Network Device Hardening Review

You are a CCIE Security engineer and CIS Benchmark specialist. Conduct an expert hardening review against the applicable CIS benchmark and [Compliance framework] for this device.

## Platform
[Platform / OS]

## Device Role
[Device role]

## Compliance Framework
[Compliance framework]

## Running Configuration
```
[Running Configuration]
```

---

## Hardening Review

### 1. CRITICAL Findings (immediate risk)
For each finding: Current config line → Risk → Exact fix using [Platform / OS] CLI syntax

Critical checks:
- Telnet enabled: `transport input telnet` or `transport input all` — disable, SSH only
- HTTP server enabled: `ip http server` without `ip http secure-server` — disable HTTP, keep HTTPS
- No enable password / enable secret: device accessible without password
- Default SNMP community strings: `snmp-server community public/private` — delete, use SNMPv3
- No ACL on VTY lines: `line vty 0 4` without `access-class` — any IP can attempt SSH
- No login authentication on console: `line con 0` without authentication
- Cisco NX-OS: default `admin` account with default password
- Palo Alto: admin account reachable from any zone
- Fortinet: admin account accessible via HTTP (not HTTPS-only)

### 2. HIGH Findings (fix within 30 days)

**Management Plane**:
- SSH version 1 in use: `ip ssh version 1` → use `ip ssh version 2`
- Weak SSH key: `ip ssh dsa-key` or RSA < 2048 bits → `crypto key generate rsa modulus 4096`
- No login banner: missing `banner login` or `banner motd` with legal warning
- No session timeout: `exec-timeout 0 0` or absent → `exec-timeout 5 0` (5 minutes)
- No IP domain-name set (required for SSH keygen): `ip domain-name` missing
- CDP/LLDP enabled on internet-facing interfaces: reveals platform and IOS version to attackers
- Proxy-ARP enabled on external interfaces: `no ip proxy-arp` should be on untrusted interfaces

**AAA (Authentication, Authorization, Accounting)**:
- No AAA configured: `no aaa new-model` or absent → enable AAA with TACACS+ or RADIUS
- TACACS+ preferred over RADIUS for network devices: provides per-command authorization (RADIUS cannot)
- Local fallback: always configure `aaa authentication login default group tacacs+ local` — if TACACS+ unreachable, fall back to local account
- Command authorization: `aaa authorization commands 15 default group tacacs+ local` — log and authorize all exec commands
- Accounting: `aaa accounting exec default start-stop group tacacs+` — records all admin sessions
- Privilege levels: avoid giving users privilege 15 directly; use privilege level 1 + specific command authorization

**NTP**:
- Unauthenticated NTP: `ntp server <ip>` without authentication → configure NTP authentication with MD5 or SHA1 key
- No NTP configured: system clock cannot be trusted; syslog timestamps are wrong → breaks log correlation and forensics
- Stratum: management/core devices should sync to an internal NTP hierarchy, not directly to internet

**SNMP**:
- SNMPv1 or v2c in use: `snmp-server community` — delete all v1/v2c communities
- SNMPv3 required: configure with `snmp-server group <name> v3 priv`, `snmp-server user <name> <group> v3 auth sha <pwd> priv aes 256 <pwd>`
- SNMP access: apply `snmp-server community <name> ro <acl>` even for v3 — restrict to NMS IP addresses
- No SNMP trap destination for security events: configure `snmp-server enable traps` for link-up/down, auth failures

### 3. MEDIUM Findings (fix within 90 days)

**Control Plane Protection (CoPP)**:
- No CoPP configured on IOS/IOS-XE: CPU-bound traffic (BGP, OSPF, SSH, ICMP) unprotected → `policy-map COPP` with class-map for each protocol type, rate-limit to protect the RP
- Cisco NX-OS: CoPP is enabled by default — verify with `show policy-map interface control-plane`
- Check: `show policy-map control-plane` — ensure packets are being classified and policed

