Cisco IOS XE Security Hardening Tool

Enable AAA New Model HIGH Configure AAA Authentication Login HIGH Enable AAA Authentication Enable HIGH Log All Privileged Commands HIGH Enable AAA Accounting Connection MEDIUM Enable AAA Accounting Exec MEDIUM Set Transport Input SSH for VTY HIGH Disable Exec on AUX Port HIGH Apply Access Class to VTY Lines HIGH Set Exec Timeout for VTY (≤10 min) MEDIUM Set Exec Timeout for Console (≤10 min) MEDIUM Configure Login Banner LOW Configure MOTD Banner LOW Set Enable Secret Password HIGH Enable Password Encryption HIGH Set Username Secrets HIGH Disable SNMP if Unused MEDIUM Remove SNMP Public Community HIGH Remove SNMP Private Community HIGH Use SNMPv3 with Privacy HIGH

Set Hostname for SSH HIGH Set IP Domain Name HIGH Generate RSA Keys (≥2048-bit) HIGH Set SSH Timeout (≤60 sec) MEDIUM Set SSH Authentication Retries MEDIUM Force SSH Version 2 HIGH Disable CDP Globally MEDIUM Disable BOOTP Server MEDIUM Disable DHCP Service MEDIUM Enable TCP Keepalives In MEDIUM Enable TCP Keepalives Out MEDIUM Enable Logging HIGH Configure Logging Buffer MEDIUM Set Logging Console Critical MEDIUM Configure Logging Host HIGH Set Logging Trap Informational MEDIUM Enable Logging Timestamps MEDIUM Enable NTP Authentication HIGH Configure NTP Auth Keys HIGH Configure NTP Server HIGH Create Loopback Interface MEDIUM

Disable IP Source Routing HIGH Disable Proxy ARP MEDIUM Disable Directed Broadcast HIGH Enable Unicast RPF HIGH Border ACL Anti-Spoofing HIGH EIGRP MD5 Authentication HIGH OSPF Message Digest Auth HIGH BGP Neighbor Password HIGH