The switch config audit tool on this site reads a running configuration and flags what is missing against a security-network baseline. This is the checklist it works from, written out so that it can be applied by hand on a platform the tool does not parse, handed to an integrator as an acceptance test, or used to read a config the way I read one on a network assessment.

The order is deliberate. Management plane first, because a switch anyone can log into makes every other control optional. Then the control plane, then the edge, then the things that are specific to carrying video and doors.

Each item has the evidence to collect. An audit finding without the command output behind it is an opinion.


1. Management plane

CheckPass conditionEvidence
Telnet and HTTP disabledOnly SSHv2 and HTTPS accept management sessionsshow ip ssh, show run | i transport|ip http
Management restricted by ACLVTY and web sessions accepted only from the management subnetshow run | s line vty, ACL contents
Centralised authenticationAAA against RADIUS or TACACS+, local account as fallback only, no shared local accountsshow aaa servers, show run | s aaa|username
Local fallback accountOne, with a unique per-switch password that is stored somewhere other than the configUsername count; password type is 8 or 9, never 7
Privilege levelsOperators cannot reach configuration mode; enable secret set and hashedshow run | i enable|privilege
SNMPSNMPv3 only, authPriv; v1 and v2c communities absentshow snmp user, show run | i snmp-server community
Management VLANDedicated, not VLAN 1, not the camera VLAN, not routed to the user networkshow ip interface brief, VLAN plan
Session timeoutIdle sessions close within ten minutesshow run | s line, exec-timeout
Login bannerPresent; states authorised use onlyshow banner
FirmwareCurrent recommended release from the vendor, or a documented reasonshow version against the vendor’s advisory list

2. Services and time

CheckPass conditionEvidence
NTPTwo or more sources, authenticated where the platform supports it, and the switch is actually synchronisedshow ntp status, show ntp associations
LoggingSyslog to at least one collector on the management VLAN; timestamps with millisecond precision and timezone; buffered log sizedshow logging
Unused servicesCDP and LLDP off on camera-facing ports unless PoE negotiation needs LLDP; no finger, no small servers, no source routingshow run | i cdp|lldp|service
Configuration backupRunning config archived to a server on change; last archive within the change windowshow archive or equivalent; backup server listing

3. Control plane

CheckPass conditionEvidence
Spanning tree modeRapid PVST or MSTP; the root bridge is the core, set by explicit priority, not by lowest MACshow spanning-tree root, show spanning-tree summary
Edge portsPortFast or edge on every camera and door controller port; BPDU Guard on every edge portshow spanning-tree interface … detail, show run | i portfast|bpduguard
Uplink protectionRoot Guard on ports facing access switches from the distribution; Loop Guard on uplinksshow spanning-tree inconsistentports
Storm controlBroadcast limited on every edge port; multicast threshold set with the video load in mind or not applied to video portsshow storm-control
Control plane policingPresent on platforms that support itshow policy-map control-plane

4. Edge and access

CheckPass conditionEvidence
Unused portsAdministratively down and in an unused black-hole VLAN, not VLAN 1show interfaces status; count of notconnect ports in an active VLAN
Port security or 802.1XCamera and door ports authenticate the device: 802.1X with MAB fallback, or at minimum port security with a sticky MAC and a violation actionshow authentication sessions, show port-security
DHCP snoopingEnabled on camera and access VLANs; trust only on uplinks and the DHCP server portshow ip dhcp snooping
Dynamic ARP inspectionEnabled on the same VLANs, with the same trustshow ip arp inspection
IP Source GuardEnabled on edge ports where the platform supports it with the DHCP snooping binding tableshow ip verify source
Port descriptionsEvery port describes what is on it: camera name, door name, uplink targetshow interfaces description; blank descriptions counted
Speed and duplexAuto on both ends, or forced on both ends; never mixedshow interfaces for duplex mismatches and late collisions