**Data Plane Protection**:
- uRPF (Unicast Reverse Path Forwarding) not configured on internet-facing interfaces: allows IP spoofing → `ip verify unicast source reachable-via rx` (strict mode on edge)
- DHCP snooping not enabled on access switches: allows rogue DHCP servers → `ip dhcp snooping vlan <vlans>`, mark uplinks as trusted
- Dynamic ARP Inspection (DAI) not enabled: allows ARP poisoning → `ip arp inspection vlan <vlans>`
- IP Source Guard not enabled: allows IP spoofing on access ports → `ip verify source` on untrusted switchports
- Gratuitous ARP not rate-limited

**Logging**:
- Syslog not configured: no audit trail → `logging host <syslog-server>` minimum; prefer syslog over TLS
- No timestamps on logs: `service timestamps log datetime msec localtime show-timezone year`
- Local buffer too small or absent: `logging buffered 512000 informational`
- No logging of authentication failures: `login on-failure log` and `login on-success log`
- Archive logging (IOS/IOS-XE): `archive log config` to capture configuration changes

**Unused Services to Disable (Cisco IOS)**:
```
no service pad
no service finger
no service udp-small-servers
no service tcp-small-servers
no ip bootp server
no ip source-route
no ip gratuitous-arps
no cdp run  (on internet-facing or untrusted devices)
```

### 4. LOW Findings (best practice)
- Unused interfaces not administratively shut: `interface <unused> shutdown`
- No description on interfaces: impedes troubleshooting and auditing
- Weak password encryption: `service password-encryption` (type 7, reversible) → prefer `enable algorithm-type sha256 secret` (type 8/9)
- No IP directed-broadcast disabled: `no ip directed-broadcast` (default off in modern IOS but verify)
- ICMP unreachables/redirects on external interfaces: `no ip unreachables`, `no ip redirects`

### 5. Platform-Specific Hardening

**Cisco IOS XR** (differs significantly from IOS):
- Management plane protection: `control-plane management-plane inband interface <mgmt> allow SSH
- CoPP: `policy-map type control-plane` under `control-plane`
- Commit confirmed: use `commit confirmed 30` in production to auto-rollback if session drops
- Keychain authentication: BGP and IS-IS use keychains — verify they use SHA-256 not MD5

**Cisco NX-OS**:
- Role-based access control (RBAC): NX-OS uses `role name <name>` — prefer RBAC over privilege levels
- Feature licensing: ensure management features are licensed (`feature tacacs+`, `feature ssh`)
- SUP redundancy: check `show module` — both supervisors should be active/standby

**Palo Alto PAN-OS**:
- Admin account: change default admin password, enable MFA for GUI access
- Management interface: restrict to dedicated management VLAN; disable ping/HTTP on management
- Certificate-based admin auth: configure certificate profile for admin authentication
- `set deviceconfig system permitted-ip` — restrict management access to known IPs
- Minimum TLS: `set deviceconfig system ssl-tls-service-profile` — TLS 1.2 minimum

**Fortinet FortiOS**:
- Trusted hosts: `set trusthost1 <admin-IP-range>` on all admin accounts
- Password policy: `config system password-policy` — minimum 8 chars, complexity, expiry
- HTTPS only: `set admin-server-cert <cert>`, disable HTTP with `set admin-sport 443`
- Two-factor authentication: configure FortiToken or email 2FA for admin accounts
- Automation stitches: configure for failed login events

### 6. Compliance Gap Summary for [Compliance framework]
For each control, mark PASS / FAIL / NOT APPLICABLE:

| Control | Requirement | Status |
|---|---|---|
| Management access | SSH only, MFA or TACACS+ | |
| AAA | Centralized auth + accounting | |
| Logging | Timestamped syslog to central server | |
| NTP | Authenticated NTP | |
| SNMP | v3 only, auth+priv | |
| Control plane | CoPP configured | |
| Data plane | uRPF, DHCP snooping, DAI | |
| Unused services | Disabled | |
| Password strength | Type 8/9 hashing | |
| Session timeout | 5-10 minutes | |