Cisco IOS Security Hardening: 15 Critical Commands Every Admin Must Know

The enable secret command stores the privileged-mode password as a one-way hash rather than the reversible Type 7 cipher used by enable password. The algorithm-type scrypt option uses the modern scrypt key derivation function — far more resistant to brute force than the older MD5-based Type 5 hash.

This command applies Type 7 cipher to all plaintext passwords in the configuration — VTY passwords, line passwords, OSPF keys. It’s not cryptographically strong, but it prevents shoulder-surfing and accidental exposure in config backups. It’s a baseline, not a substitute for proper secrets management.

Telnet transmits everything — including your password — in cleartext. Anyone with network access between you and the router can capture your credentials with a packet sniffer. SSH encrypts the session. SSH version 2 is mandatory; version 1 has known vulnerabilities. RSA keys must be at least 2048 bits.

An idle management session left open is an open door. The default exec-timeout on VTY lines is often 0 — no timeout at all. Set timeouts on every line: console, VTY, and auxiliary.

AAA (Authentication, Authorization, Accounting) is the proper framework for managing who can access the router, what they can do, and logging what they did. Without it, you’re relying on basic line passwords with no accounting. With AAA you can integrate RADIUS/TACACS+ for centralized authentication and get a complete audit trail.

The IOS HTTP server provides a browser-based management interface. The unencrypted version (port 80) transmits credentials in cleartext. Unless you specifically need web-based management, disable both. If a management platform requires HTTPS access, disable only the plain HTTP server and leave HTTPS.

IP source routing allows a packet’s sender to specify the path through the network — a legitimate feature in early networking that is now primarily used by attackers to bypass security controls. Disable it on every production router.

These disable legacy TCP and UDP diagnostic services (echo, chargen, daytime, discard) that can be abused in amplification DoS attacks. They’re off by default in newer IOS releases but should be explicitly disabled to ensure they can’t be accidentally re-enabled.

Cisco Discovery Protocol broadcasts device model, IOS version, interface IPs, and capabilities to directly connected neighbors. Useful for internal network management, but it hands attackers detailed reconnaissance data on external-facing interfaces. Disable globally and re-enable only on internal interfaces where needed.

A login banner serves two purposes: legal and operational. It establishes that unauthorized access is prohibited — a requirement for prosecution in many jurisdictions. Keep it factual and avoid including device details like hostname, IOS version, or IP addresses that help attackers.

IOS lets you enforce a minimum password length for all locally configured passwords. The CIS Benchmark recommends a minimum of 10 characters. DISA STIG requires 15 characters for privileged accounts in high-security environments.

Local logs stored only on the device can be tampered with or lost if the device is compromised or rebooted. Send logs to an external syslog server immediately. Timestamp every log entry so events can be correlated across devices during incident response.

Without accurate time synchronization, log correlation is impossible — if each device has a different clock, you can’t reconstruct the sequence of events during an incident. NTP authentication prevents attackers from injecting fake time updates that could corrupt your audit trail.

Proxy ARP allows the router to respond to ARP requests on behalf of hosts on other networks. On external or untrusted interfaces this can allow attackers to intercept traffic. IP directed broadcast enables Smurf amplification attacks. Both should be disabled on all untrusted interfaces.

Even with SSH enforced, your management interface should only be reachable from authorized management IP addresses. An access-class on VTY lines drops connection attempts from any source not on your approved list — providing defense-in-depth if credentials are ever compromised.