACL-MGMT-ACCESS in
 logging synchronous
!
! ── Service Hardening ───────────────────────────────────────────────
no service tcp-small-servers
no service udp-small-servers
no service finger
no service config

no service pad

service tcp-keepalives-in
service tcp-keepalives-out
!
! ── Protocol Hardening ──────────────────────────────────────────────
no ip source-route
no ip proxy-arp

no ip http server
no ip http secure-server


no cdp run


no lldp run

no ip bootp server
no ip identd

no ip tftp source-interface

no ip rcmd rcp-enable
no ip rcmd rsh-enable
!
! ── Control Plane Policing ──────────────────────────────────────────
ip access-list extended CPP-MANAGEMENT
 permit tcp 10.0.0.0 0.0.0.255 any eq 22
 permit icmp any any
 deny ip any any log
!
control-plane
 service-policy input COPP-POLICY
!