Cisco CCNA Preparation · lesson 30 of 36 · 25 min
Why Harden Network Devices?
A compromised router or switch can give an attacker control over the entire network — routing traffic through their systems, capturing credentials, or taking down connectivity. Device hardening reduces the attack surface by disabling unused services, securing management access, and enforcing authentication.
Disable Unused Services
Cisco IOS enables several services by default that are rarely needed and increase attack surface. Disable them unless specifically required.
Secure Passwords and AAA
AAA (Authentication, Authorisation, Accounting) is the framework for controlling who can access network devices, what they can do, and logging what they did. Cisco ISE or a RADIUS/TACACS+ server provides centralised AAA.
TACACS+ vs RADIUS
TACACS+ (Cisco proprietary): encrypts the entire packet, separates authentication/authorisation/accounting, supports per-command authorisation. Preferred for device management. RADIUS: open standard, encrypts only the password, combines authentication and authorisation. Preferred for network access (802.1X, VPN).
Login Banners and Exec Timeout
Additional Hardening
Knowledge Check — 10 Questions
Device Hardening
Why should CDP be disabled on interfaces facing untrusted networks?
- CDP uses too much bandwidth
- CDP reveals device model, IOS version, and IP addresses to potential attackers
- CDP conflicts with OSPF
- CDP is not supported on WAN interfaces
Answer: CDP reveals device model, IOS version, and IP addresses to potential attackers
CDP (Cisco Discovery Protocol) sends device information in plaintext. An attacker on the network can use CDP to map the topology and identify vulnerable device versions.
What does aaa new-model do?
- Creates a new AAA server
- Enables the AAA framework on the router, replacing line-level authentication
- Resets all AAA configuration
- Enables RADIUS only
Answer: Enables the AAA framework on the router, replacing line-level authentication
aaa new-model enables AAA and overrides line-level login commands (login, login local). After this, authentication is controlled by AAA method lists.
What is the key advantage of TACACS+ over RADIUS for device management?
- TACACS+ is an open standard
- TACACS+ encrypts the entire packet and supports per-command authorisation
- TACACS+ uses UDP for faster performance
- TACACS+ is easier to configure
Answer: TACACS+ encrypts the entire packet and supports per-command authorisation
TACACS+ encrypts the full payload (not just the password like RADIUS) and separates authentication, authorisation, and accounting — enabling per-command authorisation for granular control.
What does exec-timeout 5 0 do on a VTY line?
- Allows 5 login attempts
- Disconnects idle sessions after 5 minutes and 0 seconds
- Sets the SSH timeout to 5 seconds
- Limits sessions to 5 concurrent users
Answer: Disconnects idle sessions after 5 minutes and 0 seconds
exec-timeout [minutes] [seconds] auto-logs out idle sessions. exec-timeout 5 0 = 5 minutes. exec-timeout 0 0 = never timeout (insecure). Always set a timeout.
What is the purpose of login block-for 60 attempts 3 within 30?
- Allows 60 login attempts per 30 seconds
- Blocks all logins for 60 seconds after 3 failed attempts within 30 seconds
- Limits sessions to 3 users for 60 seconds
- Enables login logging for 30 seconds
Answer: Blocks all logins for 60 seconds after 3 failed attempts within 30 seconds
This command implements login rate limiting. After 3 failed login attempts within 30 seconds, the device blocks all login attempts for 60 seconds — mitigating brute force attacks.
What should be done with unused switch ports as a security best practice?
- Leave them in default VLAN 1
- Shut them down and assign them to an unused VLAN
- Enable port security only
- Configure them as trunk ports
Answer: Shut them down and assign them to an unused VLAN
Unused ports should be shut down (shutdown) and moved to an unused VLAN (not VLAN 1). This prevents unauthorised devices from connecting and accessing the network.
What does no ip source-route prevent?
- IP routing on the interface
- Attackers from specifying the path packets take through the network
- Source NAT
- OSPF route redistribution
Answer: Attackers from specifying the path packets take through the network
IP source routing allows the sender to specify the route a packet takes. Attackers can exploit this to bypass security controls. Disable with no ip source-route.
What does service timestamps log datetime msec do?
- Disables logging
- Adds date, time, and milliseconds to log messages
- Sends logs to a remote syslog server
- Enables NTP synchronisation
Answer: Adds date, time, and milliseconds to log messages
service timestamps log datetime msec adds precise timestamps to syslog messages. Essential for incident investigation and correlating events across devices.
The command no ip _____ disables the unencrypted web management interface on a Cisco router.
Answer: http server
no ip http server disables the HTTP (unencrypted) web management interface. Use no ip http secure-server to also disable HTTPS if web management is not needed.
Which syslog severity level should be configured for production logging to capture important events without flooding the log?
- 0 (emergencies)
- 3 (errors)
- 6 (informational)
- 7 (debugging)
Answer: 6 (informational)
logging trap informational (level 6) captures levels 0-6: emergencies, alerts, critical, errors, warnings, notifications, and informational. Level 7 (debugging) generates too much output for production.
Previous lesson: Named ACLs, ACL placement (inbound vs outbound), wildcard masks, verification
Back to Cisco CCNA Preparation
Next lesson: IPsec VPNs (remote access and site-to-site), AAA concepts (authentication, authorization, accounting), wireless security: WPA/WPA2/WPA3