How to audit switch hardening: the checklist
To audit switch hardening, compare each switch's running configuration with a checklist grouped by plane: management access (AAA, SSH, line timeouts, banners), logging and time, SNMP, services to disable, and the data plane. Cisco publishes such a checklist for IOS in its hardening guide. NacTrack evaluates the collected configuration of every device against a baseline for its platform and keeps, for each check, the evidence found and the commands that would fix it.
What you need
- Module required: compliance.
- Permission required: view_audit.
- Seventeen baselines: Cisco IOS 12, IOS 15, IOS XE 16 and 17, IOS XR 7, NX-OS, ASA and Cisco Business, Huawei VRP, Aruba AOS-CX, Dell OS10, Arista EOS, Junos, FortiOS, PAN-OS, F5 TMOS, Nokia SR OS.
In NacTrack
- 1
Open Security, then Compliance
The report opens on the fleet score, the checks passing and the open findings, then the posture by platform and the top remediations. Each device is listed with its platform, the baseline used, a score, the trend and the number of checks.
Screen: app.nactrack.com/compliance/report
- 2
Open one switch
The device page lists every check run against it: code, title, severity, status (pass, fail or waived), the evidence found in the configuration, the recommendation and the fix. That row is your checklist line, with its proof attached.
Screen: app.nactrack.com/compliance/report
- 3
Export the result
The PDF, XLSX and CSV buttons export the fleet result; each device also has its own PDF. A failure you accept can be waived, and a waived check leaves the score.
Screen: app.nactrack.com/compliance/report
The checklist, for a Cisco IOS switch
Management access: AAA new-model with authentication and authorisation, "enable secret" rather than "enable password", no local user with a clear-text password, SSH version 2 only on the VTY lines with an inbound access-class, and an exec-timeout on console and VTY lines.
Logging and time: a remote syslog host, a buffered log, consistent timestamps, and NTP from a trusted source with authentication. SNMP: no "public" or "private" community, no read-write community, SNMPv3 with privacy where possible, and an ACL on what remains.
Services: the HTTP server, small TCP and UDP servers and Finger off; CDP and LLDP off on interfaces facing untrusted networks; Smart Install disabled where the platform supports it. Each item is a line you can grep for in "show running-config". The default SNMP communities and the clear-text local users come from the NacTrack baselines; the rest follows Cisco's guide.
What this view does not tell you
- The evaluation reads the configuration, not the behaviour of the device. A service enabled in the configuration may still be unreachable behind an ACL, and the check will fail anyway.
- The Cisco IOS baselines do not check BPDU guard, the shutdown of unused ports, or Smart Install. BPDU guard is checked on NX-OS, Aruba AOS-CX and Dell OS10 only. Those items stay on your manual list for IOS.
- The result is as fresh as the last evaluation. Run All queues one evaluation per device in the background, and scheduled weekly runs are off unless enabled. A device with no collected configuration is skipped.
Further reading
Network configuration compliance, rule by rule
Named rules evaluated against each device's real configuration, with the extract that triggers each failure and the matching remediation.
How-to guideHow to check whether a device still allows Telnet
Telnet carries passwords in clear text. The devices still answering on port 23 are the ones nobody is watching, which is why they get missed.
How-to guideHow to find devices using default or version 1 and 2c SNMP communities
An SNMP community is a password in clear text, and v1 and v2c have nothing else. Find the devices still carrying public, private or no better.