CIS Cisco IOS 17 Benchmark

The enable secret command secures privileged EXEC mode access using a strong, salted hash (type 8/9 scrypt). It replaces the deprecated enable password.

Failure to 'enable secret' Is Set may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include enable secret

enable algorithm-type scrypt secret <STRONG_PASSWORD>

The enable password command stores the password with weak or no encryption (type 0/7). It should be removed in favor of enable secret.

Failure to 'enable password' Is Not Set may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include enable password

no enable password

This recommendation verifies that local User Accounts Use Scrypt Hashing on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to local User Accounts Use Scrypt Hashing may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include username

Verify all local accounts use algorithm-type scrypt (type 9 hash).

username <USER> algorithm-type scrypt secret <PASSWORD>

This recommendation verifies that password Minimum Length Is 14+ Characters on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to password Minimum Length Is 14+ Characters may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include security passwords

security passwords min-length 14

The AAA new-model enables the Authentication, Authorization, and Accounting framework which provides centralized access control.

Without AAA New-Model enabled, the Cisco IOS XE 17 network device may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show running-config | include aaa new-model

aaa new-model

This recommendation addresses the proper configuration of AAA Authentication for Login on the Cisco IOS XE 17 network device. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of AAA Authentication for Login can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | include aaa authentication login

aaa authentication login default group tacacs+ local
aaa authentication login CONSOLE local

This recommendation addresses the proper configuration of AAA Authentication for Enable Mode on the Cisco IOS XE 17 network device. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of AAA Authentication for Enable Mode can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | include aaa authentication enable

aaa authentication enable default group tacacs+ enable

This recommendation addresses the proper configuration of AAA Accounting for Commands on the Cisco IOS XE 17 network device. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of AAA Accounting for Commands can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | include aaa accounting

aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

This recommendation addresses the proper configuration of AAA Session Accounting on the Cisco IOS XE 17 network device. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of AAA Session Accounting can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | include aaa accounting

aaa accounting network default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+

This recommendation verifies that a Login Banner Is Set on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to a Login Banner Is Set may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | section banner login

banner login ^
Authorized access only. Unauthorized access is prohibited.
All activity may be monitored and recorded.
^

This recommendation verifies that a MOTD Banner Is Set on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to a MOTD Banner Is Set may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | section banner motd

banner motd ^
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED.
^

Prevents brute-force attacks by blocking login attempts after repeated failures.

Misconfiguration of Login Block-For can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | include login block-for

login block-for 120 attempts 3 within 60

This recommendation configures the timeout for Exec on the Cisco IOS XE 17 network device. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to exec Timeout on Console Is ≤ 10 Minutes may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | section line con 0

line con 0
 exec-timeout 10 0

This setting controls whether SSH Version 2 is enabled on the Cisco IOS XE 17 network device. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IOS CLI, running-config, or Cisco DNA Center.

Without SSH Version 2 enabled, the Cisco IOS XE 17 network device may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show ip ssh

Verify SSH version is 2.

ip ssh version 2

This recommendation configures the timeout for SSH on the Cisco IOS XE 17 network device. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to sSH Timeout Is ≤ 60 Seconds may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show ip ssh
# Verify: SSH timeout ≤ 60

ip ssh time-out 60

This recommendation verifies that sSH Authentication Retries ≤ 3 on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sSH Authentication Retries ≤ 3 may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show ip ssh

ip ssh authentication-retries 3

Telnet sends data in plaintext. All remote management should use SSH only.

Failure to telnet Is Disabled on VTY Lines may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | section line vty

line vty 0 15
 transport input ssh

This recommendation verifies that rSA Key Pair Size ≥ 2048 Bits on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to rSA Key Pair Size ≥ 2048 Bits may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show crypto key mypubkey rsa

crypto key generate rsa modulus 2048

This setting controls whether NTP Authentication is enabled on the Cisco IOS XE 17 network device. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IOS CLI, running-config, or Cisco DNA Center.

Without NTP Authentication enabled, the Cisco IOS XE 17 network device may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show running-config | include ntp

ntp authenticate
ntp authentication-key 1 md5 <KEY>
ntp trusted-key 1
ntp server <NTP_SERVER> key 1

This recommendation verifies that timestamps Are Enabled for Logging on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to timestamps Are Enabled for Logging may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include service timestamps

service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone

This recommendation verifies that logging to a Central Syslog Server on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to logging to a Central Syslog Server may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include logging host

logging host <SYSLOG_SERVER_IP>
logging trap informational

This recommendation addresses the proper configuration of Logging Buffered on the Cisco IOS XE 17 network device. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Logging Buffered can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | include logging buffered

logging buffered 65536 informational

This setting ensures that Logging Console is limited on the Cisco IOS XE 17 network device. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Logging Console could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Cisco IOS XE 17 network device is essential for defense in depth.

show running-config | include logging console

logging console critical

SNMPv1 and v2c use community strings in plaintext. All SNMP should use SNMPv3 with authPriv.