5. VLAN hygiene

CheckPass conditionEvidence
SegmentationCameras, access control, servers, management, and operator workstations in separate VLANs, per the segmentation guideshow vlan brief against the VLAN plan
VLAN 1No ports assigned; not the native VLAN on any trunk; not the management VLANshow vlan id 1, show interfaces trunk
Native VLANAn unused, dedicated VLAN on every trunk; tagged where the platform allowsshow interfaces trunk
Trunk pruningTrunks carry only the VLANs the far end needs; no allowed vlan allshow interfaces trunk
Trunk negotiationDTP off; trunks configured statically; access ports set to nonegotiateshow interfaces switchport; Negotiation of Trunking: Off
Inter-VLAN routingOnly where the design says so, through the firewall or an ACL on the SVI, with the camera VLAN unable to initiate to anything but the ArchiversSVI ACLs; firewall policy

6. Video and access control specifics

CheckPass conditionEvidence
PoE budgetAllocated power below the supply’s budget with 20 percent headroom at winter peak; priority set by what the port covers; budget alert configured. Details in the PoE guideshow power inline; supply model and mode
LLDP for PoEEnabled on camera ports; allocation by negotiation rather than by classshow power inline … detail; allocated versus drawn
IGMP snooping and querierSnooping on the video VLAN; a querier on every switch in it. Details in the multicast guideshow ip igmp snooping querier
Jumbo framesConsistent end to end on any iSCSI storage path; not enabled on camera VLANs without a reasonshow system mtu, interface MTU
QoSDSCP trusted from cameras and Archivers; video marked and queued ahead of best-effort; access control marked ahead of videoshow mls qos or show policy-map interface
Uplink capacityAggregate camera bitrate per switch below 60 percent of uplink capacity; uplinks in a port channel where two existInterface utilisation over a week; show etherchannel summary
Redundant powerDual supplies on distribution and on any access switch feeding doors; mode documentedshow environment power

The platform commands

The evidence column above is Cisco IOS-XE syntax. The equivalents on the other platforms this site carries templates for:

                       Cisco IOS-XE                    Aruba AOS-CX                        Junos
Running config         show running-config             show running-config                 show configuration
Interface status       show interfaces status          show interface brief                show interfaces terse
Trunks                 show interfaces trunk           show vlan port                      show vlans
Spanning tree          show spanning-tree summary      show spanning-tree summary          show spanning-tree bridge
Port security / 802.1X show authentication sessions    show port-access clients            show dot1x interface
DHCP snooping          show ip dhcp snooping           show dhcpv4-snooping                show dhcp-security binding
PoE                    show power inline               show power-over-ethernet brief      show poe interface
IGMP querier           show ip igmp snooping querier   show ip igmp snooping vlan          show igmp snooping membership
NTP                    show ntp status                 show ntp status                     show ntp status
Logging                show logging                    show logging                        show log messages | last 50

Scoring and what to do with the result

Not every failed check is the same finding. I score them in three bands.

  • Fix before anything else. Telnet or HTTP management, SNMPv2 communities, VLAN 1 in use, no AAA, missing BPDU Guard on edge ports, unused ports live in an active VLAN. Any one of these means the switch can be taken by whoever plugs into a lobby port.
  • Fix in the next change window. No querier, no PoE headroom, no port security, trunks unpruned, no DHCP snooping, storm control absent, logging local only. These are the outages waiting to happen and the gaps an incident investigation will find.
  • Fix as the estate is touched. Descriptions, banner, QoS refinement, config archive cadence. Real, but not the reason to open a window.

The point of running the checklist is the delta between what the config says and what the drawing says. On a network I have not seen before, that delta is the fastest possible description of how the system has been maintained, and it tells me most of what the rest of the assessment is going to find.

The full baselines that pass every item above are the Cisco Catalyst, Aruba CX, Juniper EX, and OmniSwitch templates.

References

  1. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) SecurityRev 3
    NISTcsrc.nist.gov
  2. CIS Controls v8v8
    Center for Internet Securitycisecurity.org
  3. IEEE 802.1Q, Bridges and Bridged Networks
    IEEEstandards.ieee.org
  4. RFC 4541, Considerations for IGMP and MLD Snooping Switches
    IETFdatatracker.ietf.org

Outbound links open in a new tab. Source-pinned. If a vendor moves a doc, this block gets updated.

Tags switch-configauditchecklistciscoarubajunipercctvaccess-controlhardeningnetwork