Router Audit Tool — Complete Guide to Cisco IOS & IOS-XE Security Hardening

Paste your show running-config output into the tool below. The engine checks your configuration against 60 security controls from CIS Benchmark, DISA STIG, and the NSA Router Security Configuration Guide — entirely in your browser. Nothing is uploaded to any server.

The average enterprise router has 23 security misconfigurations. Most take less than five minutes to fix once you know they exist. The one that doesn’t get fixed is the one an attacker uses to pivot into your network, establish persistence, and spend 87 days — the median dwell time for router compromises — reading your traffic undetected.

A router security audit compares a device’s running configuration against a known-good security baseline — enforcing SSH-only access, disabling cleartext SNMP community strings, requiring authenticated NTP, and ensuring every routing protocol session has MD5 or SHA authentication. Done manually it takes 30 minutes per device and a spreadsheet. Done with this tool, five seconds.

The rest of this guide explains exactly what each check means — why it matters, what the real-world attack looks like, and the precise IOS commands that fix it. Whether you’re preparing for a CCNP Security exam, hardening a production edge router, or satisfying a PCI DSS audit, every section below is written to be immediately actionable.

Why This Matters — By The Numbers

What Is a Router Security Audit? History & Context

Definition and Purpose

A router audit checks a device’s running or startup configuration against a set of known security requirements. The output is a list of controls that pass, controls that fail, and the exact commands needed to remediate each failure. The goal is to close the gap between a factory-default Cisco router — which is configured for maximum compatibility, not maximum security — and a hardened device suitable for an enterprise perimeter or carrier edge.

Manual audits involve a network engineer reading a configuration printout and checking each line against a spreadsheet of requirements. This works, but it’s slow, error-prone, and impossible to scale across dozens or hundreds of devices. Automated router audit tools like this one parse the configuration programmatically, apply every check in under a second, and produce structured output that can be exported to CSV, Markdown, JSON, or PDF for compliance documentation.

Who needs a Cisco router security audit: network engineers before any device goes live in production, security teams conducting quarterly compliance reviews, MSPs managing client infrastructure, and penetration testers verifying whether a client’s perimeter devices are hardened before they start looking for deeper vulnerabilities.

The NSA Router Security Configuration Guide (RSCG)

The authoritative starting point for Cisco IOS security is the NSA’s Router Security Configuration Guide (RSCG), first published in 2001 at 248 pages. It covered four broad areas: disabling unnecessary services, controlling management access, filtering routing traffic, and implementing logging and monitoring. Cisco configuration syntax has not changed dramatically at the command level, so the NSA RSCG remains largely valid.

What the RSCG cannot cover: SSH v2 cipher restriction, SNMPv3, Type 8 and Type 9 password hashing, Control Plane Policing (introduced in IOS 12.3(4)T in 2003), or any IOS-XE-specific syntax. The RSCG is a foundation, not a complete modern standard.

CIS Benchmark for Cisco IOS

The Center for Internet Security publishes regularly updated benchmarks for Cisco IOS and IOS-XE, available at cisecurity.org. Level 1 consists of foundational controls safe to apply on any production router. Level 2 adds advanced controls that may have operational trade-offs, such as strict Control Plane Policing rate limits and RPKI for BGP route origin validation.

Why Router Auditing Matters More Than Ever

Threat actors in 2023 and 2024 specifically targeted misconfigured network infrastructure. The Volt Typhoon APT group compromised Cisco routers at critical infrastructure organizations across the United States by exploiting weak or default credentials on unaudited management interfaces. The NSA and CISA issued a joint advisory in 2023 explicitly calling out router misconfigurations as the primary initial access vector.

The BGP hijacking incidents — Pakistan Telecom taking YouTube offline in 2008, Rostelecom redirecting Apple and Google traffic in 2022 — all exploited the absence of BGP authentication and route origin validation. These are configuration failures, not software vulnerabilities. They are detectable in 30 seconds by a router audit tool.

According to Mandiant’s M-Trends 2023 report, the median attacker dwell time for infrastructure device compromises is 87 days. Attackers stay undetected longer on network devices because most organizations lack logging and monitoring for configuration changes. The archive log config feature in IOS, which this tool checks for, produces a complete record of every configuration command entered with timestamp and username. Most routers don’t have it enabled.

