The Basics of Securing a Cisco Switch (CCNA)

When studying for the Cisco Certified Network Associate (CCNA 200-301) exam, one of the first practical skills you master is baseline device hardening. Out of the box, a freshly unboxed Cisco Catalyst switch is completely open: anyone with a rollover console cable or network access can jump in and alter running configurations.

Securing a switch doesn't have to be overwhelming. For the CCNA exam—and for basic enterprise network hygiene—securing access boils down to a few fundamental steps: protecting local console access, locking down privileged execution, encrypting passwords in memory, replacing Telnet with SSH, setting legal banners, and disabling unused physical ports.

Here is a hands-on walkthrough of the core commands, why they matter, and what you need to remember for exam day.

1. Securing Console Access (User EXEC Mode)

When you first connect via a serial console cable, you land in User EXEC mode (indicated by the Switch> prompt). You can view basic status commands, but cannot modify configurations. Even so, unauthorized console access exposes network topology and device status.

To lock down the physical console port with a password:

Switch> enable
Switch# configure terminal
Switch(config)# line console 0
Switch(config-line)# password ConsoleSecPass123!
Switch(config-line)# login
Switch(config-line)# exit

CCNA Exam Note: The login command is required under line con 0. Without it, Cisco IOS will not prompt for the password when a user connects via console.

2. Securing Privileged EXEC Mode (enable secret)

Typing enable elevates you to Privileged EXEC mode (indicated by the Switch# prompt), granting full administrative control.

Cisco IOS gives you two commands to set an enable password:

Switch(config)# enable password WeakPlainPass
Switch(config)# enable secret StrongHashPass123!

Why enable secret Always Wins

• enable password uses legacy Type 7 reversible obfuscation (or plain text if password encryption is disabled).
• enable secret uses strong cryptographic hashing (Type 5 MD5 or Type 8/9 SHA-256/scrypt depending on IOS version).
• If both are configured on the same switch, Cisco IOS will always enforce enable secret and ignore enable password.

For both security and the CCNA exam, always configure enable secret.

3. Encrypting Cleartext Passwords (service password-encryption)

By default, passwords set on console or auxiliary lines appear in plain text when running show running-config.

To prevent "shoulder surfers" or unauthorized viewers from reading these passwords directly out of configuration files, enable global password encryption:

Switch(config)# service password-encryption

This applies a Type 7 XOR-based cipher to all plain text passwords stored in the configuration file. While Type 7 is only simple obfuscation (and easily cracked by online tools), it satisfies the basic CCNA requirement for hiding passwords from casual viewing in config files.

4. Securing Remote Management: Moving from Telnet to SSH (VTY Lines)

Remote administrative access takes place across Virtual Terminal (VTY) lines (line vty 0 4 or 0 15). Legacy setups used Telnet, which transmits credentials and configurations in clear text across the wire.

The CCNA heavily emphasizes disabling Telnet in favor of encrypted SSHv2.

Step-by-Step SSH Configuration

! 1. Set a unique hostname and domain name (required for RSA key generation)
Switch(config)# hostname SW-CORE-01
SW-CORE-01(config)# ip domain-name lab.local

! 2. Generate RSA cryptographic keys (minimum 1024 bits for SSHv2, 2048 recommended)
SW-CORE-01(config)# crypto key generate rsa modulus 2048

! 3. Enforce SSH Version 2
SW-CORE-01(config)# ip ssh version 2

! 4. Create a local administrative user account
SW-CORE-01(config)# username admin privilege 15 secret AdminPass2026!

! 5. Configure VTY lines to require local login and accept SSH only
SW-CORE-01(config)# line vty 0 15
SW-CORE-01(config-line)# login local
SW-CORE-01(config-line)# transport input ssh
SW-CORE-01(config-line)# exit

CCNA Exam Trap: If you omit transport input ssh, VTY lines may default to transport input all or transport input telnet, leaving unencrypted access open.

5. Adding a Legal Notice (Message of the Day Banner)

A Message of the Day (MOTD) banner provides legal notice prior to authentication, warning unauthorized users that access is monitored.

SW-CORE-01(config)# banner motd #
*****************************************************************
* UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS STRICTLY        *
* PROHIBITED. ALL ACTIVITIES ARE MONITORED AND LOGGED.          *
*****************************************************************
#

Exam Tip: The character following banner motd (in this case #) acts as the delimiting character. The banner message ends when that same character is typed again. Avoid using words like "Welcome" in enterprise banners for legal compliance reasons.

6. Disabling Inactive and Unused Switch Ports

Physical security matters just as much as line authentication. Any open RJ45 wall jack connected to an enabled switchport is an open door into your network.

Best practice is to shut down all unused interfaces and assign them to an unused "parking lot" VLAN:

SW-CORE-01(config)# interface range FastEthernet 0/10 - 24, GigabitEthernet 0/2
SW-CORE-01(config-if-range)# description UNUSED_PORTS_SHUTDOWN
SW-CORE-01(config-if-range)# switchport mode access
SW-CORE-01(config-if-range)# switchport access vlan 999
SW-CORE-01(config-if-range)# shutdown
SW-CORE-01(config-if-range)# exit

7. Basic Layer 2 Hardening: Port Security

For active user-facing access ports, Port Security limits the MAC addresses allowed to send frames through a switchport, preventing unauthorized rogue switches or MAC flooding attacks.

SW-CORE-01(config)# interface FastEthernet 0/1
SW-CORE-01(config-if)# switchport mode access
SW-CORE-01(config-if)# switchport port-security
SW-CORE-01(config-if)# switchport port-security maximum 2
SW-CORE-01(config-if)# switchport port-security mac-address sticky
SW-CORE-01(config-if)# switchport port-security violation restrict
SW-CORE-01(config-if)# exit

CCNA Violation Modes to Memorize

• Protect: Drops unauthorized frames silently; no syslog generated, port stays up.
• Restrict: Drops unauthorized frames; logs syslog message and increments violation counter; port stays up.
• Shutdown (Default): Drops unauthorized frames; logs syslog message and immediately puts the port into err-disabled state.

8. Verifying and Saving Your Configuration

Always verify your changes and save the active configuration from RAM (running-config) to non-volatile RAM (startup-config):

SW-CORE-01# show running-config
SW-CORE-01# show ip ssh
SW-CORE-01# show port-security
SW-CORE-01# copy running-config startup-config

Summary Checklist for CCNA Baseline Switch Security

Securing network switches forms the frontline barrier for any enterprise infrastructure. For more security tooling and defensive workflows, check out our work on LinuSec and Python-based reconnaissance tools.