Cisco IOS XR Security Hardening
Security hardening baseline for Cisco IOS XR routers (ASR 9000, NCS 5500). Covers AAA, SSH hardening, control-plane protection, management ACLs, and logging.
What is it?
IOS XR security hardening applies CIS Benchmark and NSA/CISA guidance to Cisco service provider routers. IOS XR has several important differences from IOS/IOS-XE hardening: passwords are always stored hashed when using the secret keyword (no service password-encryption needed), SSH hardening uses separate algorithms subcommands for key exchange, ciphers, and MACs, and control-plane protection uses the management-plane inband hierarchy. The commit-based configuration model means all hardening changes can be reviewed before applying, reducing the risk of lockout. IOS XR enforces role-based access control (root-lr, operator, etc.) natively through user groups.
When to use
- ·Initial deployment of any IOS XR router in a production environment
- ·Security audits or compliance reviews (PCI-DSS, NIST SP 800-53, CIS Benchmark for IOS XR)
- ·After any router compromise or security incident requiring reconfiguration
- ·Before connecting a new PE or P router to the SP backbone or internet
- ·Periodic hardening reviews as part of a vulnerability management program
When NOT to use
- ·Lab environments where strict AAA would complicate testing — use local auth only in isolated labs
- ·Before testing connectivity in a new deployment — apply hardening after basic reachability is confirmed
How it compares
Prerequisites
- →TACACS+ server must be reachable and configured with the correct shared key before enabling AAA
- →Test local authentication fallback before removing console password — always keep local as fallback
- →NTP authentication keys must be synchronized with the NTP server configuration
- →Management source IP ACL must be accurate — incorrect ACL can lock out all management access
Config Generator
Verification commands
show aaaVerify AAA method lists are configured correctly
ExpectedAuthentication and authorization lists visible with TACACS+ and local fallback
show ssh session detailShow active SSH sessions and cipher details
ExpectedActive sessions using AES-CTR ciphers and SHA2 MACs as configured
show control-plane management-plane inband interface allVerify management-plane allowed protocols
ExpectedSSH, SNMP, NTP listed as permitted protocols on management interfaces
show ntp statusVerify NTP is synchronized after enabling NTP authentication
ExpectedClock is synchronized, stratum 4 or lower, reference clock shows NTP server IP
Debug commands
show aaa serversCheck TACACS+ server reachability and response times
WarningIf all TACACS+ servers are unreachable, local authentication fallback is used. Verify local username is configured.
show loggingVerify syslog messages are being generated and forwarded
WarningIf logging host is unreachable via management VRF, messages are only buffered locally
Common mistakes & fixes
Further learning
Recommended books to go deeper on this topic.
Network Security Architectures
Sean Convery · Cisco Press · Defense-in-depth, CoPP, control plane hardening, AAA design
CCNP Enterprise Core ENCOR 350-401 Official Cert Guide
Brad Edgeworth et al. · Cisco Press · AAA, RADIUS, TACACS+, device hardening best practices