The Original SANS RAT vs. Modern Requirements

What the 2002 SANS/CIS RAT Checked

The 2002 CIS Router Audit Tool checked 37 rules across six categories. For its time it was excellent work. Here is the full original rule set:

What Has Changed Since 2002

SSH v2 and cipher restriction: The command ip ssh version 2 disables SSHv1 negotiation entirely. Modern audits must restrict SSH to CTR-mode ciphers only, rejecting CBC-mode ciphers vulnerable to the BEAST attack.

SNMPv3 with encryption: The correct modern check is: eliminate all SNMPv1 and v2c community strings entirely, and verify SNMPv3 is configured with priv mode (authentication and encryption).

AAA framework: The 2002 RAT did not check for AAA at all. The aaa new-model command is now a foundational requirement under PCI DSS 8.2, NIST SP 800-53 IA-2, and HIPAA §164.312(d).

Type 8 and Type 9 password hashing: In 2025, MD5-based password hashes are crackable by commodity GPU hardware running Hashcat in minutes on common passwords. Type 8 (SHA-256 with PBKDF2) and Type 9 (scrypt, memory-hard) are the current standards.

Control Plane Policing: Not introduced until IOS 12.3(4)T in 2003, CoPP has no analog in the original RAT. It protects the router’s software-based control plane from being overwhelmed by crafted packets.

IOS Classic vs. IOS-XE: 20 Years of Security Architecture Changes

Classic IOS Architecture

Classic Cisco IOS, running on platforms like the ISR G1/G2, 7200, and 7600 series, is a monolithic operating system. All processes — routing, forwarding, management, crypto — run within a single shared memory space. The version numbering follows the 12.x train (e.g., 12.4(24)T, 12.2(33)SXI). Configuration is stored in NVRAM as startup-config and loaded into RAM as running-config.

From an auditing perspective, classic IOS uses numbered ACLs (1–99 for standard, 100–199 for extended), classic EIGRP autonomous-system syntax, crypto ca for PKI (later renamed crypto pki), and SNMP v1/v2c community-based access.

IOS-XE Architecture

IOS-XE, running on the ASR 1000, ISR 4000, CSR 1000v, and Catalyst 9000 series, separates the IOS software layer from the underlying operating system. On ASR 1000 platforms, the underlying OS is QNX. On CSR 1000v and Catalyst 9000, it is Linux. This separation provides process isolation — a crashing IOS-XE process does not crash the entire platform. Version numbering follows the 16.x and 17.x trains.

Configuration Differences That Affect Auditing

A router audit tool that does not distinguish between IOS classic and IOS-XE syntax will produce false positives and false negatives. Key differences:

• PKI syntax: Classic IOS uses crypto ca identity; IOS-XE uses crypto pki trustpoint.
• Named EIGRP: Classic EIGRP uses router eigrp <asn>. Named EIGRP (IOS-XE preferred) uses router eigrp <name> with an address-family block and af-interface sub-commands for authentication.
• HTTPS server: Classic IOS enables HTTPS with ip http secure-server. IOS-XE 17.x adds ip http secure-active-session-modules for module-level control.
• SSH algorithm restriction: The ip ssh server algorithm encryption and ip ssh server algorithm mac commands are available from IOS 15.2(2) onward.

This tool’s hierarchical block parser handles both syntaxes. Interface blocks, line blocks, router protocol blocks (including named EIGRP address-family sub-blocks), archive blocks, and control-plane blocks are all parsed in correct structural context — not via flat line-by-line regex matching.

IOS-XE Version-Specific Security Defaults

IOS-XE 17.3 and later disable 3DES by default on new key generation, and many platforms no longer accept 3DES-CBC for SSH negotiation. However, a device upgraded to 17.3 from 16.x may retain legacy SSH configuration. The only reliable check is explicit algorithm configuration, which is what this tool verifies.

Authentication & AAA — The Complete IOS Deep Dive

Why AAA Is the Foundation of Router Security

Without the AAA framework, Cisco IOS authentication is line-level. A line password on the VTY lines is a single shared credential — every administrator who SSH’s into the device uses the same password, there is no per-user logging, there is no lockout mechanism, and removing access requires changing the shared password and distributing the new one.

AAA (Authentication, Authorization, Accounting) is the framework that changes this. Authentication answers “who are you?” Authorization answers “what are you allowed to do?” Accounting answers “what did you do?” — generating per-session and per-command records sent to the TACACS+ server with timestamp and username.

