Cisco Switch Security Best Practices for Catalyst IOS XE

Securing a Cisco switch comes down to three things: lock down who can manage it, shut every port nobody uses, and stop attached devices from impersonating the network. On a Catalyst switch running IOS XE that means SSH with named accounts, a restricted management network, port security, DHCP snooping, dynamic ARP inspection and BPDU guard. Each closes a different hole.

The short version: secure management first, then the access ports, then the first-hop protections, one VLAN at a time. Keep a console connection open while you change login settings so you can’t lock yourself out. The examples below are Catalyst IOS XE syntax; swap in your own names, ports, VLANs and secrets.

Use SSH v2 and named administrator accounts

Telnet sends passwords in clear text. Turn it off, use SSH v2, give each admin their own account and store credentials with secret, not password. This sets up local accounts and SSH-only access on a standalone switch:

hostname access-sw
ip domain name example.com
username netadmin privilege 15 secret REPLACE_WITH_UNIQUE_SECRET
aaa new-model
aaa authentication login default local
aaa authorization exec default local
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 15
 transport input ssh
 exec-timeout 10 0
exit

If you already authenticate admins with TACACS+ or RADIUS, keep that and its local fallback account; this example is for switches without one. Test a second SSH login before you close the session you’re working in.

Keep management on its own network

Put the switch’s management address on a dedicated management VLAN or the out-of-band port, then restrict who can reach it with an ACL or a firewall rule. A separate VLAN on its own doesn’t stop a user from routing to it. Turn off the HTTP and HTTPS servers if nobody uses the web interface, and save a copy of the configuration before you change access rules on a remote switch.

Shut unused ports into an unused VLAN

An open, live port in a lobby or conference room is an invitation. Park unused ports in a VLAN that goes nowhere, and shut them down:

vlan 999
 name UNUSED
exit
interface range GigabitEthernet1/0/20-24
 switchport mode access
 switchport access vlan 999
 shutdown
exit

Keep VLAN 999 off every trunk and give it no routed interface. Check the range before you apply it: a quiet port can still be an access point or a phone.

Use port security on fixed desks

Port security limits how many MAC addresses a port will learn. On a desk port, a limit of two (a phone plus the PC behind it) stops someone plugging in a switch and adding devices. It doesn’t authenticate anyone; for that you need 802.1X.

Pick the violation action on purpose: shutdown disables the port until an admin re-enables it, restrict drops the extra traffic and logs it. Sticky learning saves the first MAC addresses it sees to the configuration, so make sure the right device is plugged in first.

Enable DHCP snooping, then dynamic ARP inspection

DHCP snooping drops DHCP server replies from untrusted ports, which stops a rogue DHCP server (often a consumer router someone plugged in) from handing out addresses. It also builds a table of which IP address belongs on which port. This enables it on VLAN 10 and trusts only the uplink toward the real DHCP server:

ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet1/1/1
 ip dhcp snooping trust
exit

Dynamic ARP inspection uses that table to drop forged ARP replies, the basis of most man-in-the-middle attacks on a LAN. Let snooping run first and check its bindings, and add ARP ACL entries for devices with static IP addresses, or they’ll lose connectivity.

ip arp inspection vlan 10
interface GigabitEthernet1/1/1
 ip arp inspection trust
exit

Protect endpoint ports with BPDU guard

PortFast lets an endpoint port come up immediately. BPDU guard shuts that port down if a switch is plugged into it, before it can disrupt spanning tree. Apply both to every endpoint port, never to uplinks:

interface GigabitEthernet1/0/1
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
exit

Monitoring, banners and software updates

• SNMPv3. Use SNMPv3 with authentication and encryption, allow polling only from your monitoring servers, and delete the default community strings. Send syslog to a central server.
• Login banner. State that access is for authorized users only. It doesn’t block anyone, but it puts your policy on record.
• Software. Follow Cisco’s security advisories and recommended release for your exact model. Back up the configuration and schedule the reload before upgrading.

Choosing the switch itself? See our Cisco switch buying guide.

Get a quote

Send us the Catalyst part numbers and quantities you need, and we’ll quote them the same business day.