Securing Network Devices

Exam topics covered

5.3 Configure and verify device access control using local passwords

5.4 Configure and verify security password policies elements, such as management,

complexity, and password alternatives (multifactor authentication, certificates, and biometrics)

Foundation. A router or switch with a default configuration lets anyone who plugs into its console port reach privileged mode with no password at all. This chapter closes that door. You will protect every way into a Cisco device, choose strong password storage types, add local usernames, slow down guessing attacks, post legal banners and switch off unused services. Finally, you will study password policy and the alternatives blueprint topic 5.4 lists: multifactor authentication, certificates and biometrics.

29.1 Ways Into a Cisco Device

An IOS device can be managed through several lines. Each one needs its own protection, because an attacker will use whichever is weakest.

Console line ( line console 0 ): the physical console port. Requires physical access, which is why physical security (Chapter 28) matters.

Auxiliary line ( line aux 0 ): an older port intended for an out-of-band modem. Disable it if unused.

VTY lines ( line vty 0 4 , often 0 15 ): virtual terminals for remote Telnet or SSH sessions over the network. These face the largest attacker population.

Once logged in, a user is in user EXEC mode (privilege level 1, prompt > ). The enable command moves to privileged EXEC mode (level 15, prompt # ), which is protected by the enable password or enable secret.

Vty 0-15

SSH (TCP 22) / Telnet (23)

admin

Figure 29-1 The console, auxiliary and VTY lines, plus the enable secret guarding privileged mode.

29.2 Protecting Privileged Mode

29.2.1 enable password versus enable secret

Two commands protect privileged EXEC mode. enable password is the original command; it stores the password in clear text (type 0) in the configuration. enable secret stores a one-way hash instead. If both are configured, enable secret always wins and the enable password is ignored. There is no reason to use enable password today.

R1(config)# enable password cisco123 ! type 0: plain text, avoid
R1(config)# enable secret Str0ng!Enable#26 ! hashed; overrides enable password
R1(config)# enable algorithm-type scrypt secret Str0ng!Enable#26 ! explicitly type 9

29.2.2 Password storage types

IOS labels each stored password in show running-config with a type number that tells you how it is stored:

Table 29-1 Cisco IOS password types

Type Algorithm Strength and notes

0 Plain text No protection. Anyone who sees the configuration sees the password.

• 4 SHA-256 (flawed
• implementation)
• Deprecated: implemented without salt or iterations. Do not

use.

5 Salted MD5 hash Long-time default for enable secret . Better than 7, but MD5 is fast to brute-force today.

7 Cisco proprietary (Vigenère-style)Reversible encoding, not encryption. Free tools decode it in seconds. Produced by service password-encryption .

8 PBKDF2 with SHA-256 Strong, salted, many iterations. algorithm-type sha256 . 9 scrypt Strongest; memory-hard, resists GPU cracking. algorithm-type scrypt ; default for secrets on many current IOS XE releases.

29.2.3 service password-encryption and its weakness

Line passwords ( password under line con 0 or line vty ) and username ... password are stored in plain text by default. The global command service password-encryption converts every type 0 password in the configuration to type 7. That stops someone glancing over your shoulder at the screen, but type 7 is a reversible encoding with a published key, so anyone who obtains a copy of the configuration can recover the password instantly. It does not affect values already stored as secrets (types 5, 8, 9).

R1# show running-config | include password|secret
no service password-encryption

enable secret 9 $9$nhEmQVczB7dqsO$X.HsgL6x1il0RxkOSSvyQYwucySCt7qFm4v7pqCxkKM enable password cisco123

username backup secret 9 $9$CnHUa3gl/nEJ3E$QiDRqeQTlLD2y6vjHFAYwgFh35aZEbs8EU0F8xkoAuA password Cons0le!

R1# configure terminal
R1(config)# service password-encryption
R1(config)# end
R1# show running-config | include password|secret
service password-encryption

enable secret 9 $9$nhEmQVczB7dqsO$X.HsgL6x1il0RxkOSSvyQYwucySCt7qFm4v7pqCxkKM enable password 7 0822455D0A16544541

username backup secret 9 $9$CnHUa3gl/nEJ3E$QiDRqeQTlLD2y6vjHFAYwgFh35aZEbs8EU0F8xkoAuA password 7 060506324F41584B56

Figure 29-2 service password-encryption turns plain-text passwords into reversible type 7; secrets stay type 9. (Output is illustrative of IOS 15 / IOS XE.)

Exam alert

enable secret beats enable password when both exist. service password-encryption produces type 7, which is weak and reversible, and it does nothing to secrets. Types 8 (PBKDF2-SHA-256) and 9 (scrypt) are the strong choices; type 5 is MD5.