AAA is required by PCI DSS v4.0 Requirement 8.2, NIST SP 800-53 Rev 5 IA-2, HIPAA §164.312(d), and is the first check in the DISA STIG for Cisco IOS XE Router at category CAT I.

The aaa new-model Command

The aaa new-model command is the master switch for the entire AAA framework. Entering it immediately changes how all authentication works — line passwords are overridden, and any undefined method list falls back to local authentication.

! Step 1: Create a local fallback user FIRST
username admin privilege 15 algorithm-type scrypt secret MyStrongPass123!
! Step 2: Enable the AAA framework
aaa new-model
! Step 3: Define authentication — TACACS+ first, local fallback
aaa authentication login default group tacacs+ local
! Step 4: Define authorization — who gets an EXEC shell
aaa authorization exec default group tacacs+ local if-authenticated
! Step 5: Define accounting — what they do
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

Login Brute-Force Protection

! Block all logins for 60s if 5 failures within 30s
login block-for 60 attempts 5 within 30
! During lockout period, allow only management IPs
login quiet-mode access-class MGMT-ONLY
! Log every third failure (reduce log noise)
login on-failure log every 3
! Log every success
login on-success log

IOS Privilege Levels

IOS supports 16 privilege levels, numbered 0 through 15. The principle of least privilege suggests that not all network engineers need level 15. Custom privilege levels allow fine-grained control:

! Allow "show running-config" at privilege level 7
privilege exec level 7 show running-config
! Assign a user to a specific privilege level
username netops privilege 7 algorithm-type scrypt secret NOCpass!

SSH v2 Hardening — Ciphers, MACs, Key Exchange

SSH Is a Protocol Family, Not a Specific Algorithm

Enabling SSH on a Cisco router does not mean your management access is secure. SSH is a protocol framework that negotiates algorithms at connection time — and the algorithms IOS accepts by default include several that have been deprecated, attacked, or broken.

Default IOS SSH accepts: 3DES-CBC (64-bit block cipher, Sweet32 attack), AES-128-CBC and AES-256-CBC (CBC mode, vulnerable to the BEAST attack), HMAC-MD5 and HMAC-SHA1 (both deprecated by NIST SP 800-131A Rev 2), and potentially Diffie-Hellman group1 (768-bit, factored by the Logjam attack).

Enforcing Strong Ciphers — CTR Mode Only

ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh server algorithm mac hmac-sha2-256 hmac-sha2-512
ip ssh server algorithm kex diffie-hellman-group14-sha1
ip ssh dh-min-size 2048
! Generate a 4096-bit RSA key pair
crypto key zeroize rsa
crypto key generate rsa modulus 4096
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3

Password Hashing Types 0, 5, 7, 8, and 9 — Explained

Cisco IOS stores passwords using a type prefix in the configuration. That single digit before the hash string tells you everything about whether the credential is recoverable.

! Type 0 — plaintext (never acceptable)
enable password cisco
! Type 5 — MD5, crackable in minutes on GPU
enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0
! Type 7 — XOR cipher, instantly reversible
username admin password 7 0822455D0A16544541B
! Type 9 — scrypt (preferred)
enable secret 9 $9$nhEmQVczB7dqsO$X.HsgL3x1VxeLeL...
username admin privilege 15 algorithm-type scrypt secret MyStr0ngPass!

no enable secret
no enable password
enable algorithm-type scrypt secret MyNewStrongPass123!
username admin privilege 15 algorithm-type scrypt secret MyNewStrongPass123!

SNMP Security — From Community Strings to SNMPv3

The SNMP Attack Surface

SNMP (Simple Network Management Protocol) is the most dangerous service on most network devices. SNMPv1 and v2c authenticate via community strings — short text passwords embedded in cleartext UDP packets. There is no encryption, no replay protection, and no lockout mechanism. A brute-force attack against SNMP v2c proceeds at wire speed.

What SNMP read access reveals: the complete routing table, every interface and its IP address, the ARP cache, CDP neighbor information, and the full MIB-II tree including device uptime, hardware model, and IOS version. Every piece of information needed to plan a network attack is available via SNMP read access.

SNMP write access is functionally equivalent to console access. An attacker with read-write SNMP access can shut down interfaces, manipulate routing tables, change ACL configurations, and — on some platforms — overwrite the startup configuration.

