Network Security Fundamentals: Device Hardening and Port Security

Why Basic Device Hardening Comes First

Advanced security features like ACLs, discussed earlier in this series, and VPNs are meaningless if the underlying network devices themselves can be accessed and reconfigured by an unauthorized party. Device Hardening refers to the baseline security practices applied to every router and switch before considering any more advanced protection.

Securing Administrative Access

By default, several passwords protect different access levels on a Cisco device, and each must be deliberately configured — an unconfigured password often means no protection at all rather than a secure default.

Router(config)# enable secret MyStr0ngP@ss
-- protects privileged EXEC mode access,
-- stored as an encrypted hash rather than
-- plaintext, unlike the older "enable password"

Router(config)# line console 0
Router(config-line)# password ConsoleP@ss
Router(config-line)# login
-- protects physical console access

Router(config)# line vty 0 15
Router(config-line)# password VtyP@ss
Router(config-line)# login
Router(config-line)# transport input ssh
-- protects remote access, restricted to SSH only

enable secret should always be used instead of the older enable password command, since the older command stores the password in a weakly reversible format, while enable secret stores a properly hashed value that cannot be practically reversed even if the configuration file is exposed.

Encrypting Locally Stored Passwords

Several passwords configured with the older syntax are stored in plaintext directly within the running configuration by default, visible to anyone who can view the configuration file.

Router(config)# service password-encryption

-- Retroactively encrypts all currently configured
-- plaintext passwords using a weak, reversible
-- encoding (not a true cryptographic hash)

-- This is a minimum baseline protection, NOT
-- a substitute for "enable secret," which uses
-- genuinely strong hashing

It is important to understand that service password-encryption provides only weak obfuscation, easily reversed with widely available tools — it prevents casual shoulder-surfing of a configuration file but should never be relied upon as genuine security against a determined attacker.

Configuring SSH Instead of Telnet

Telnet transmits all traffic, including passwords, in plaintext, making it trivially interceptable by anyone with access to the network path — SSH encrypts this traffic and should always be used instead in any production environment.

Router(config)# hostname R1
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa
-- generates the key pair SSH requires;
-- the router prompts for a key modulus size
-- (2048 bits or higher is standard practice)

R1(config)# username admin secret AdminP@ss
R1(config)# line vty 0 15
R1(config-line)# login local
R1(config-line)# transport input ssh

Generating the RSA key pair requires both a hostname and a domain name to be configured first, since the key is associated with the device's fully qualified domain name — attempting to generate keys before setting both will fail with an error.

Port Security: Restricting Which Devices Can Connect

Beyond securing administrative access, Port Security restricts which devices can physically connect to a switch port, based on the connecting device's MAC address, discussed earlier in this series.

Switch(config)# interface gigabitethernet 1/0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation shutdown

The sticky keyword tells the switch to dynamically learn the first MAC addresses seen on the port and automatically add them to the running configuration as permitted addresses, rather than requiring an administrator to manually type in every expected MAC address.

Port Security Violation Modes

When an unauthorized MAC address attempts to connect, the switch's response depends on the configured violation mode.

Shutdown (default):  the port is placed into
  err-disabled state, completely stopping all
  traffic until manually re-enabled — the most
  secure but potentially disruptive option

Restrict: the violating traffic is dropped, but
  the port remains up for legitimate traffic,
  and a log message and counter increment occur

Protect: the violating traffic is silently
  dropped, with no log message generated at all

Shutdown is the default and most commonly used mode in production, since a port that unexpectedly goes into err-disabled state immediately alerts an administrator to investigate, whereas the other modes could allow a security violation to go unnoticed for an extended period.

Recovering a Port from Err-Disabled State

Switch# show interfaces gigabitethernet 1/0/5 status
-- confirms the port shows "err-disabled"

Switch(config)# interface gigabitethernet 1/0/5
Switch(config-if)# shutdown
Switch(config-if)# no shutdown
-- manually cycling the port clears the
-- err-disabled state

-- Alternatively, automatic recovery can be
-- configured to clear this state after a
-- defined timeout without manual intervention:
Switch(config)# errdisable recovery cause psecure-violation
Switch(config)# errdisable recovery interval 300

Verifying Port Security Status

Switch# show port-security interface gigabitethernet 1/0/5

Port Security              : Enabled
Port Status                : Secure-up
Violation Mode              : Shutdown
Maximum MAC Addresses       : 2
Total MAC Addresses          : 1
Sticky MAC Addresses         : 1
Security Violation Count     : 0

This output confirms exactly what the port is enforcing and its current state — an essential first check whenever a device unexpectedly cannot connect to a specific port, since a port security violation causing an err-disabled state is a common and easily overlooked cause of sudden, unexplained connectivity loss.

Why Basic Hardening Underlies All Network Security

Every more sophisticated security topic in networking — VPNs, firewalls, intrusion prevention — assumes that the underlying network devices themselves are already protected against unauthorized administrative access and unauthorized physical connections. Skipping these fundamentals in favor of more advanced features is a common and serious mistake; a device with strong perimeter security but a default or weak enable password remains fundamentally insecure.