Cisco IOS Security Hardening

Cisco IOS / IOS-XEAdvanced

CIS Benchmark and NSA/NIST-aligned security hardening checklist for Cisco IOS/IOS-XE. Covers AAA, SSH, login protection, management plane, and service hardening.

↓ example.txt

What is it?

Security hardening is the process of reducing a device's attack surface by disabling unnecessary services, enforcing strong authentication, and restricting management access. A factory-default Cisco IOS router has many insecure defaults: Telnet enabled, HTTP server running, CDP broadcasting hardware info, no brute-force protection. Hardening aligns the device with frameworks like CIS Benchmarks (Center for Internet Security) and NSA/NIST guidelines. The goal is that every management action is authenticated, logged, and restricted to authorized sources.

✓ When to use

·Before deploying any network device to production — hardening is not optional
·After a security audit finds misconfigured or default settings
·For compliance with PCI-DSS (requirement 2: no vendor defaults), HIPAA, SOC 2, or ISO 27001
·When adding new devices to an existing network — match the security baseline

✗ When NOT to use

·In a lab/test environment where rapid changes are needed — strict exec timeouts and login block-for can slow troubleshooting. Keep separate lab and production templates.
·Disabling CDP on all interfaces blindly — CDP is often needed for IP phone voice VLAN discovery. Be selective: 'no cdp enable' per interface rather than 'no cdp run' globally.

How it compares

vs CIS BenchmarksCIS (Center for Internet Security) publishes specific hardening benchmarks for Cisco IOS. This template covers the most critical controls. The full CIS benchmark has 200+ checks including interface-level settings.

vs STIG (DoD)DISA STIGs are the US Department of Defense's hardening standards — more stringent than CIS, required for government contractors. STIGs specify exact command syntax and are updated quarterly.

vs Cisco AutoSecure'auto secure' is a Cisco wizard that applies basic hardening interactively. This template gives you full control and repeatability. AutoSecure is good for quick hardening but not for automation pipelines.

Prerequisites

→Active AAA server (TACACS+ or RADIUS) for centralized authentication, or local user database as fallback
→Management ACL defined with your actual management source IPs — applying a management ACL with wrong IPs will lock you out
→NTP configured before applying hardening — login logs need accurate timestamps
→Test console access verified before applying VTY access restrictions

Config Generator

Hostname *

Domain Name *

Enable Secret *

TACACS+ / RADIUS Server

AAA Server Key

AAA Protocol

Exec timeout (minutes)

SSH timeout (seconds)

SSH auth retries

Management VRF name

Management ACL name

Allowed management sources

Disable CDP globally?

Disable LLDP?

Disable HTTP/HTTPS server?

Disable TFTP?

Disable PAD service?

Verification commands

show ip ssh

Verify SSH version 2 is running and RSA key is generated

Expected: SSH Enabled - version 2.0. Authentication timeout and retries should match policy.

show aaa sessions

Show active AAA sessions and authentication statistics

Expected: Lists active management sessions with username, IP, and time. Shows failed auth attempts.

show login

Show login block-for status and failed login tracking

Expected: Shows current block status, number of failed attempts, and quiet mode status

show running-config | include no ip|no service|no cdp

Verify hardening commands are in the running config

Expected: Should show all disabled services: no ip http server, no cdp run, no ip source-route, etc.

Debug commands

show tcp brief

Show all open TCP connections to and from the router

Common mistakes & fixes

⚡ Locked out of the device after applying management ACL

Cause: Management ACL includes wrong source IPs or subnet, blocking your own management station

Fix: Use console access (not blocked by VTY ACL). Modify the ACL to include your management IP. Always test with 'ip access-list standard TEST' before applying to VTY lines.

⚡ Login blocked for an unexpected period

Cause: 'login block-for' triggered after too many failed attempts

Fix: Check: 'show login'. Wait for the block-for period to expire, or access via console (not affected by login block-for).

⚡ IP phones stop working after disabling CDP

Cause: 'no cdp run' prevents the switch from telling IP phones which voice VLAN to use

Fix: Re-enable CDP globally: 'cdp run'. Then disable it selectively on WAN/external interfaces: 'no cdp enable' per interface.

⚡ TACACS+ authentication failing after applying AAA config

Cause: TACACS+ server unreachable, wrong shared key, or wrong server IP

Fix: Test: 'test aaa group tacacs+ <user> <pass> legacy'. If it fails, the TACACS+ server is the issue. Verify key matches server config. Local fallback prevents lockout if server is down.