Why Changing Community Strings Is Not Sufficient

The original SANS RAT checked only whether the community strings were literally “public” or “private.” The actual problem is that any SNMPv1 or v2c community string is vulnerable: brute-force attacks against SNMP community strings are trivial, operate at line rate, and produce no log entries on default IOS configurations. The solution is not a stronger community string — it is eliminating SNMPv1 and v2c entirely.

Complete SNMPv3 Configuration

! Step 1: Remove ALL community strings (eliminates v1/v2c)
no snmp-server community public
no snmp-server community private
! Step 2: Create MIB views
snmp-server view FULL-VIEW iso included
! Step 3: Create groups with auth + priv (encryption mandatory)
snmp-server group NETMGMT v3 priv read FULL-VIEW write FULL-VIEW
! Step 4: Create user (auth SHA, encryption AES-128)
snmp-server user NETOPS NETMGMT v3 auth sha AuthPass123! priv aes 128 PrivPass123!
! Step 5: Restrict by ACL
ip access-list standard SNMP-ACL
 permit 10.0.100.0 0.0.0.255
 deny any log
snmp-server group NETMGMT v3 priv access SNMP-ACL
snmp-server contact noc@company.com
snmp-server location "DC1 Row3 Rack12 U14"
snmp-server enable traps config
snmp-server host 10.0.100.50 version 3 priv NETOPS

The difference between SNMPv3 authNoPriv and priv: with authNoPriv, the payload travels in cleartext UDP. A passive network tap captures all MIB data. With priv, the entire payload is AES-128 encrypted. Always use priv mode.

Interface Hardening — The Per-Interface Security Checklist

Why Interface-Level Checks Are Different

Global IOS security commands protect the control plane. Interface-level commands protect the data plane — the forwarding path for traffic flowing through the router. Both are essential. A router with perfect global hardening but no interface-level controls is still vulnerable to topology disclosure, traffic redirection, and source address spoofing attacks.

The Six Per-Interface Security Commands

no ip redirects

ICMP redirect messages tell a host to use a different next-hop router. In an attack, a threat actor sends crafted ICMP redirect messages to hosts, redirecting their traffic through an attacker-controlled device — enabling man-in-the-middle interception without any software vulnerability.

no ip unreachables

ICMP “destination unreachable” messages reveal network topology. Disable on all interfaces, particularly on external-facing interfaces. This makes the router’s unroutable space completely dark to external probes.

no ip mask-reply

ICMP address mask replies tell an attacker exactly what subnets are behind each router interface. There is no legitimate use case for ICMP mask replies in a modern network.

no ip proxy-arp

Proxy-ARP causes a router to respond to ARP requests on behalf of hosts in other subnets. Attackers exploit proxy-ARP to conduct ARP spoofing attacks across subnet boundaries.

no ip directed-broadcast

In the Smurf DDoS attack, an attacker spoofs the victim’s IP address and sends ICMP echo requests to the directed broadcast address of a large network. Every host on that network responds to the victim’s IP, amplifying the attack traffic by a factor of the number of hosts.

interface GigabitEthernet0/0
 description *** UPLINK ISP-PRIMARY ***
 ip address 203.0.113.2 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip mask-reply
 no ip proxy-arp
 no ip directed-broadcast
 no cdp enable
 ip access-group INGRESS-FILTER in
 ip verify unicast source reachable-via rx
! Unused interface template
interface GigabitEthernet0/3
 description UNUSED - SHUTDOWN
 no ip address
 shutdown

Routing Protocol Security — OSPF, EIGRP, BGP

The Real-World Cost of Unauthenticated Routing

February 2008: Pakistan Telecom accidentally leaked a BGP route for YouTube’s prefix globally. YouTube was offline worldwide for approximately two hours. The vulnerability: no BGP route origin validation, no authentication on the peer session.

April 2010: China Telecom announced 37,000 BGP prefixes belonging to organizations including the US military. For 18 minutes, approximately 15% of global internet traffic was routed through China Telecom’s network.

April 2022: Rostelecom hijacked BGP prefixes belonging to Apple, Google, Meta, Twitter, and Akamai. No software vulnerabilities were exploited — only misconfigured or absent BGP authentication and route filtering.

None of these incidents required a software vulnerability. A 10-minute configuration change — adding MD5 authentication to BGP peer sessions and basic prefix filtering — would have prevented all of them.

