The switch config audit tool on this site reads a running configuration and flags what is missing against a security-network baseline. This is the checklist it works from, written out so that it can be applied by hand on a platform the tool does not parse, handed to an integrator as an acceptance test, or used to read a config the way I read one on a network assessment.
The order is deliberate. Management plane first, because a switch anyone can log into makes every other control optional. Then the control plane, then the edge, then the things that are specific to carrying video and doors.
Each item has the evidence to collect. An audit finding without the command output behind it is an opinion.
1. Management plane
| Check | Pass condition | Evidence |
|---|---|---|
| Telnet and HTTP disabled | Only SSHv2 and HTTPS accept management sessions | show ip ssh, show run | i transport|ip http |
| Management restricted by ACL | VTY and web sessions accepted only from the management subnet | show run | s line vty, ACL contents |
| Centralised authentication | AAA against RADIUS or TACACS+, local account as fallback only, no shared local accounts | show aaa servers, show run | s aaa|username |
| Local fallback account | One, with a unique per-switch password that is stored somewhere other than the config | Username count; password type is 8 or 9, never 7 |
| Privilege levels | Operators cannot reach configuration mode; enable secret set and hashed | show run | i enable|privilege |
| SNMP | SNMPv3 only, authPriv; v1 and v2c communities absent | show snmp user, show run | i snmp-server community |
| Management VLAN | Dedicated, not VLAN 1, not the camera VLAN, not routed to the user network | show ip interface brief, VLAN plan |
| Session timeout | Idle sessions close within ten minutes | show run | s line, exec-timeout |
| Login banner | Present; states authorised use only | show banner |
| Firmware | Current recommended release from the vendor, or a documented reason | show version against the vendor’s advisory list |
2. Services and time
| Check | Pass condition | Evidence |
|---|---|---|
| NTP | Two or more sources, authenticated where the platform supports it, and the switch is actually synchronised | show ntp status, show ntp associations |
| Logging | Syslog to at least one collector on the management VLAN; timestamps with millisecond precision and timezone; buffered log sized | show logging |
| Unused services | CDP and LLDP off on camera-facing ports unless PoE negotiation needs LLDP; no finger, no small servers, no source routing | show run | i cdp|lldp|service |
| Configuration backup | Running config archived to a server on change; last archive within the change window | show archive or equivalent; backup server listing |
3. Control plane
| Check | Pass condition | Evidence |
|---|---|---|
| Spanning tree mode | Rapid PVST or MSTP; the root bridge is the core, set by explicit priority, not by lowest MAC | show spanning-tree root, show spanning-tree summary |
| Edge ports | PortFast or edge on every camera and door controller port; BPDU Guard on every edge port | show spanning-tree interface … detail, show run | i portfast|bpduguard |
| Uplink protection | Root Guard on ports facing access switches from the distribution; Loop Guard on uplinks | show spanning-tree inconsistentports |
| Storm control | Broadcast limited on every edge port; multicast threshold set with the video load in mind or not applied to video ports | show storm-control |
| Control plane policing | Present on platforms that support it | show policy-map control-plane |
4. Edge and access
| Check | Pass condition | Evidence |
|---|---|---|
| Unused ports | Administratively down and in an unused black-hole VLAN, not VLAN 1 | show interfaces status; count of notconnect ports in an active VLAN |
| Port security or 802.1X | Camera and door ports authenticate the device: 802.1X with MAB fallback, or at minimum port security with a sticky MAC and a violation action | show authentication sessions, show port-security |
| DHCP snooping | Enabled on camera and access VLANs; trust only on uplinks and the DHCP server port | show ip dhcp snooping |
| Dynamic ARP inspection | Enabled on the same VLANs, with the same trust | show ip arp inspection |
| IP Source Guard | Enabled on edge ports where the platform supports it with the DHCP snooping binding table | show ip verify source |
| Port descriptions | Every port describes what is on it: camera name, door name, uplink target | show interfaces description; blank descriptions counted |
