Unit 11: Hardening network devices · Lesson 2 of 4 · 18 min

Locking down the management plane

Audit every switch and router config for web admin, telnet, default SNMP, missing access lists and missing remote logging.

mission

You are
The engineer preparing the network hardening report.
Situation
The running configs of five devices are in ~/devices/*/running.cfg.
Goal
Check every device against five hardening rules with one command each.
Hand in
A device by rule table of failures.

Five rules for the management plane

  1. No web adminno ip http server
  2. SSH onlytransport input ssh
  3. No default SNMPno community public; prefer SNMPv3
  4. Access list on vtyonly the management network may log in
  5. Remote logginglogging host on every device
01

Web admin and telnet

grep -l lists files that match. -x matches whole lines, so no ip http server does not count.

analyst@net-lab
grep -lx 'ip http server' */running.cfg
sw-floor1/running.cfg
sw-floor3/running.cfg
grep -l 'transport input.*telnet' */running.cfg
edge-rtr2/running.cfg
sw-floor1/running.cfg

you should see Two devices run the web admin server and two still accept telnet.

02

Default SNMP community

public is the first community string anyone tries.

analyst@net-lab
grep -l 'community public' */running.cfg
sw-floor1/running.cfg
sw-floor3/running.cfg
03

Missing controls

grep -L lists files that do not match, which is what you want for required settings.

analyst@net-lab
grep -L 'logging host' */running.cfg
core-rtr1/running.cfg
edge-rtr2/running.cfg
sw-floor1/running.cfg
grep -L 'access-class' */running.cfg
edge-rtr2/running.cfg
sw-floor1/running.cfg

you should see sw-floor1 fails every rule, and core-rtr1 has lost its logging host.

defender tip Put management interfaces in a separate VRF or VLAN reachable only from jump hosts, and alert on any login from elsewhere.

04

Compare SNMP settings

SNMPv1 and v2c send their community strings in clear text. SNMPv3 with priv encrypts them.

analyst@net-lab
grep -h 'snmp-server' */running.cfg | sort | uniq -c
      2 snmp-server community n3tm0n-RO-2026 RO
      2 snmp-server community public RO
      1 snmp-server group NETMON v3 priv

you should see Only one device uses SNMPv3. Two still use public.

What a defender takes away

  1. 1Audit configs with simple text searches, then automate the same checks.
  2. 2SSH only, access lists on every vty, no default SNMP.
  3. 3Every device sends its logs somewhere it cannot erase them.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.