29.3 Securing the Console and VTY Lines

29.3.1 Line passwords with login

The simplest scheme gives each line a shared password. Two commands are needed: password sets it and login tells the line to ask for it. A password without login does nothing on the console; conversely, VTY lines with login but no password refuse all connections with “Password required, but none set.”

R1(config)# line console 0
R1(config-line)# password Cons0le!
R1(config-line)# login
R1(config-line)# exec-timeout 5 0 ! log out after 5 min idle (default 10 0)
R1(config-line)# logging synchronous
R1(config-line)# line aux 0
R1(config-line)# no exec ! disable the unused AUX port
R1(config-line)# transport input none

29.3.2 Local usernames and login local

A shared line password cannot tell you who logged in, and changing it means telling everyone. Local usernames solve both problems: each administrator has a personal account, and login local makes the line prompt for a username and password checked against the local database. Always create users with secret (hashed), not password (type 0 or 7). SSH requires login local (or AAA); Chapter 26 covers generating the RSA keys.

R1(config)# username alice privilege 15 algorithm-type scrypt secret Al1ce-Net!26
R1(config)# username bob secret B0b-Ops#2026 ! level 1, must use enable
R1(config)# line vty 0 15
R1(config-line)# login local ! username + password from local DB
R1(config-line)# transport input ssh ! refuse Telnet
R1(config-line)# exec-timeout 10 0
R1(config-line)# access-class 10 in ! permit only admin subnet (Chapter 30)

R1 — console

R1# show running-config | section line
line con 0
exec-timeout 5 0
password 7 060506324F41584B56
logging synchronous
login
line aux 0
no exec
transport input none
line vty 0 4
access-class 10 in
exec-timeout 10 0
login local
transport input ssh
line vty 5 15

...same as vty 0 4...

Figure 29-3 Line configuration after hardening: console password, AUX disabled, VTY limited to SSH with local usernames.

Table 29-2 Line login options compared

Command on the line What the user is asked for Checked against no login Nothing: immediate access (console

29.4 Defeating Password Guessing

Even strong passwords can eventually fall to an automated dictionary attack if an attacker can try thousands per minute. IOS offers two simple defences.

security passwords min-length rejects any new password, secret or key shorter than the configured length (existing ones are not checked). login block-for watches for failed logins: if too many occur within a time window, the device enters quiet mode and refuses all login attempts for the block period. Because quiet mode would also lock out legitimate administrators, you can exempt a management subnet with login quiet-mode access-class .

R1(config)# security passwords min-length 10
R1(config)# login block-for 120 attempts 3 within 60 ! 3 failures in 60 s = 120 s block
R1(config)# login quiet-mode access-class 10 ! admin hosts still allowed
R1(config)# login on-failure log
R1(config)# login on-success log
R1(config)# username test secret short

% Password too short - must be at least 10 characters. Password configuration failed R1 — console

R1# show login

A login delay of 1 seconds is applied.

Quiet-Mode access list 10 is applied.

All successful login is logged.

All failed login is logged.

Router enabled to watch for login Attacks.

If more than 3 login failures occur in 60 seconds or less,

logins will be disabled for 120 seconds.

Router presently in Quiet-Mode.

Will remain in Quiet-Mode for 97 seconds.

Restricted logins filtered by applied ACL 10.

R1#

*Oct 4 09:14:22.381: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 41 secs, [user: admin] [Source: 198.51.100.77] [localport: 22] [Reason: Login Authentication Failed] [ACL: 10] at 09:14:22 UTC Sun Oct 4 2026

Figure 29-4 show login during a guessing attack: the router has entered quiet mode.

29.5 Login Banners

Banners do not stop anyone, but a warning such as “Authorized access only; activity is monitored” helps an organization take legal action against intruders and is required by many security policies. Never write “Welcome” in a banner. Each banner is enclosed by a delimiter character of your choice that does not appear in the text.

banner motd : message of the day, shown to everyone who connects, before login. banner login : shown after the MOTD, before the username/password prompts. banner exec : shown after a successful login, before the prompt.

R1(config)# banner motd #

WARNING: Authorized access only. All activity is logged and monitored.

#

R1(config)# banner exec ^Change window: Sat 02:00-04:00 only. Use a ticket number.^
admin-pc — ssh alice@10.0.0.1

$ ssh alice@10.0.0.1

WARNING: Authorized access only. All activity is logged and monitored.

Password:

Change window: Sat 02:00-04:00 only. Use a ticket number.

R1#

Figure 29-5 The MOTD banner appears before authentication, the EXEC banner after it.

29.6 Disabling Unused Services and Ports

Every running service is attack surface. Hardening means turning off what you do not need and shutting ports nobody uses, a direct application of the least-privilege principle.