OSPF Authentication

! Process-level authentication (all interfaces in area)
router ospf 1
 area 0 authentication message-digest
! Per-interface configuration
interface GigabitEthernet0/1
 ip ospf message-digest-key 1 md5 OSPFKey123!
 ip ospf authentication message-digest

EIGRP Authentication

! Classic EIGRP — key chain MD5
key chain EIGRP-KEYS
 key 1
  key-string EIGRPkey!
interface GigabitEthernet0/1
 ip authentication mode eigrp 100 md5
 ip authentication key-chain eigrp 100 EIGRP-KEYS
! Named EIGRP (IOS-XE preferred) — HMAC-SHA-256
router eigrp ENTERPRISE
 address-family ipv4 unicast autonomous-system 100
  af-interface GigabitEthernet0/1
   authentication mode hmac-sha-256 EIGRPsha256key!

BGP Authentication and GTSM

router bgp 65001
 neighbor 203.0.113.1 remote-as 65002
 ! MD5 session authentication
 neighbor 203.0.113.1 password BGPsecret!
 ! GTSM — Generalized TTL Security Mechanism (RFC 5082)
 neighbor 203.0.113.1 ttl-security hops 1

GTSM (Generalized TTL Security Mechanism, RFC 5082) is one of the highest-impact, lowest-effort BGP security improvements available. By requiring that BGP TCP packets arrive with a TTL of 254, it ensures that only directly connected peers can establish BGP sessions. GTSM prevents remote BGP session attacks without cryptographic authentication overhead.

Control Plane Policing (CoPP)

The Data Plane vs. the Control Plane

Every router has two fundamentally different packet processing systems. The data plane forwards packets between interfaces at line rate using dedicated hardware (ASICs on the ASR 1000, the Quantum Flow Processor on the ISR 4000). The control plane runs routing protocols (BGP, OSPF, EIGRP), responds to ICMP pings, processes SSH sessions, handles SNMP polls — the control plane runs on the main CPU in software.

An attacker who floods the control plane with crafted packets — OSPF hellos, BGP OPEN messages, SSH connection attempts, ICMP pings — can overwhelm the CPU and cause routing protocol adjacencies to drop. The result is a network outage. This attack requires no software vulnerability — only the ability to send packets to the router’s interfaces.

CoPP Architecture

ip access-list extended COPP-OSPF
 permit ospf any any
ip access-list extended COPP-BGP
 permit tcp any any eq 179
ip access-list extended COPP-SSH
 permit tcp 10.0.100.0 0.0.0.255 any eq 22
ip access-list extended COPP-ICMP
 permit icmp any any
class-map match-any COPP-ROUTING-CRITICAL
 match access-group name COPP-OSPF
 match access-group name COPP-BGP
class-map match-any COPP-MANAGEMENT
 match access-group name COPP-SSH
class-map match-any COPP-ICMP
 match access-group name COPP-ICMP
policy-map COPP-POLICY
 class COPP-ROUTING-CRITICAL
  police rate 512000 bps burst 32000 byte
   conform-action transmit
   exceed-action transmit
 class COPP-MANAGEMENT
  police rate 1000000 bps burst 128000 byte
   conform-action transmit
   exceed-action drop
 class COPP-ICMP
  police rate 256000 bps burst 16000 byte
   conform-action transmit
   exceed-action drop
 class class-default
  police rate 128000 bps burst 8000 byte
   conform-action transmit
   exceed-action drop
control-plane
 service-policy input COPP-POLICY

Logging, NTP & Timestamps

Why Timestamps Are a Security Control

PCI DSS v4.0 Requirement 10.3.3 explicitly requires time synchronization with millisecond precision across all in-scope systems. Without msec in your timestamp configuration, you are non-compliant. Without millisecond timestamps, SIEM correlation across multiple event sources becomes unreliable.

