A hardened Catalyst baseline means SSH version 2 only, central AAA with a local fallback, type 9 secrets, SNMPv3, authenticated NTP, and syslog off the box. On the access ports you add port security, BPDU guard, DHCP snooping, and Dynamic ARP Inspection, and you park every unused port in a blackhole VLAN. The one trap on camera networks is DAI blocking static-IP devices, which is covered below. Read that part first.
The examples assume a Catalyst 9200 or 9300 on a current IOS-XE 17.x release, VLAN 99 for management, VLANs 100 to 102 for endpoints, and documentation addresses from 192.0.2.0/24. Replace every placeholder before use. The same ground is taught in Network Hardening Level 1 and Cisco Catalyst Level 1, and the audit side is in the switch configuration audit checklist.
Management plane
Start with identity. Create a local fallback account and a type 9 (scrypt) enable secret, then point logins at TACACS+ with local as the last method. Test the fallback from the console before you close your session.
aaa new-model
enable algorithm-type scrypt secret <strong-secret>
username breakglass privilege 15 algorithm-type scrypt secret <strong-secret>
tacacs server TAC1
address ipv4 192.0.2.20
key <strong-secret>
aaa group server tacacs+ TAC-GRP
server name TAC1
aaa authentication login default group TAC-GRP local
aaa authorization exec default group TAC-GRP local
aaa accounting commands 15 default start-stop group TAC-GRP
login block-for 120 attempts 5 within 60
banner login ^C
This system is private property of [ORGANIZATION]. Authorized use only.
Activity is logged and monitored.
^C
SSH needs a domain name and a host key before it will run. Set version 2, restrict the VTY lines to the management subnet with an access class, and turn off everything else that listens.
ip domain name example.net
crypto key generate rsa modulus 3072
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
ip access-list standard MGMT-ONLY
permit 192.0.2.0 0.0.0.255
line vty 0 15
access-class MGMT-ONLY in
transport input ssh
exec-timeout 10 0
no ip http server
no ip http secure-server
no vstack
The no vstack line disables Smart Install, which has been exploited in the field and has no place on a production access switch. If you need the HTTPS interface, keep ip http secure-server with an access class and a real certificate rather than the factory one.
Time, SNMP, and logging
Logs without trustworthy time are hard to use. Incident reviews depend on them. Authenticate NTP so the switch only accepts time from a source it trusts, move to SNMPv3 with authentication and privacy, and send syslog to a collector that is not on the same switch stack. If your release does not offer a SHA-2 NTP key type, check its notes before you fall back to MD5.
ntp authentication-key 1 hmac-sha2-256 <strong-secret>
ntp authenticate
ntp trusted-key 1
ntp server 192.0.2.30 key 1
snmp-server group MON-GRP v3 priv
snmp-server user monitor MON-GRP v3 auth sha <strong-secret> priv aes 128 <strong-secret>
no snmp-server community public
service timestamps log datetime msec localtime show-timezone
logging source-interface Vlan99
logging host 192.0.2.10
logging trap informational
Control plane basics
Catalyst 9000 switches ship with a default control plane policing policy. Confirm it is attached with show policy-map control-plane, and leave it alone unless you have measured a reason to change it, because a wrong policy can starve routing and management traffic during a burst. Measure first. Then remove the small things that widen the attack surface.
no ip source-route
no ip domain lookup
no service pad
spanning-tree mode rapid-pvst
spanning-tree portfast bpduguard default
Access ports
Every port that faces an endpoint gets the same set of controls. Port security with a maximum of 1 MAC catches the unmanaged switch plugged in for extra drops, and BPDU guard catches a managed switch or a loop. Neither replaces the other.
interface range GigabitEthernet1/0/1 - 23
switchport mode access
switchport access vlan 100
switchport nonegotiate
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address sticky
switchport port-security violation shutdown
spanning-tree portfast
spanning-tree bpduguard enable
storm-control broadcast level 1.00
ip dhcp snooping limit rate 15
errdisable recovery cause psecure-violation
errdisable recovery cause bpduguard
errdisable recovery interval 300
DHCP snooping and DAI go on at the VLAN level, with trust set on the uplinks only. Forget the uplink trust and the VLAN loses its DHCP server, so do this in a maintenance window.
ip dhcp snooping
ip dhcp snooping vlan 100-102
ip arp inspection vlan 100-102
interface Port-channel1
ip dhcp snooping trust
ip arp inspection trust
DAI validates ARP against the snooping binding table. A camera with a static address never asked a DHCP server, so it has no binding, and its ARP is dropped as soon as DAI turns on. Half the cameras go dark. The cleaner fix is a DHCP reservation for every camera and door controller. For devices that must stay static, add an ARP ACL and attach it to the VLAN.
arp access-list STATIC-DEVICES
permit ip host 192.0.2.50 mac host 0011.2233.4455
ip arp inspection filter STATIC-DEVICES vlan 100
A static source binding for the device does the same job. Whichever you pick, build the list from the camera inventory before enabling DAI, and watch show ip arp inspection statistics for drops afterward.
Unused ports
Every port without a labelled purpose goes into a VLAN that has no SVI and no routing, gets shut down, and carries a description that says it is unused.
interface range GigabitEthernet1/0/24, GigabitEthernet1/0/30 - 48
switchport mode access
switchport access vlan 666
description UNUSED
shutdown
Backups and firmware
Save the config after each change set with copy running-config startup-config, then pull a copy off the switch on a schedule.
copy running-config scp://backup@192.0.2.40/sw01.cfg
Keep the backup server out of the camera VLANs, and diff each copy against the last one. For firmware, check the target release against Cisco’s security advisories before you deploy, and use install mode so a failed upgrade can roll back.
install add file flash:<image>.bin activate commit
Checking your work
The switch config audit tool reads a pasted running config and flags the gaps against this baseline, and the switch config audit is the remote review across a whole estate. Hands-on practice is in the Network and Windows Hardening course.
Book a working session at /book/.