Table 29-3 Common hardening commands

Command Why

no ip http server Disable the unencrypted web server; use ip http secure-server only if the GUI is required.

• no cdp run or no cdp enable (per
• interface)
• Stop advertising model and IOS version to untrusted

ports; same for no lldp transmit .

no ip domain-lookup Avoid DNS lookups for mistyped commands.

no service pad , no ip bootp server Turn off legacy services rarely needed. shutdown on unused switch ports An unused live port is an open door; also assign unused ports to an unused “parking” VLAN.

switchport mode access , switchport

nonegotiate

Stop DTP so an attacker cannot negotiate a trunk.

transport input ssh Refuse Telnet, which sends passwords in clear text.

SW1(config)# interface range GigabitEthernet1/0/20 - 24
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 999 ! unused parking VLAN
SW1(config-if-range)# shutdown

29.7 Password Policies and Alternatives

29.7.1 Policy elements: management and complexity

A password policy is the written rule set that all accounts must meet. Blueprint topic 5.4 groups its elements into management and complexity:

Complexity: a minimum length (current guidance, such as NIST SP 800-63B, favours long passphrases of 12 or more characters over forced symbol rules), a mix of character types where required, no dictionary words, and no reuse of the username.

Management: how passwords are issued, stored and changed. Change them when there is evidence of compromise and when staff leave; prevent reuse of recent passwords; lock or slow down accounts after repeated failures; never share accounts; store them only as strong hashes; use a password manager or vault for shared device credentials; and centralize accounts with AAA so one change applies everywhere.

On a Cisco device, security passwords min-length , login block-for and type 8/9 secrets enforce parts of this policy locally; a central AAA server can enforce the rest.

29.7.2 Alternatives to passwords

Passwords are only “something you know,” and they can be guessed, phished or reused. The three authentication factors are:

Something you know: password, PIN, passphrase.

Something you have: hardware token, smart card, phone running an authenticator app, digital certificate on a device.

Something you are: biometrics such as fingerprint, face, iris or voice.

Multifactor authentication (MFA) requires factors from at least two different categories. A password plus a one-time code from a phone app is MFA; a password plus a PIN is not, because both are something you know. MFA defeats most phishing and credential-stuffing attacks, because a stolen password alone is not enough.

Digital certificates bind an identity to a public key and are signed by a trusted certificate authority (CA). The holder proves identity by using the matching private key, which never leaves the device. Certificates authenticate web servers (HTTPS), VPN peers, 802.1X clients (EAP-TLS) and SSH users without any password being typed. Biometrics measure a physical characteristic; they are convenient and cannot be forgotten, but they cannot be changed if compromised, so they are normally combined with another factor.

Figure 29-6 The three authentication factors. MFA combines factors from different categories.

Exam alert

Watch for “two-factor” distractors that use two items from the same category (password plus security question). Know examples of each factor; certificates and smart cards count as “something you have.”

LAB Harden a branch router and access switch

Goal: apply every control in this chapter to R1 and SW1 so that only named administrators on the 10.0.99.0/24 management subnet can log in, over SSH, with strong hashed credentials.

• Admin PC
• 10.0.99.10
• SW1

Svi 10.0.99.2

Figure 29-7 Hardening lab topology.

Steps (shown for R1; repeat the relevant ones on SW1):

R1(config)# security passwords min-length 10
R1(config)# enable algorithm-type scrypt secret En@ble-R1-2026
R1(config)# no enable password
R1(config)# username alice privilege 15 algorithm-type scrypt secret Al1ce-Net!26
R1(config)# service password-encryption
R1(config)# access-list 10 permit 10.0.99.0 0.0.0.255
R1(config)# login block-for 120 attempts 3 within 60
R1(config)# login quiet-mode access-class 10
R1(config)# banner motd #Authorized access only. Activity is monitored.#
R1(config)# no ip http server
R1(config)# line con 0
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0
R1(config-line)# line vty 0 15
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# access-class 10 in
R1(config-line)# exec-timeout 10 0

Verify: attempt Telnet (refused), SSH from 10.0.99.10 (succeeds after the banner), and SSH from another subnet (refused by the access class). Then check the configuration:

R1 — console

R1# show running-config | include secret|block|min-length|http server
security passwords min-length 10

enable secret 9 $9$4a/r1gSzmmBvRE$h6uKh2ElBdeNSoPYmUpY2s0NJuVo4.R6dwh3Ue5dUH2 username alice privilege 15 secret 9

• $9$Uf3hJt2BqpRn5U$tJ0aB1kGsk3H4Ml2gGqH/2y4L5eZpXw9cYv8QxRrT1s
• login block-for 120 attempts 3 within 60
• no ip http server

R1# show users

• Line User Host(s) Idle Location
• * 0 con 0 alice idle 00:00:00
• 866 vty 0 alice idle 00:00:12 10.0.99.10

Figure 29-8 Verifying type 9 secrets, login protection and an SSH session from the management subnet.