! Timestamps with milliseconds and timezone (mandatory)
service timestamps log datetime msec localtime show-timezone
service timestamps debug datetime msec localtime show-timezone
logging buffered 65536 informational
logging source-interface Loopback0
logging host 10.0.100.50 transport udp port 514
logging trap informational
logging facility local7
logging userinfo
login on-failure log every 3
login on-success log

Configuration Change Logging via Archive

archive
 log config
  logging enable
  logging size 500
  notify syslog contenttype plaintext
  hidekeys

NTP Authentication

ntp authenticate
ntp authentication-key 1 md5 NTPkey123!
ntp trusted-key 1
ntp server 216.239.35.0 key 1 prefer
ntp server 216.239.35.4 key 1
ntp source Loopback0

Management Plane Hardening

The Management Plane Defined

The management plane comprises all traffic destined for the router itself for administrative purposes: SSH sessions, SNMP polls, HTTP/HTTPS web management, NETCONF/RESTCONF API calls, and ICMP pings to the router’s own interfaces. The gold standard is a dedicated management VRF with a separate out-of-band management interface that is physically disconnected from the production network.

no ip http server
ip http secure-server
ip http secure-port 8443
ip access-list standard HTTPS-MGMT
 permit 10.0.100.0 0.0.0.255
 deny any log
ip http access-class HTTPS-MGMT

Disabling Unnecessary Services

Ingress/Egress ACLs & Anti-Spoofing with uRPF

Why IP Source Address Spoofing Matters

IP source address spoofing enables DDoS reflection attacks, bypassing IP-based access control lists, and evading network forensics. Unicast Reverse Path Forwarding (uRPF) provides dynamic, routing-table-based anti-spoofing that handles all cases automatically.

uRPF — Strict vs. Loose Mode

In strict mode, the source IP must be reachable via the same interface the packet arrived on. This is the correct mode for single-homed links where asymmetric routing does not occur. In loose mode, the source IP only needs a route in the FIB via any interface — use on multi-homed links with asymmetric routing.

! CEF must be enabled (prerequisite for uRPF)
ip cef
! Strict mode — for single-homed external links
interface GigabitEthernet0/0
 ip verify unicast source reachable-via rx
! Loose mode — for multi-homed links with asymmetric routing
interface GigabitEthernet0/1
 ip verify unicast source reachable-via any

ip access-list extended INGRESS-FILTER
 deny ip 0.0.0.0 0.255.255.255 any log
 deny ip 127.0.0.0 0.255.255.255 any log
 deny ip 10.0.0.0 0.255.255.255 any log
 deny ip 172.16.0.0 0.15.255.255 any log
 deny ip 192.168.0.0 0.0.255.255 any log
 deny ip 169.254.0.0 0.0.255.255 any log
 deny ip 192.0.2.0 0.0.0.255 any log
 deny ip 224.0.0.0 15.255.255.255 any log
 permit ip any any
interface GigabitEthernet0/0
 ip access-group INGRESS-FILTER in

DISA STIG & CIS Benchmark Compliance Mapping

The Major Frameworks and Their Scope

The DISA STIG for Cisco IOS XE Router RTR (current version: V3R1) contains approximately 200 individual checks, mandatory for all Department of Defense contractors and federal agencies. STIG findings are categorized by severity: CAT I (critical), CAT II (serious), and CAT III (minor). Our tool covers all CAT I and the most impactful CAT II controls.

The CIS Benchmark for Cisco IOS 15 and the separate CIS Benchmark for Cisco IOS XE are the civilian equivalents — industry consensus documents updated approximately annually. Level 1 is safe for all production environments. Level 2 requires operational trade-off evaluation but is recommended for any router handling sensitive data or facing the public internet.

Interactive Audit Walkthrough — Before and After

The “Before” Configuration

This is a realistic configuration for a newly deployed Cisco ISR 4000 running IOS-XE 17.3 — straight from the VAR, with minimal post-deployment hardening. This exact configuration pattern is common in small-to-medium enterprise deployments:

version 17.3
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Router
enable password cisco
!
interface GigabitEthernet0/0/0
 description WAN
 ip address 203.0.113.2 255.255.255.252
!
ip http server
ip http secure-server
!
snmp-server community public RO
snmp-server community private RW
snmp-server community internal RO
!
line vty 0 4
 password cisco
 login
 transport input all
!
end

What the Audit Engine Finds

Score: approximately 6/100 — Risk Level: CRITICAL. This router, if placed on the internet today, would be enumerated via SNMP within minutes, scanned for SSH (and would accept Telnet), and has credentials that are trivially recoverable from any config backup.

Remediation Command Reference

Copy-paste IOS/IOS-XE hardening blocks. Each block is independently applicable — apply in the order shown to avoid lockout risk. Review every command in a lab environment before production deployment.

