<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-network-device-hardening
description: >-
  Harden network infrastructure devices including routers, switches, firewalls, and
  load balancers by disabling unnecessary services, enforcing secure management protocols,
  configuring AAA, applying CIS benchmarks, and validating configurations with Nmap and Nipper.
domain: cybersecurity
subdomain: network-security
tags:
  - hardening
  - cis-benchmark
  - router
  - switch
  - firewall
  - configuration
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1200", "T1133", "T1557"]
  nist-csf: ["PR.IP-1", "PR.AC-5", "PR.PT-3"]
  uuid: a1b2c3d4-1009-4a00-b009-f00d00000009
---

# Performing Network Device Hardening

## Overview

Network devices are high-value targets — compromising a router or switch gives an attacker
control over all traffic traversing it. Hardening involves disabling unnecessary services,
enforcing encrypted management, configuring centralized authentication, applying firmware
patches, and validating compliance with CIS benchmarks.

Mode: `[MODE: BLUE]` for hardening; `[MODE: ARCHITECT]` for baseline design.

## Prerequisites

| Requirement | Details |
|---|---|
| SSH access to network devices | Required |
| CIS Benchmark documents for target platforms | Required |
| nmap for service enumeration | Required |
| TFTP/SCP for configuration backup | Required |
| TACACS+ or RADIUS server for centralized AAA | Required |

## Key Concepts

### Cisco IOS Hardening Checklist

```
! Disable unnecessary services
no ip http server
no ip http secure-server
no cdp run
no ip source-route
no ip finger
no service pad
no service tcp-small-servers
no service udp-small-servers
no ip bootp server
no ip domain-lookup

! Enforce SSH v2 management
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
crypto key generate rsa modulus 4096
line vty 0 15
 transport input ssh
 exec-timeout 10 0
 login local
 access-class SSH_ACCESS in

! Enable AAA
aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting commands 15 default start-stop group tacacs+

! Secure SNMP
no snmp-server community public
no snmp-server community private
snmp-server community <COMPLEX_STRING> RO SNMP_ACL
snmp-server group v3group v3 priv
snmp-server host 10.0.0.100 version 3 priv v3user

! Enable logging
logging buffered 64000 informational
logging trap informational
logging source-interface Loopback0
logging host 10.0.0.100
service timestamps log datetime msec localtime show-timezone

! NTP with authentication
ntp authenticate
ntp authentication-key 1 md5 <NTP_KEY>
ntp trusted-key 1
ntp server 10.0.0.50 key 1

! Control plane protection
control-plane
 service-policy input CoPP-Policy
```

### Verification with nmap

```bash
# Verify only SSH is exposed for management
nmap -sV -p 1-1024 10.0.0.1

# Check for SNMP community strings
nmap -sU -p 161 --script=snmp-brute 10.0.0.1

# Verify HTTP server is disabled
nmap -p 80,443 --script=http-methods 10.0.0.1

# Check for CDP/LLDP information leakage
nmap --script=cdp-info -sU -p 9 10.0.0.1
```

### Suricata Rules for Device Monitoring

```
# Alert on Telnet to network devices
alert tcp any any -> $NETWORK_DEVICES 23 ( \
  msg:"HARDENING - Telnet access to network device"; \
  flow:to_server,established; \
  sid:3001070; rev:1; \
  metadata:mitre_attack_technique T1133;)

# Alert on SNMP v1/v2c to network devices
alert udp any any -> $NETWORK_DEVICES 161 ( \
  msg:"HARDENING - SNMPv1/v2c to network device"; \
  content:"|02 01 00|"; offset:4; depth:3; \
  sid:3001071; rev:1;)

# Alert on HTTP management access
alert tcp any any -> $NETWORK_DEVICES 80 ( \
  msg:"HARDENING - HTTP management access to network device"; \
  flow:to_server,established; \
  sid:3001072; rev:1;)
```

### Configuration Backup and Diff

```bash
# Backup via SCP
scp admin@10.0.0.1:running-config /backups/router-01-$(date +%F).conf

# Diff against hardened baseline
diff /backups/baseline.conf /backups/router-01-$(date +%F).conf

# Automated config audit
# Check for banned commands in config
grep -E "^(ip http server|snmp-server community public|service finger)" \
  /backups/router-01-*.conf
```

## Workflow

### Step 1: Inventory Network Devices

Document all routers, switches, firewalls with firmware versions.

### Step 2: Backup Current Configurations

Retrieve and store current configurations before changes.

### Step 3: Apply Hardening Template

Apply CIS benchmark recommendations per device platform.

### Step 4: Verify Hardening

```bash
# Scan each device to verify hardening
for device in 10.0.0.1 10.0.0.2 10.0.0.3; do
  echo "=== Scanning $device ==="
  nmap -sV -p 22,23,80,161,443 "$device"
done
```

### Step 5: Monitor for Configuration Drift

Schedule periodic config backups and diff against baseline.

## Detection

```yaml
title: Network Device Hardening Detection
id: 6d2dd50b-a1fd-4404-87f4-bf66365d5f65
status: experimental
description: Detects suspicious activity related to performing network device hardening techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1200
  - attack.t1133
  - attack.t1557
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Network Device Hardening Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1200, T1133, T1557 |

## Verification

- [ ] Only SSH v2 enabled for management access
- [ ] HTTP/HTTPS management disabled or restricted
- [ ] SNMP v3 with encryption enforced
- [ ] Telnet disabled on all VTY lines
- [ ] AAA configured with TACACS+/RADIUS
- [ ] Unused ports administratively disabled
- [ ] NTP with authentication configured
- [ ] Logging to central syslog server enabled
- [ ] Control plane policing active

## References

- [CIS Cisco IOS Benchmark](https://www.cisecurity.org/benchmark/cisco)
- NIST SP 800-123: Guide to General Server Security
- NSA Network Infrastructure Security Guide
- CIS Controls v8 — Control 4: Secure Configuration