Table 29-4 Device hardening checklist

☐ Control Verify with

☐ Enable secret type 8/9; no enable password show run | include enable ☐ Named local users with secret show run | include

• username
• ☐ Console: login local , exec-timeout show run | section line
• con
• ☐ AUX disabled show run | section line
• aux

☐ VTY: SSH only, login local , access-class show run | section line vty , show ip ssh

☐ Min length, login block-for show login

☐ service password-encryption for remaining type 0 no clear-text passwords in show run

☐ MOTD banner log in and observe

☐ HTTP off, CDP off on edge ports, unused ports shut show ip http server status , show interfaces status

Mfa

• digital certificate
• biometrics
• Review questions

• 1. A router has both enable password cisco and enable secret Cisc0!2026 configured. Which password grants privileged EXEC access?

• A. cisco
• B. Cisc0!2026
• C. Either one
• D. Neither, until one is removed

• 2. Which password type does service password-encryption produce?

• A. Type 5
• B. Type 7
• C. Type 8
• D. Type 9

• 3. Which two password types are considered strong on current IOS? (Choose two.)

• A. Type 0
• B. Type 4
• C. Type 7
• D. Type 8
• E. Type 9

• 4. An engineer configures password Cons0le! under line con 0 but users are never prompted for a password. What is missing?

• A. login
• B. transport input ssh
• C. service password-encryption
• D. exec-timeout 0 0

• 5. Which line command makes VTY sessions prompt for a username and check it against the device's own database?

• A. login
• B. login local
• C. password local
• D. username local

• 6. What does exec-timeout 5 0 do?

• A. Blocks logins for 5 minutes after failures
• B. Disconnects an idle session after 5 minutes
• C. Allows 5 login attempts
• D. Sets the SSH timeout to 5 seconds

• 7. What happens after login block-for 120 attempts 3 within 60 if four logins fail within 30 seconds?

• A. The VTY lines are shut down permanently.
• B. All login attempts are refused for 120 seconds, except from hosts permitted by a quiet-mode access class.
• C. The offending user account is deleted.
• D. The router reloads.

• 8. Which command prevents configuration of any new password shorter than 12 characters?

• A. password min-length 12
• B. security passwords min-length 12
• C. login password-length 12
• D. service password-length 12

• 9. Which two banners are displayed to users before they log in? (Choose two.)

• A. banner motd
• B. banner exec
• C. banner login
• D. banner incoming
• E. banner prompt

• 10. Which pair of credentials constitutes multifactor authentication?

• A. Password and security question
• B. PIN and passphrase
• C. Password and a code from an authenticator app
• D. Two different passwords

• 11. A digital certificate stored on a laptop is an example of which factor?

• A. Something you know
• B. Something you have
• C. Something you are
• D. Somewhere you are

• 12. Which two actions reduce a switch's attack surface? (Choose two.)

• A. Shutting down unused ports
• B. Enabling ip http server
• C. Configuring transport input telnet ssh
• D. Disabling CDP on user-facing ports
• E. Using enable password instead of enable secret

• 13. Why is a type 7 password considered weak?

• A. It is stored in clear text.
• B. It uses MD5 without salt.
• C. It is a reversible encoding that tools decode instantly.
• D. It can only be eight characters long.

Answers

• 1. B. When both are configured, the enable secret is used and the enable password is ignored.
• 2. B. service password-encryption converts type 0 passwords to reversible type 7.
• 3. D, E. Type 8 (PBKDF2-SHA-256) and type 9 (scrypt) are strong. Type 4 is deprecated, type 7 reversible, type 0 plain text.
• 4. A. The login command tells the line to require the configured password.
• 5. B. login local uses the local username database.
• 6. B. The arguments are minutes and seconds of idle time before the session is closed.
• 7. B. The device enters quiet mode for the block period; a quiet-mode access class can exempt management hosts.
• 8. B. security passwords min-length applies to new passwords and secrets.
• 9. A, C. MOTD and login banners appear before authentication; the EXEC banner appears after.
• 10. C. A password (know) plus an app code (have) uses two categories. The others are all “know.”
• 11. B. A certificate (with its private key) is something the device or user possesses.
• 12. A, D. Shutting unused ports and limiting CDP reduce exposure; the other options increase it.
• 13. C. Type 7 uses a published algorithm and key, so it is trivially reversed.