! ── PREREQUISITE: Create local fallback user BEFORE enabling AAA ──
username admin privilege 15 algorithm-type scrypt secret CHANGE_ME_NOW!
aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
tacacs server PRIMARY
 address ipv4 10.0.100.10
 key CHANGE_TACACS_KEY!
 timeout 5
security passwords min-length 12
login block-for 60 attempts 5 within 30
login quiet-mode access-class MGMT-ONLY
login on-failure log every 3
login on-success log

crypto key zeroize rsa
crypto key generate rsa modulus 4096
ip ssh version 2
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh server algorithm mac hmac-sha2-256 hmac-sha2-512
ip ssh server algorithm kex diffie-hellman-group14-sha1
ip ssh dh-min-size 2048
ip ssh time-out 60
ip ssh authentication-retries 3
ip access-list standard VTY-MGMT
 permit 10.0.100.0 0.0.0.255
 deny any log
line vty 0 15
 transport input ssh
 exec-timeout 5 0
 access-class VTY-MGMT in
 login authentication default

no enable password
enable algorithm-type scrypt secret CHANGE_ME_NOW!
service password-encryption
line con 0
 exec-timeout 5 0
 login authentication default
line aux 0
 transport input none
 no exec

no snmp-server community public
no snmp-server community private
ip access-list standard SNMP-ACL
 permit 10.0.100.0 0.0.0.255
 deny any log
snmp-server view FULL-VIEW iso included
snmp-server group NETMGMT v3 priv read FULL-VIEW write FULL-VIEW access SNMP-ACL
snmp-server user NETOPS NETMGMT v3 auth sha AuthPass123! priv aes 128 PrivPass123!
snmp-server contact noc@company.com
snmp-server location "DC1 Row3 Rack12"
snmp-server enable traps config
snmp-server enable traps snmp linkdown linkup
snmp-server host 10.0.100.50 version 3 priv NETOPS

service timestamps log datetime msec localtime show-timezone
service timestamps debug datetime msec localtime show-timezone
logging source-interface Loopback0
logging buffered 65536 informational
logging host 10.0.100.50
logging trap informational
logging facility local7
logging userinfo
archive
 log config
  logging enable
  logging size 500
  notify syslog contenttype plaintext
  hidekeys
ntp authenticate
ntp authentication-key 1 md5 NTPkey123!
ntp trusted-key 1
ntp server 216.239.35.0 key 1 prefer
ntp server 216.239.35.4 key 1
ntp source Loopback0

no service pad
no service config
no service tcp-small-servers
no service udp-small-servers
no ip finger
no ip bootp server
no ip source-route
no ip domain-lookup
no cdp run
ip cef
no ip http server
banner motd ^
=========================================================
AUTHORIZED ACCESS ONLY
This system is for authorized users only.
Unauthorized access is prohibited and monitored.
All activities are logged and may be audited.
=========================================================
^

interface GigabitEthernet0/0
 no ip redirects
 no ip unreachables
 no ip mask-reply
 no ip proxy-arp
 no ip directed-broadcast
 no cdp enable
interface GigabitEthernet0/3
 description UNUSED
 no ip address
 shutdown
interface GigabitEthernet0/0
 ip verify unicast source reachable-via rx

Frequently Asked Questions

Conclusion & Next Steps

Router security is not complex. It is a checklist — a well-defined set of configuration controls that have been known and documented since the NSA published its Router Security Configuration Guide in 2001. What has been missing is a tool that applies all of those controls, plus two decades of additional requirements from CIS, DISA, and NIST, against an actual configuration in seconds, with zero friction and zero privacy risk.

The 2002 SANS RAT paper that still dominates search results for “router audit tool” checks 37 rules, has no interactive element, cannot parse IOS-XE syntax, and misses entire categories of modern attack surface. This tool closes all of those gaps.

Your Three Next Steps

• Run your first audit now: Paste a show running-config from any router you manage into the tool at the top of this page. Even if you think it’s already hardened, the results are usually surprising.
• Bookmark the Remediation Command Reference: Section 17 is structured as a runbook. Each block is independently applicable with comments explaining every command. Add it to your team’s network engineering wiki.
• Download the CIS Benchmark: The full CIS Benchmark for Cisco IOS is available free with registration. It provides the detailed rationale, audit procedures, and remediation guidance for every control.

Twenty years after the original router audit tool was published as a static PDF, network security has evolved, attack techniques have matured, and the configuration requirements have grown more precise. The router on your network perimeter deserves an audit tool that has kept pace.