Failure to sNMPv3 with Encryption Is Used may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show snmp group
show snmp user

snmp-server group SNMPV3GROUP v3 priv
snmp-server user SNMPV3USER SNMPV3GROUP v3 auth sha256 <AUTH_PW> priv aes 256 <PRIV_PW>

This recommendation verifies that sNMP Community Strings Are Not 'public' or 'private' on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sNMP Community Strings Are Not 'public' or 'private' may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include snmp-server community

no snmp-server community public
no snmp-server community private

This recommendation verifies that sNMP ACLs Are Applied on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sNMP ACLs Are Applied may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include snmp-server community

Verify an ACL number or name is specified for each community string.

snmp-server community <STRING> RO <ACL_NAME>

This recommendation addresses the proper configuration of SNMP Traps on the Cisco IOS XE 17 network device. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of SNMP Traps can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | include snmp-server host

snmp-server host <MGMT_SERVER> version 3 priv <USER>
snmp-server enable traps

OSPF neighbor authentication prevents unauthorized routers from injecting routes into the network.

Misconfiguration of OSPF Authentication can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show ip ospf interface

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 <KEY>
!
router ospf 1
 area 0 authentication message-digest

This recommendation addresses the proper configuration of EIGRP Authentication on the Cisco IOS XE 17 network device. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of EIGRP Authentication can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | section key chain
show running-config | section interface

key chain EIGRP-KEY
 key 1
  key-string <SECRET_KEY>
!
interface GigabitEthernet0/0
 ip authentication mode eigrp <ASN> md5
 ip authentication key-chain eigrp <ASN> EIGRP-KEY

This recommendation addresses the proper configuration of BGP Neighbor Authentication on the Cisco IOS XE 17 network device. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of BGP Neighbor Authentication can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | section router bgp

router bgp <ASN>
 neighbor <PEER_IP> password <SECRET>

This recommendation addresses the proper configuration of RIPv2 Authentication on the Cisco IOS XE 17 network device. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of RIPv2 Authentication can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show running-config | section interface
# Verify: ip rip authentication mode md5

key chain RIP-KEY
 key 1
  key-string <SECRET_KEY>
!
interface GigabitEthernet0/0
 ip rip authentication mode md5
 ip rip authentication key-chain RIP-KEY

This setting controls whether Unused Interfaces is disabled on the Cisco IOS XE 17 network device. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Unused Interfaces enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Cisco IOS XE 17 network device.

show ip interface brief | include down

interface <UNUSED_IF>
 shutdown

This recommendation verifies that port-Security Is Enabled on Access Ports on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to port-Security Is Enabled on Access Ports may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show port-security interface <IF>

interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict

This setting controls whether IP Source Guard is enabled on the Cisco IOS XE 17 network device. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IOS CLI, running-config, or Cisco DNA Center.

Without IP Source Guard enabled, the Cisco IOS XE 17 network device may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show ip verify source

interface GigabitEthernet0/1
 ip verify source

Unicast Reverse Path Forwarding (uRPF) verifies the source address of incoming packets to prevent IP spoofing.

Failure to uRPF Is Enabled on External Interfaces may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config interface <EXTERNAL_IF>

interface GigabitEthernet0/0
 ip verify unicast source reachable-via rx

This recommendation verifies that vTY Lines Require an ACL on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to vTY Lines Require an ACL may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | section line vty

ip access-list standard VTY-ACCESS
 permit <MGMT_SUBNET> <WILDCARD>
 deny any log
!
line vty 0 15
 access-class VTY-ACCESS in

This setting ensures that Console Access is restricted on the Cisco IOS XE 17 network device. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Console Access could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Cisco IOS XE 17 network device is essential for defense in depth.

show running-config | section line con 0

line con 0
 login authentication CONSOLE
 exec-timeout 5 0

This recommendation verifies that aCLs Deny IP Addresses from RFC 1918 on External Interfaces on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to aCLs Deny IP Addresses from RFC 1918 on External Interfaces may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show access-lists

ip access-list extended EXTERNAL-IN
 deny ip 10.0.0.0 0.255.255.255 any
 deny ip 172.16.0.0 0.15.255.255 any
 deny ip 192.168.0.0 0.0.255.255 any
 deny ip 127.0.0.0 0.255.255.255 any
 permit ip any any
!
interface GigabitEthernet0/0
 ip access-group EXTERNAL-IN in

This recommendation verifies that aCLs Contain Explicit 'deny any' at the End on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to aCLs Contain Explicit 'deny any' at the End may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show access-lists

# Add explicit deny with logging at end of each ACL:
 deny ip any any log

This recommendation verifies that sNMP Traffic Is Restricted by ACL on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sNMP Traffic Is Restricted by ACL may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include snmp-server community

ip access-list standard SNMP-ACCESS
 permit host <SNMP_MGMT_IP>
 deny any log
!
snmp-server community <STRING> RO SNMP-ACCESS

CDP can expose device details to adjacent devices. Disable on untrusted or external interfaces.

Failure to cDP Is Disabled on External Interfaces may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show cdp interface

interface GigabitEthernet0/0
 no cdp enable

This setting enforces that LLDP Is Disabled if Not is required on the Cisco IOS XE 17 network device. Making this mandatory ensures consistent security policy enforcement across the environment.

