The device itself is a target — its login, its management protocols, its control plane. This is the consolidated checklist we run on every Cisco box we take over: what to disable, what to encrypt, what to restrict, and how to verify it. Fifteen minutes that turn a soft target into a hard one.
Across this series we've hardened traffic through the device — ACLs, firewalls, L2 defences. This post hardens the device itself: the management plane (how you log in and monitor it) and the control plane (the CPU that runs routing and answers ARP). Both are attack surface, and both ship soft by default — default services on, weak or absent auth, management reachable from anywhere.
On internal pentests, the management plane is where a foothold becomes ownership: a default SNMP community dumps the whole config, a Telnet port sniffs a password, an unrestricted VTY line invites a brute-force. So this is deliberately a checklist, not a narrative — the exact commands we apply to every device we manage, grouped by area, each with the "why" and the verify. Run it top to bottom on any box you inherit and it goes from soft target to hard one in about fifteen minutes.
01
Strong, hashed credentials; no unencrypted passwords in the config; a login banner; and brute-force throttling on the login itself.
# Modern hashing: enable secret + username with type-8/9 (scrypt/PBKDF2) R1(config)# enable algorithm-type scrypt secret S0meStr0ng!Pass R1(config)# username admin privilege 15 algorithm-type scrypt secret Adm1n!Str0ng R1(config)# service password-encryption # hide any type-7 leftovers # Throttle brute force: after 3 fails in 60s, block logins for 60s R1(config)# login block-for 60 attempts 3 within 60 R1(config)# login on-failure log R1(config)# login on-success log # A legal banner (no "welcome" — that has helped attackers in court) R1(config)# banner login ^Authorised access only. Activity is logged.^
service password-encryption applies Cisco "type 7" encoding, which is trivially reversible — decoders are a web search away. It stops shoulder-surfing, nothing more. Never treat a type-7 string as a secret, and never post a config with one publicly thinking it's safe. Real protection is the one-way hashes: type 8 (scrypt) or type 9 for enable secret and username … secret. Audit an inherited box with show run | include secret|password — any bare password (type 0) or type-7 credential guarding real access is a finding.
02
SSH only, from the management subnet only, with idle timeouts. This is the single highest-value block — it's how attackers reach the box over the network.
# Who may even TRY to connect (from the ACL post) R1(config)# ip access-list standard MGMT-ONLY R1(config-std-nacl)# permit 192.168.99.0 0.0.0.255 R1(config-std-nacl)# deny any log R1(config-std-nacl)# exit R1(config)# line vty 0 4 R1(config-line)# transport input ssh # NO telnet, ever R1(config-line)# access-class MGMT-ONLY in # only from mgmt subnet R1(config-line)# login local # or AAA R1(config-line)# exec-timeout 10 0 # auto-logout idle sessions R1(config-line)# exit # Harden SSH itself: v2 only, strong keys, short grace, fewer retries R1(config)# ip ssh version 2 R1(config)# ip ssh time-out 60 R1(config)# ip ssh authentication-retries 3 R1(config)# crypto key generate rsa modulus 4096 # 2048 min, 4096 better
03
Legacy IOS ships with a pile of services that are attack surface and nothing else. Disable them. This block is pure risk reduction with zero downside on a modern network.
R1(config)# no ip http server # cleartext web mgmt R1(config)# no ip http secure-server # if you don't use it R1(config)# no service pad R1(config)# no ip finger R1(config)# no ip bootp server R1(config)# no service config R1(config)# no cdp run # or at least disable on WAN/edge ports # Per-interface, on anything facing users/untrusted: R1(config)# interface GigabitEthernet0/0 R1(config-if)# no ip redirects R1(config-if)# no ip unreachables R1(config-if)# no ip proxy-arp R1(config-if)# no lldp transmit
CDP and LLDP broadcast the device's model, IOS version, and management IP to any neighbour — gold for an attacker mapping the network, and something a pentester grabs in seconds off a live port. They're genuinely useful internally (mapping a rack, phone discovery), so the balance is: keep them on trusted switch-to-switch and switch-to-phone links, and turn them off on edge/WAN and user-facing ports (no cdp enable / no lldp transmit per interface). Never run CDP toward the internet. It's a classic finding precisely because it's on by default and rarely reviewed.
