Beyond SSH, what do you harden on a router or switch?
Show the answer
Say this first
I think in planes. Management plane: AAA with TACACS+, management only from a dedicated network or VRF, SNMPv3 with authentication and privacy instead of community strings, authenticated NTP, remote syslog, a login banner, and unused services off (HTTP server, Telnet, CDP and LLDP on untrusted edges). Control plane: routing protocol authentication, CoPP, and limits like BGP maximum-prefix. Data plane: ACLs and uRPF at the edges, no proxy ARP or ICMP redirects where they are not needed. Plus verified software images and config backups with change tracking.
Go deeper
Example lines
no ip http server
no ip http secure-server
no ip source-route
service tcp-keepalives-in
service timestamps log datetime msec localtime show-timezone
!
interface GigabitEthernet0/0/0
description ISP1
no ip proxy-arp
no ip redirects
no cdp enable
no lldp transmit
no lldp receive
!
snmp-server group NETOPS v3 priv
snmp-server user nms1 NETOPS v3 auth sha Auth-Pass-2026 priv aes 128 Priv-Pass-2026
!
ntp authentication-key 1 md5 Ntp-Key-2026
ntp authenticate
ntp trusted-key 1
ntp server 10.99.0.10 key 1
!
logging host 10.99.0.20
logging trap informationalNewer releases offer stronger NTP and SNMP hash options; use them where both ends support them.
Why each matters
- CDP or LLDP on an internet or untrusted edge leaks model, software version and addresses.
- Time must be right for logs, certificates and correlation, and unauthenticated NTP can be spoofed.
- SNMPv2c communities travel in clear and often give read access to the whole config.
- Proxy ARP hides addressing mistakes and helps an attacker reach things through the router.
- Remote syslog keeps evidence when a device is wiped or rebooted.
They will ask next
What is management plane protection on IOS?
Under
control-plane host,management-interface Gi0/0/1 allow ssh snmprestricts management protocols to the listed interfaces, so SSH arriving on any other interface is dropped.How do you know a device's image has not been tampered with?
Check the image hash against the vendor's published value (
verify /md5 flash:<image>or a SHA variant), and use platforms with secure boot that verify signed images at startup.
Traps
- Answering only "disable Telnet". Hardening is a checklist across management, control and data planes.