A hardened Catalyst baseline means SSH version 2 only, central AAA with a local fallback, type 9 secrets, SNMPv3, authenticated NTP, and syslog off the box. On the access ports you add port security, BPDU guard, DHCP snooping, and Dynamic ARP Inspection, and you park every unused port in a blackhole VLAN. The one trap on camera networks is DAI blocking static-IP devices, which is covered below. Read that part first.

The examples assume a Catalyst 9200 or 9300 on a current IOS-XE 17.x release, VLAN 99 for management, VLANs 100 to 102 for endpoints, and documentation addresses from 192.0.2.0/24. Replace every placeholder before use. The same ground is taught in Network Hardening Level 1 and Cisco Catalyst Level 1, and the audit side is in the switch configuration audit checklist.

Management plane

Start with identity. Create a local fallback account and a type 9 (scrypt) enable secret, then point logins at TACACS+ with local as the last method. Test the fallback from the console before you close your session.

aaa new-model enable algorithm-type scrypt secret <strong-secret> username breakglass privilege 15 algorithm-type scrypt secret <strong-secret> tacacs server TAC1 address ipv4 192.0.2.20 key <strong-secret> aaa group server tacacs+ TAC-GRP server name TAC1 aaa authentication login default group TAC-GRP local aaa authorization exec default group TAC-GRP local aaa accounting commands 15 default start-stop group TAC-GRP login block-for 120 attempts 5 within 60 banner login ^C This system is private property of [ORGANIZATION]. Authorized use only. Activity is logged and monitored. ^C

SSH needs a domain name and a host key before it will run. Set version 2, restrict the VTY lines to the management subnet with an access class, and turn off everything else that listens.

ip domain name example.net crypto key generate rsa modulus 3072 ip ssh version 2 ip ssh time-out 60 ip ssh authentication-retries 3 ip access-list standard MGMT-ONLY permit 192.0.2.0 0.0.0.255 line vty 0 15 access-class MGMT-ONLY in transport input ssh exec-timeout 10 0 no ip http server no ip http secure-server no vstack

The no vstack line disables Smart Install, which has been exploited in the field and has no place on a production access switch. If you need the HTTPS interface, keep ip http secure-server with an access class and a real certificate rather than the factory one.

Time, SNMP, and logging

Logs without trustworthy time are hard to use. Incident reviews depend on them. Authenticate NTP so the switch only accepts time from a source it trusts, move to SNMPv3 with authentication and privacy, and send syslog to a collector that is not on the same switch stack. If your release does not offer a SHA-2 NTP key type, check its notes before you fall back to MD5.

ntp authentication-key 1 hmac-sha2-256 <strong-secret> ntp authenticate ntp trusted-key 1 ntp server 192.0.2.30 key 1 snmp-server group MON-GRP v3 priv snmp-server user monitor MON-GRP v3 auth sha <strong-secret> priv aes 128 <strong-secret> no snmp-server community public service timestamps log datetime msec localtime show-timezone logging source-interface Vlan99 logging host 192.0.2.10 logging trap informational

Control plane basics

Catalyst 9000 switches ship with a default control plane policing policy. Confirm it is attached with show policy-map control-plane, and leave it alone unless you have measured a reason to change it, because a wrong policy can starve routing and management traffic during a burst. Measure first. Then remove the small things that widen the attack surface.

no ip source-route no ip domain lookup no service pad spanning-tree mode rapid-pvst spanning-tree portfast bpduguard default

Access ports

Every port that faces an endpoint gets the same set of controls. Port security with a maximum of 1 MAC catches the unmanaged switch plugged in for extra drops, and BPDU guard catches a managed switch or a loop. Neither replaces the other.

interface range GigabitEthernet1/0/1 - 23 switchport mode access switchport access vlan 100 switchport nonegotiate switchport port-security switchport port-security maximum 1 switchport port-security mac-address sticky switchport port-security violation shutdown spanning-tree portfast spanning-tree bpduguard enable storm-control broadcast level 1.00 ip dhcp snooping limit rate 15 errdisable recovery cause psecure-violation errdisable recovery cause bpduguard errdisable recovery interval 300

DHCP snooping and DAI go on at the VLAN level, with trust set on the uplinks only. Forget the uplink trust and the VLAN loses its DHCP server, so do this in a maintenance window.

ip dhcp snooping ip dhcp snooping vlan 100-102 ip arp inspection vlan 100-102 interface Port-channel1 ip dhcp snooping trust ip arp inspection trust

DAI validates ARP against the snooping binding table. A camera with a static address never asked a DHCP server, so it has no binding, and its ARP is dropped as soon as DAI turns on. Half the cameras go dark. The cleaner fix is a DHCP reservation for every camera and door controller. For devices that must stay static, add an ARP ACL and attach it to the VLAN.

arp access-list STATIC-DEVICES permit ip host 192.0.2.50 mac host 0011.2233.4455 ip arp inspection filter STATIC-DEVICES vlan 100

A static source binding for the device does the same job. Whichever you pick, build the list from the camera inventory before enabling DAI, and watch show ip arp inspection statistics for drops afterward.

Unused ports

Every port without a labelled purpose goes into a VLAN that has no SVI and no routing, gets shut down, and carries a description that says it is unused.

interface range GigabitEthernet1/0/24, GigabitEthernet1/0/30 - 48 switchport mode access switchport access vlan 666 description UNUSED shutdown

Backups and firmware

Save the config after each change set with copy running-config startup-config, then pull a copy off the switch on a schedule.

copy running-config scp://backup@192.0.2.40/sw01.cfg

Keep the backup server out of the camera VLANs, and diff each copy against the last one. For firmware, check the target release against Cisco’s security advisories before you deploy, and use install mode so a failed upgrade can roll back.

install add file flash:<image>.bin activate commit

Checking your work

The switch config audit tool reads a pasted running config and flags the gaps against this baseline, and the switch config audit is the remote review across a whole estate. Hands-on practice is in the Network and Windows Hardening course.

Book a working session at /book/.