04
Two services that, misconfigured, hand over the box. SNMP in v3 only; AAA with a local fallback so a RADIUS outage doesn't lock you out. Both were built earlier in the series — here's the hardened form.
# SNMP: v3 auth+priv, restricted to the NMS by ACL. NO v2c communities. R1(config)# no snmp-server community public # nuke any defaults first R1(config)# no snmp-server community private R1(config)# snmp-server group MON v3 priv read MON-VIEW R1(config)# snmp-server user nms MON v3 auth sha AuthPass123 priv aes 128 PrivPass123 # AAA for admin logins, with LOCAL fallback (don't strand yourself) R1(config)# aaa new-model R1(config)# aaa authentication login default group radius local R1(config)# aaa authorization exec default group radius local R1(config)# aaa accounting commands 15 default start-stop group radius # command accounting = an audit trail of every privileged command typed.
05
The control plane is the CPU that runs routing, answers ARP, and terminates SSH. Flood it — a scan, a DoS, a broadcast storm — and the box's brain stalls even if the data plane is fine. CoPP rate-limits traffic destined to the CPU.
# Class the "punt to CPU" traffic you want to bound (management + ICMP) R1(config)# ip access-list extended CPP-MGMT R1(config-ext-nacl)# permit tcp 192.168.99.0 0.0.0.255 any eq 22 R1(config-ext-nacl)# exit R1(config)# class-map CPP-MGMT R1(config-cmap)# match access-group name CPP-MGMT R1(config-cmap)# exit R1(config)# policy-map CONTROL-PLANE-POLICY R1(config-pmap)# class CPP-MGMT R1(config-pmap-c)# police 64000 conform-action transmit exceed-action drop R1(config-pmap-c)# exit # Attach to the control plane itself R1(config)# control-plane R1(config-cp)# service-policy input CONTROL-PLANE-POLICY R1(config-cp)# end
CoPP is the one item on this list to approach carefully: a too-tight policer, or classes that accidentally match your routing-protocol hellos / SSH / ARP, can break the box's ability to route or be managed — the control-plane equivalent of shooting the pilot. Start permissive: police only clearly-abusive classes, leave a generous class class-default, and watch show policy-map control-plane counters for a while before tightening. On lower-end SMB gear it may not be needed at all; the platform's own hardware punt-limiting often suffices. Include it in an audit, but tune it, don't paste it.
06
To audit a box you didn't build, you don't read the whole config — you grep for the danger signs. These five reads surface almost every management-plane weakness.
| Command | Look for |
|---|---|
| show run | include transport|telnet | Any transport input telnet — should be ssh only. |
| show run | include snmp-server community | Any v2c community, especially public/private. |
| show run | include password|secret | Type-0/type-7 credentials guarding real access. |
| show run | section line vty | Missing access-class, missing timeout, telnet allowed. |
| show ip http server status | HTTP server enabled when it shouldn't be. |
| show run | include http server|cdp run|proxy-arp | Unneeded services still on. |
This post is the security spine of the whole series pulled into one runbook: SSH from First Contact, VTY access-class from ACLs, SNMPv3 from Observability, the self-zone from ZBF, and the L2 controls from Switch Security. Keep it as a template config with the site-specific bits (mgmt subnet, RADIUS IP, keys) as fill-in blanks, and every new device gets the same hardened baseline in minutes. Consistency is itself a security control — the box someone configured "quickly, just this once" is the one that gets popped.
Takeaways
login block-for, and never trust a type-7 string.access-class to the mgmt subnet, idle timeouts, strong SSH keys. It's how the network reaches the box.show run | include reads surface almost every weakness; a consistent hardened template prevents them.NOCTIS runs exactly this checklist — plus the L2 and traffic-plane controls from across our writeups — as a hardening audit for hotels, clinics, and SMBs. You get a findings report and the fixes applied, from the same people who'd otherwise find the holes on a pentest.
Book a Discovery Call →