How to Read a Cisco Router Config File: Security Red Flags to Look For
Run Free Audit ↓

How to Read a Cisco Router Config File: Security Red Flags to Look For

The running configuration of a Cisco IOS or IOS-XE router tells you everything about its security posture — if you know how to read it. This guide walks through each major section of a router config, explains what each block controls, and shows you exactly what good and bad configurations look like.

How to Collect the Running Config

Before you can analyze a configuration, you need a copy of it. The command to retrieve the full running configuration from a Cisco IOS or IOS-XE router is:

show running-config

Run this command from privileged EXEC mode (the prompt shows Router#). The output will be several hundred to several thousand lines depending on how much is configured. Copy the entire output to a text file for review. You can also pipe it to filter specific sections:

show running-config | section vty show running-config | include snmp show running-config | section aaa

For a full security audit, always work from the complete output rather than filtered views — some vulnerabilities only become visible when you see multiple sections together.

Global Settings Section

The top of the running config contains global commands that apply to the entire device. This is where you find some of the most critical security settings.

What to look for at the top of the config

The first lines of the running config typically include version info, service commands, hostname, and domain name. Each service command here has security implications.

! Example — annotated for security review version 15.6 service timestamps debug datetime msec ! GOOD: timestamps on service timestamps log datetime msec ! GOOD: log timestamps on service password-encryption ! GOOD: encrypts passwords no service pad ! GOOD: PAD disabled no service udp-small-servers ! GOOD: small servers off no service tcp-small-servers ! GOOD: small servers off service finger ! BAD: finger service exposes user info hostname CORE-RTR-01 enable password Cisco123 ! BAD: weak enable password, not enable secret enable secret $1$mERr$hx5rVt7rPNoS4wqbXKX7m0 ! GOOD: enable secret configured
Red Flags
enable password present (use enable secret instead)
service finger present (should be no service finger)
No service password-encryption
No service timestamps log datetime msec
ip source-route present (should be no ip source-route)

AAA and Authentication

The AAA section controls how users authenticate to the router and what they are authorized to do. This is one of the most security-critical sections in the entire configuration.

AAA configuration — what good looks like

aaa new-model aaa authentication login default group tacacs+ local aaa authentication enable default group tacacs+ enable aaa authorization exec default group tacacs+ local aaa accounting exec default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group tacacs+
Red Flags
No aaa new-model — AAA is completely absent
aaa authentication login default local — local-only, no external auth server
No aaa accounting — no audit trail of sessions or commands
No tacacs-server or radius-server configuration despite AAA referencing it

Interface Configuration

Interface stanzas appear as blocks starting with interface [name]. Each interface block can contain multiple security-relevant settings.

Interface block — what to check

interface GigabitEthernet0/0 description WAN-INTERFACE ip address 203.0.113.1 255.255.255.252 no ip verify unicast reverse-path ! Missing uRPF — spoofed packets allowed ip proxy-arp ! BAD: proxy ARP should be disabled ip redirects ! BAD: ICMP redirects should be off ip unreachables ! BAD: unreachables can aid reconnaissance cdp enable ! BAD: CDP on external interface leaks info duplex auto speed auto
! Hardened version of the same interface interface GigabitEthernet0/0 description WAN-INTERFACE ip address 203.0.113.1 255.255.255.252 ip verify unicast reverse-path no ip proxy-arp no ip redirects no ip unreachables no cdp enable duplex auto speed auto

Console and VTY Lines

Line configurations control access to the router’s management interfaces. This section is where Telnet vs SSH is configured, timeouts are set, and access-class ACLs are applied. A misconfigured line section is one of the most common findings in router security audits.

VTY lines — good vs bad

! BAD — allows Telnet, no ACL, no timeout line vty 0 4 password cisco login transport input all ! GOOD — SSH only, ACL restricted, timeout enforced line vty 0 4 access-class MGMT-ACCESS in exec-timeout 10 0 transport input ssh transport output ssh login authentication default
Red Flags
transport input all or transport input telnet
No exec-timeout or timeout set to 0 0 (never)
No access-class ACL restricting management source IPs
login without AAA (uses local line password only)
No login authentication referencing an AAA list

Analyze Your Config Automatically

Instead of reviewing hundreds of lines manually, paste your running config and get a structured security report in seconds.

Run Free Config Audit →

SNMP, NTP, and Logging

These three sections are often misconfigured because they are set up once and rarely revisited. They represent some of the most frequently flagged findings in router security assessments.

SNMP — what to look for

snmp-server community public RO ! BAD: default read community snmp-server community private RW ! BAD: default write community ! GOOD version no snmp-server community public no snmp-server community private snmp-server community xK9#mQ2p RO 10 snmp-server host 10.1.1.100 version 3 priv authuser

NTP — what to look for

ntp server 0.pool.ntp.org ! BAD: unauthenticated NTP ! GOOD version ntp authenticate ntp authentication-key 1 md5 NtpStr0ng! ntp trusted-key 1 ntp server 10.1.1.50 key 1

Logging — what to look for

no logging buffered ! BAD: buffered logging off no logging trap ! BAD: no syslog ! GOOD version logging buffered 65536 informational logging host 10.1.1.200 logging trap informational logging source-interface Loopback0 service timestamps log datetime msec show-timezone localtime

Routing Protocol Security

If your router runs OSPF, EIGRP, or BGP, check whether authentication is configured. Unauthenticated routing protocols allow an attacker to inject false routing updates — redirecting traffic, causing route loops, or creating black holes.

Routing protocol authentication — what to look for

! OSPF — check for authentication router ospf 1 ! No authentication configured — BAD network 10.0.0.0 0.255.255.255 area 0 ! EIGRP — check for authentication router eigrp 100 ! No authentication configured — BAD ! GOOD — OSPF with MD5 authentication on interface interface GigabitEthernet0/1 ip ospf authentication message-digest ip ospf message-digest-key 1 md5 OspfKey!9x

Tip: The absence of a line is often the finding. If you don’t see aaa new-model, that means AAA is off. If you don’t see no ip source-route, source routing is on. Reading a config for security is as much about what’s missing as what’s present.

Frequently Asked Questions

How do I get the running config from a Cisco router?
From privileged EXEC mode (the # prompt), run show running-config. This outputs the current active configuration. To save it to startup config (so it persists after reboot), run copy running-config startup-config.
What is the difference between running-config and startup-config?
The running-config is the configuration currently active in memory — changes you make take effect immediately. The startup-config is what the router loads when it boots. If a configuration change is not saved with copy running-config startup-config, it is lost on reboot. Security audit the running-config since that is what is actually protecting the network right now.
What does “no ip source-route” do in a Cisco config?
The command no ip source-route disables IP source routing — a legacy feature that allows packet senders to specify the path their packets take through the network. It has no legitimate use in modern networks and is used in attacks to bypass firewall rules. It should always be disabled.
How do I read a Cisco router config if I’m not a network engineer?
A free Cisco router audit tool can parse the configuration for you and flag security issues in plain English without requiring you to understand every IOS command. It checks against industry benchmarks and explains each finding with a severity rating and remediation steps.

Ready to Audit Your Router?

Free. No login. No data sent to any server. Works on Cisco IOS and IOS-XE.

Run Your Free Audit Now →