A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
That's a default router's exposed services — HTTP server on, CDP on, BOOTP on, finger on, and only weak password obfuscation. Every one of these is an attack surface. Hardening is the process of turning them off systematically. The CIS Benchmarks for Cisco IOS publish the authoritative list.
! === Management Plane Hardening ===hostname R1-CORPip domain-name corp.example.comservice password-encryptionsecurity passwords min-length 12no ip http serverno ip http secure-serverno ip bootp serverno ip fingerno ip source-routeno service tcp-small-serversno service udp-small-serversservice tcp-keepalives-inservice tcp-keepalives-out!! === SSH and AAA ===aaa new-modelaaa authentication login default group TACACS_GROUP localaaa authorization exec default group TACACS_GROUP localaaa accounting exec default start-stop group TACACS_GROUP!username admin privilege 15 algorithm-type scrypt secret StrongP@ss2026!ip ssh version 2ip ssh time-out 60ip ssh authentication-retries 3crypto key generate rsa modulus 4096!line vty 0 15transport input sshexec-timeout 10 0logging synchronouslogin authentication defaultaccess-class MGMT_ACCESS in!line console 0exec-timeout 10 0logging synchronouslogin authentication default!line aux 0no exectransport input none!! === Logging and Monitoring ===service timestamps log datetime msec localtime show-timezonelogging host 10.10.99.10logging trap informationallogging source-interface loopback0!! === SNMPv3 ===snmp-server group SECURE_MON v3 auth privsnmp-server user monitor SECURE_MON v3 auth sha AuthPass123 priv aes 128 PrivPass123snmp-server host 10.10.99.10 version 3 priv monitor!! === NTP with Authentication ===ntp authentication-key 1 md5 NtpKey123ntp authenticatentp trusted-key 1ntp server 10.10.99.10 key 1ntp source loopback0!! === ACL to Restrict Management Access ===ip access-list standard MGMT_ACCESSpermit 10.10.99.0 0.0.0.255deny any log!! === Interface-Level Hardening ===interface range gi0/0 - 3no cdp enable!! === Save ===endwrite memory
That's a complete hardening template. It touches every management surface: SSH-only, TACACS+ for auth, strong passwords, timeouts, logging, secure SNMP, NTP with auth, ACL-restricted management. Applied to every device in the network, it moves the org from 'default insecure' to 'reasonably hardened baseline.'
| Plane | Focus | Key controls |
|---|---|---|
| Management | Admin access | SSH, AAA, ACLs, exec-timeout, disable unused services |
| Control | Routing protocol security | OSPF authentication, BGP MD5, routing protocol ACLs, passive interfaces |
| Data | User traffic | Port security, DHCP snooping, DAI, IP Source Guard, ACLs, Private VLANs |
| Compliance | Audit | Logging, NTP, SNMPv3, configuration backups, change control |
Hardening isn't a one-time task. Passwords rotate, new services get enabled by mistake, configuration drift happens. Best practice: run a configuration audit against a CIS Benchmark (or your own baseline) quarterly. Tools like Nipper, Batfish, or commercial products automate this. Manual review doesn't scale past 20 devices.
Apply the hardening checklist to a lab router. Verify with `show running-config` that HTTP server is off, SSH is required, minimum password length is set, and VTY lines have exec-timeout and ACL restrictions. Document each change in a note.
Section 16 complete. You've covered access control lists (standard, extended, named) and their verification, wireless authentication and encryption, WPA2/WPA3 Enterprise on Cisco WLC, and a full hardening checklist. Section 17 covers WAN, VPN, and modern network architectures.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.