A hardened AOS-CX baseline puts SSH on the management VRF behind an allow-list, authenticates logins centrally with a local fallback, moves SNMP to v3 only, and authenticates NTP. On the access ports it adds port security, BPDU guard or loop protection, DHCP snooping, and ARP inspection, with unused ports shut down in a blackhole VLAN. As on any platform, static-IP cameras need explicit handling before ARP inspection goes on. Plan for that first.
The syntax below was checked against the HPE AOS-CX Command-line interface Reference Guide for 8100 and 8360 Switch Series, published February 2026. Other series such as the 6200 and 6300 share most of it, but confirm against the guide for your model and release. Addresses are from the 192.0.2.0/24 documentation range, and every secret is a placeholder. The Cisco equivalent is in hardening Cisco Catalyst switches, and the audit side is in the switch configuration audit checklist.
Management plane
SSH is disabled until the admin password is set, and it is enabled per VRF. It will not start without it. Put it on the management VRF, restrict who can connect, and turn off Telnet and the web interface where you do not use them. The CLI reference states that the Telnet server is disabled by default, so the explicit line below is a guard against someone enabling it later.
ssh server vrf mgmt
ssh server allow-list
ip 192.0.2.0/24
enable
ssh maximum-auth-attempts 3
no telnet server vrf mgmt
no https-server vrf mgmt
session-timeout 10
Enabling the allow-list restarts the SSH servers and ends active sessions, and an enabled list with no entries blocks everyone. Apply it from the console or from a session inside the permitted range. Test it. Keep the HTTPS server only if you use the REST API or web interface, and then keep it on the management VRF.
Authentication comes next. Create named users in the built-in groups, point SSH and console logins at TACACS+ with local last, and test the fallback before you leave the room. AOS-CX stores local passwords hashed, so there is no separate secret type to choose.
user ops1 group administrators password
tacacs-server host 192.0.2.20 key plaintext <strong-secret> vrf mgmt
aaa authentication login ssh group tacacs local
aaa authentication login console group tacacs local
aaa authentication limit-login-attempts 5 lockout-time 300
banner motd ^
This system is private property of [ORGANIZATION]. Authorized use only.
Activity is logged and monitored.
^
The guide warns that command authorization has no fail-through, so a wrong TACACS+ authorization setup can leave a switch unable to run commands. Always end the group list with local, and prove the setup on a lab switch first.
Time, SNMP, and logging
NTP can be tied to a trusted key so the switch only syncs with a source that proves itself, which protects log timestamps from a spoofed time server on the camera VLAN. SNMPv3 users get authentication and privacy, and the switch can be told to drop v1 and v2c entirely. Syslog goes out over the management VRF.
ntp authentication-key 10 sha1 <strong-secret> trusted
ntp authentication
ntp server 192.0.2.30 key 10
ntp vrf mgmt
ntp enable
snmp-server snmpv3-only
snmpv3 security-level auth-privacy
snmpv3 user monitor auth sha256 auth-pass plaintext <strong-secret> priv aes priv-pass plaintext <strong-secret> access-level ro
logging 192.0.2.10 severity info vrf mgmt
The guide notes that a # character in an NTP key stops synchronization once authentication is on, so choose keys without one. The logging command also supports TCP and TLS transports, and TLS is the better choice when your collector can present a certificate.
Control plane basics
AOS-CX applies a predefined control plane policing policy named default at first startup. Review it with show copp-policy rather than rewriting it. Leave it alone. Rate limits on ingress ICMP and broadcast traffic on edge ports add a second layer, and the management plane is already limited by the VRF and allow-list above.
Access ports
Edge ports get an access VLAN, edge port type, BPDU guard, loop protection, a broadcast rate limit, and port security, all applied the same way to every port that faces a camera, reader, or workstation. The client limit defaults to 1. Sticky learning keeps the first MAC the port sees. A violation shuts the port down, and auto-recovery brings it back after a timer.
spanning-tree bpdu-guard timeout 300
port-access port-security enable
interface 1/1/1
no routing
vlan access 100
spanning-tree port-type admin-edge
spanning-tree bpdu-guard
loop-protect
rate-limit broadcast 1 percent
port-access port-security enable
port-access security violation action shutdown
port-access security violation action shutdown auto-recovery enable
port-access security violation action shutdown recovery-timer 300
port-access port-security
client-limit 1
sticky-learn enable
Port security with one client catches an unmanaged switch added for extra drops, while BPDU guard catches a managed switch or a loop through one. Loop protection is a separate mechanism that sends its own control packets, so it also catches loops that never involve spanning tree.
DHCP snooping is enabled globally and per VLAN, and only the ports that face the real DHCP server, usually the uplinks or the LAG toward the distribution layer, are trusted. Everything else stays untrusted. From release 10.14 the command is dhcp-snooping, and earlier releases use dhcpv4-snooping. ARP inspection is enabled per VLAN on the 8100 and 8360 from 10.12.
dhcp-snooping
vlan 100
dhcp-snooping
arp inspection
interface lag 1
dhcp-snooping trust
ARP inspection discards ARP packets that carry an invalid IP-to-MAC binding, so a camera with a static address and no lease is at risk of being dropped. That is the trap. Convert cameras and door controllers to DHCP reservations where you can. For devices that must stay static, the guide documents ipv4 source-binding, which adds a static entry to the binding database.
ipv4 source-binding 100 192.0.2.50 00:11:22:33:44:55 1/1/5
The guide documents how to enable ARP inspection and view its trust state per interface, but I could not find a command to set a port as trusted in it. Check the security guide for your release, and keep uplinks in mind when you test, because a wrongly untrusted uplink drops ARP between switches.
Unused ports
Unused ports go into a VLAN with no routed interface, get a description, and are shut down.
vlan 666
name BLACKHOLE
interface 1/1/24
no routing
vlan access 666
description UNUSED
shutdown
Backups and firmware
Copy the running configuration to a remote server over SFTP or SCP on a schedule, using the management VRF, and diff each copy against the last. The guide lists the copy forms for running configuration and checkpoints.
copy running-config sftp://backup@192.0.2.40/sw01.cfg vrf mgmt
For firmware, read the release notes and the HPE security bulletins for the target version before upgrading. AOS-CX keeps primary and secondary images, so stage the new image on the secondary partition and keep the known-good one until the switch has run clean for a day.
Checking your work
The switch config audit tool checks a configuration you paste or upload against a published checklist. The switch config audit is the remote review across a whole estate, and the Network Hardening Level 1 course and the Network and Windows Hardening training cover the reasoning behind each control.
Book a working session at /book/.