NSA Router Security Configuration Guide: What Network Admins Need to Know
The NSA Router Security Configuration Guide (RSCG) is one of the most technically comprehensive public documents on router hardening ever published. Written for Cisco IOS, it goes deeper than most vendor documentation on why each security control matters — not just what commands to run. Here’s what it covers and how to apply it.
What Is the NSA RSCG?
The NSA Router Security Configuration Guide is a public document published by the National Security Agency’s Information Assurance Directorate. Despite being produced by one of the world’s most secretive intelligence agencies, the RSCG is freely downloadable and written specifically to be used by network administrators in any environment — not just government networks.
The document was developed in response to the observation that most network compromises exploit configuration weaknesses rather than software vulnerabilities. The NSA’s position, backed by incident response data, is that the biggest risk to router security is not a missing patch — it is a missing hardening command. The RSCG addresses this directly.
The RSCG covers Cisco IOS specifically, with actual IOS command examples throughout. Each recommendation is explained with a detailed rationale covering both the threat being addressed and the technical mechanism of the control. This makes it one of the most educational router security references available — not just a checklist, but an explanation of why each control matters.
Where to find it: The NSA Router Security Configuration Guide is available at apps.nsa.gov. Search for “Router Security Configuration Guide” — it is published in the Information Assurance section.
The Four Security Pillars
The RSCG organizes router security around four functional areas. Understanding this framework helps you approach hardening systematically rather than as a list of unrelated commands.
1. Secure the Router Itself
This pillar covers the management plane — how the router is administered, who can access it, and what they can do. It includes authentication, management protocol security (SSH vs Telnet), password policy, banners, and session timeouts.
- Disable Telnet, require SSH version 2
- Enforce strong enable secret and user passwords
- Implement AAA with centralized authentication
- Apply access-class ACLs to restrict management source addresses
- Set exec-timeout on all lines
2. Protect the Router’s Routing Infrastructure
Routing protocols are a target. An attacker who can inject false routing updates can redirect traffic, create black holes, or enable man-in-the-middle scenarios across the entire network. This pillar covers authentication and integrity protection for OSPF, EIGRP, BGP, and RIP.
- Configure MD5 authentication on OSPF and EIGRP adjacencies
- Implement BGP MD5 authentication with all peers
- Use passive-interface on non-routing interfaces
- Filter routing updates with route maps and prefix lists
3. Harden the Network Traffic
This pillar focuses on what the router does with traffic passing through it. It covers filtering, uRPF (Unicast Reverse Path Forwarding), IP options filtering, and the disabling of services that can be abused to amplify attacks or gather information about the network.
- Enable uRPF on interfaces to drop spoofed source addresses
- Disable IP directed broadcasts (amplification attack vector)
- Filter IP options in transit traffic
- Disable proxy ARP on interfaces where it is not needed
- Disable ICMP redirects and unreachables on external interfaces
4. Disable Unnecessary Services and Features
Every enabled service that is not actively used is a potential attack surface. The RSCG documents every default-enabled IOS service and recommends explicit disabling of everything not required for the router’s operational purpose.
- Disable CDP, LLDP on external interfaces
- Disable the Finger service, PAD, and small servers
- Disable the HTTP server if not required
- Disable BOOTP server
- Disable ip source-route
- Turn off MOP (Maintenance Operation Protocol)
Management Plane Security — Deep Dive
The RSCG’s treatment of management plane security is particularly thorough. It goes beyond “use SSH” to address the full chain of management access: how an admin connects, how they authenticate, what they are authorized to do, and what record is kept of their actions.
Access Control Lists on Management Interfaces
The RSCG requires that VTY lines have an access-class ACL applied that restricts connections to specific management source addresses. Without this, any IP address can attempt to connect to the router’s SSH service — exposing it to brute-force attacks from any point on the internet if reachable.
ip access-list standard MGMT-ACCESS
permit 10.1.100.0 0.0.0.255
deny any log
line vty 0 4
access-class MGMT-ACCESS in
transport input sshConsole Line Security
The console port — physical access to the router — requires the same controls as remote access. The RSCG specifically calls out that console lines with no password or no timeout are a physical security gap. If someone gains physical access to the network closet, an unprotected console port is an immediate path to full device compromise.
line console 0
exec-timeout 5 0
login authentication default
transport output nonePerimeter Security and Filtering
The RSCG defines the concept of infrastructure ACLs (iACLs) — access control lists applied to all interfaces to protect the router’s own services from the networks it connects. An iACL is distinct from a transit ACL (which filters traffic passing through the router). The iACL filters traffic destined for the router itself.
ip access-list extended INFRASTRUCTURE-ACL
! Permit management traffic from known management network
permit tcp 10.1.100.0 0.0.0.255 host [ROUTER-MGMT-IP] eq 22
! Permit established/related traffic
permit tcp any any established
! Permit routing protocol traffic
permit ospf any any
permit eigrp any any
! Deny all other traffic to router IPs
deny ip any host [ROUTER-MGMT-IP] log
! Permit transit traffic
permit ip any anyRouting Protocol Security
The RSCG’s routing protocol security section is more comprehensive than most other hardening guides. It covers not just authentication but also route filtering, neighbor restrictions, and passive interface configuration.
EIGRP Authentication
key chain EIGRP-KEYS
key 1
key-string EigrpKey!2025
accept-lifetime 00:00:00 Jan 1 2025 infinite
send-lifetime 00:00:00 Jan 1 2025 infinite
interface GigabitEthernet0/1
ip authentication mode eigrp 100 md5
ip authentication key-chain eigrp 100 EIGRP-KEYSBGP Security
For BGP, the RSCG recommends MD5 authentication with all peers, maximum prefix limits to prevent route table exhaustion, and explicit filtering of prefixes that should never appear in BGP (bogon filtering).
router bgp 65001
neighbor 203.0.113.2 password BgpPeer!Str0ng
neighbor 203.0.113.2 maximum-prefix 200000 80
neighbor 203.0.113.2 soft-reconfiguration inboundNSA RSCG vs CIS Benchmark vs DISA STIG
All three frameworks address the same underlying security controls, but they are designed for different use cases. Understanding when to use each helps you avoid re-doing the same work.
| Framework | Best For | Format | Compliance Use |
|---|---|---|---|
| NSA RSCG | Deep understanding of why each control matters; technical education | Narrative technical document with IOS examples | Reference — not structured for direct compliance audit |
| CIS Benchmark | Structured checklist-based hardening with audit procedures | Numbered controls with pass/fail criteria | Widely accepted by PCI DSS, HIPAA, SOC 2 auditors |
| DISA STIG | DoD and government mandatory compliance; strictest requirements | Numbered rules with CAT I/II/III severity ratings | Mandatory for DoD — used with eMASS/ACAS |
In practice, using all three together gives the most complete coverage. Read the RSCG to understand the security principles. Use the CIS Benchmark as your audit checklist for compliance purposes. Apply DISA STIG if your environment requires it. A good automated audit tool draws from all three simultaneously.
Audit Your Router Against All Three Frameworks
RouterAuditTool.com checks your Cisco IOS or IOS-XE configuration against controls drawn from CIS Benchmark, DISA STIG, and NSA RSCG. Free, browser-based, no data sent anywhere.
Run Free Audit →Frequently Asked Questions
Ready to Audit Your Router?
Free. No login. No data sent to any server. Works on Cisco IOS and IOS-XE.
Run Your Free Audit Now →