| Speed and duplex | Auto on both ends, or forced on both ends; never mixed | show interfaces for duplex mismatches and late collisions |
5. VLAN hygiene
| Check | Pass condition | Evidence |
|---|---|---|
| Segmentation | Cameras, access control, servers, management, and operator workstations in separate VLANs, per the segmentation guide | show vlan brief against the VLAN plan |
| VLAN 1 | No ports assigned; not the native VLAN on any trunk; not the management VLAN | show vlan id 1, show interfaces trunk |
| Native VLAN | An unused, dedicated VLAN on every trunk; tagged where the platform allows | show interfaces trunk |
| Trunk pruning | Trunks carry only the VLANs the far end needs; no allowed vlan all | show interfaces trunk |
| Trunk negotiation | DTP off; trunks configured statically; access ports set to nonegotiate | show interfaces switchport; Negotiation of Trunking: Off |
| Inter-VLAN routing | Only where the design says so, through the firewall or an ACL on the SVI, with the camera VLAN unable to initiate to anything but the Archivers | SVI ACLs; firewall policy |
6. Video and access control specifics
| Check | Pass condition | Evidence |
|---|---|---|
| PoE budget | Allocated power below the supply’s budget with 20 percent headroom at winter peak; priority set by what the port covers; budget alert configured. Details in the PoE guide | show power inline; supply model and mode |
| LLDP for PoE | Enabled on camera ports; allocation by negotiation rather than by class | show power inline … detail; allocated versus drawn |
| IGMP snooping and querier | Snooping on the video VLAN; a querier on every switch in it. Details in the multicast guide | show ip igmp snooping querier |
| Jumbo frames | Consistent end to end on any iSCSI storage path; not enabled on camera VLANs without a reason | show system mtu, interface MTU |
| QoS | DSCP trusted from cameras and Archivers; video marked and queued ahead of best-effort; access control marked ahead of video | show mls qos or show policy-map interface |
| Uplink capacity | Aggregate camera bitrate per switch below 60 percent of uplink capacity; uplinks in a port channel where two exist | Interface utilisation over a week; show etherchannel summary |
| Redundant power | Dual supplies on distribution and on any access switch feeding doors; mode documented | show environment power |
The platform commands
The evidence column above is Cisco IOS-XE syntax. The equivalents on the other platforms this site carries templates for:
Cisco IOS-XE Aruba AOS-CX Junos
Running config show running-config show running-config show configuration
Interface status show interfaces status show interface brief show interfaces terse
Trunks show interfaces trunk show vlan port show vlans
Spanning tree show spanning-tree summary show spanning-tree summary show spanning-tree bridge
Port security / 802.1X show authentication sessions show port-access clients show dot1x interface
DHCP snooping show ip dhcp snooping show dhcpv4-snooping show dhcp-security binding
PoE show power inline show power-over-ethernet brief show poe interface
IGMP querier show ip igmp snooping querier show ip igmp snooping vlan show igmp snooping membership
NTP show ntp status show ntp status show ntp status
Logging show logging show logging show log messages | last 50
Scoring and what to do with the result
Not every failed check is the same finding. I score them in three bands.
- Fix before anything else. Telnet or HTTP management, SNMPv2 communities, VLAN 1 in use, no AAA, missing BPDU Guard on edge ports, unused ports live in an active VLAN. Any one of these means the switch can be taken by whoever plugs into a lobby port.
- Fix in the next change window. No querier, no PoE headroom, no port security, trunks unpruned, no DHCP snooping, storm control absent, logging local only. These are the outages waiting to happen and the gaps an incident investigation will find.
- Fix as the estate is touched. Descriptions, banner, QoS refinement, config archive cadence. Real, but not the reason to open a window.
The point of running the checklist is the delta between what the config says and what the drawing says. On a network I have not seen before, that delta is the fastest possible description of how the system has been maintained, and it tells me most of what the rest of the assessment is going to find.
The full baselines that pass every item above are the Cisco Catalyst, Aruba CX, Juniper EX, and OmniSwitch templates.