Failure to lLDP Is Disabled if Not Required may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show lldp

no lldp run

This setting controls whether HTTP Server is disabled on the Cisco IOS XE 17 network device. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving HTTP Server enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Cisco IOS XE 17 network device.

show running-config | include ip http

no ip http server
no ip http secure-server

This setting controls whether TCP/UDP Small Servers is disabled on the Cisco IOS XE 17 network device. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving TCP/UDP Small Servers enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Cisco IOS XE 17 network device.

show running-config | include small-servers

no service tcp-small-servers
no service udp-small-servers

This setting controls whether IP Source Routing is disabled on the Cisco IOS XE 17 network device. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving IP Source Routing enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Cisco IOS XE 17 network device.

show running-config | include ip source-route

no ip source-route

This setting controls whether Finger Service is disabled on the Cisco IOS XE 17 network device. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Finger Service enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Cisco IOS XE 17 network device.

show running-config | include service finger

no service finger
no ip finger

This setting controls whether IP Directed Broadcasts is disabled on the Cisco IOS XE 17 network device. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving IP Directed Broadcasts enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Cisco IOS XE 17 network device.

show running-config | section interface

interface GigabitEthernet0/0
 no ip directed-broadcast

This setting controls whether Proxy ARP is disabled on the Cisco IOS XE 17 network device. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Proxy ARP enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Cisco IOS XE 17 network device.

show ip interface

interface GigabitEthernet0/0
 no ip proxy-arp

This setting controls whether BOOTP is disabled on the Cisco IOS XE 17 network device. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving BOOTP enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Cisco IOS XE 17 network device.

show running-config | include ip bootp

no ip bootp server

This recommendation verifies that dNS Resolution Is Configured Securely on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to dNS Resolution Is Configured Securely may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running-config | include ip name-server

ip name-server <TRUSTED_DNS_1> <TRUSTED_DNS_2>
ip domain lookup

DHCP snooping prevents rogue DHCP servers from distributing incorrect IP configuration.

Without DHCP Snooping enabled, the Cisco IOS XE 17 network device may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show ip dhcp snooping

ip dhcp snooping
ip dhcp snooping vlan <VLAN_RANGE>
!
interface <TRUSTED_UPLINK>
 ip dhcp snooping trust

This setting controls whether Dynamic ARP Inspection is enabled on the Cisco IOS XE 17 network device. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IOS CLI, running-config, or Cisco DNA Center.

Without Dynamic ARP Inspection enabled, the Cisco IOS XE 17 network device may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show ip arp inspection

ip arp inspection vlan <VLAN_RANGE>
!
interface <TRUSTED_UPLINK>
 ip arp inspection trust

This setting controls whether 'service password-encryption' is enabled on the Cisco IOS XE 17 network device. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IOS CLI, running-config, or Cisco DNA Center.

Without 'service password-encryption' enabled, the Cisco IOS XE 17 network device may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show running-config | include service password-encryption

service password-encryption

Type 0 is plaintext. Type 7 uses weak Vigenère cipher and is trivially reversible. All passwords should use type 8 (PBKDF2) or type 9 (scrypt).

The absence of No Type 0 or Type 7 Passwords leaves the Cisco IOS XE 17 network device without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

show running-config | include password
# Look for passwords starting with '0 ' or '7 '

# Re-create accounts using scrypt:
username <USER> algorithm-type scrypt secret <PASSWORD>

This recommendation verifies that password Policy Meets Complexity Requirements on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to password Policy Meets Complexity Requirements may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Review organizational password policy and verify:
# - Minimum 14 characters
# - Mix of upper, lower, numbers, special
# - No dictionary words

security passwords min-length 14
# Enforce complexity via AAA server policy

This setting controls whether TCP Keepalives is enabled on the Cisco IOS XE 17 network device. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IOS CLI, running-config, or Cisco DNA Center.

Without TCP Keepalives enabled, the Cisco IOS XE 17 network device may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show running-config | include tcp keepalives

service tcp-keepalives-in
service tcp-keepalives-out

This setting controls whether Memory Threshold Notifications is enabled on the Cisco IOS XE 17 network device. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IOS CLI, running-config, or Cisco DNA Center.

Without Memory Threshold Notifications enabled, the Cisco IOS XE 17 network device may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show running-config | include memory free

memory free low-watermark processor 50000
memory free low-watermark IO 25000

Control Plane Policing (CoPP) protects the CPU from excessive traffic directed at the router itself.

Misconfiguration of Control Plane Policing can lead to security gaps that may be exploited by attackers. A properly configured Cisco IOS XE 17 network device reduces exposure to both known vulnerabilities and configuration drift.

show policy-map control-plane

policy-map COPP
 class class-default
  police rate 1000 pps burst 250 packets
   conform-action transmit
   exceed-action drop
!
control-plane
 service-policy input COPP

This recommendation verifies that iOS Image Integrity Is Verified on the Cisco IOS XE 17 network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to iOS Image Integrity Is Verified may leave the Cisco IOS XE 17 network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

verify /md5 <IOS_IMAGE_FILE>

# Compare MD5/SHA hash with official Cisco download page
# Ensure Secure Boot is enabled where supported:
secure boot-image