# The Basics of Securing a Cisco Switch (CCNA) > By Johnathan Belcher — September 14, 2026 — 7 min read When studying for the Cisco Certified Network Associate (CCNA 200-301) exam, one of the first practical skills you master is baseline device hardening. Out of the box, a freshly unboxed Cisco Catalyst switch is completely open: anyone with a rollover console cable or network access can jump in and alter running configurations. Securing a switch doesn't have to be overwhelming. For the CCNA exam—and for basic enterprise network hygiene—securing access boils down to a few fundamental steps: protecting local console access, locking down privileged execution, encrypting passwords in memory, replacing Telnet with SSH, setting legal banners, and disabling unused physical ports. Here is a hands-on walkthrough of the core commands, why they matter, and what you need to remember for exam day. ## 1. Securing Console Access (User EXEC Mode) When you first connect via a serial console cable, you land in **User EXEC mode** (indicated by the `Switch>` prompt). You can view basic status commands, but cannot modify configurations. Even so, unauthorized console access exposes network topology and device status. To lock down the physical console port with a password: ```cisco Switch> enable Switch# configure terminal Switch(config)# line console 0 Switch(config-line)# password ConsoleSecPass123! Switch(config-line)# login Switch(config-line)# exit ``` *CCNA Exam Note:* The `login` command is required under `line con 0`. Without it, Cisco IOS will not prompt for the password when a user connects via console. ## 2. Securing Privileged EXEC Mode (`enable secret`) Typing `enable` elevates you to **Privileged EXEC mode** (indicated by the `Switch#` prompt), granting full administrative control. Cisco IOS gives you two commands to set an enable password: ```cisco Switch(config)# enable password WeakPlainPass Switch(config)# enable secret StrongHashPass123! ``` ### Why `enable secret` Always Wins - `enable password` uses legacy Type 7 reversible obfuscation (or plain text if password encryption is disabled). - `enable secret` uses strong cryptographic hashing (Type 5 MD5 or Type 8/9 SHA-256/scrypt depending on IOS version). - If both are configured on the same switch, Cisco IOS will **always enforce `enable secret`** and ignore `enable password`. For both security and the CCNA exam, always configure `enable secret`. ## 3. Encrypting Cleartext Passwords (`service password-encryption`) By default, passwords set on console or auxiliary lines appear in plain text when running `show running-config`. To prevent "shoulder surfers" or unauthorized viewers from reading these passwords directly out of configuration files, enable global password encryption: ```cisco Switch(config)# service password-encryption ``` This applies a Type 7 XOR-based cipher to all plain text passwords stored in the configuration file. While Type 7 is only simple obfuscation (and easily cracked by online tools), it satisfies the basic CCNA requirement for hiding passwords from casual viewing in config files. ## 4. Securing Remote Management: Moving from Telnet to SSH (VTY Lines) Remote administrative access takes place across **Virtual Terminal (VTY)** lines (`line vty 0 4` or `0 15`). Legacy setups used Telnet, which transmits credentials and configurations in clear text across the wire. The CCNA heavily emphasizes disabling Telnet in favor of encrypted SSHv2. ### Step-by-Step SSH Configuration ```cisco ! 1. Set a unique hostname and domain name (required for RSA key generation) Switch(config)# hostname SW-CORE-01 SW-CORE-01(config)# ip domain-name lab.local ! 2. Generate RSA cryptographic keys (minimum 1024 bits for SSHv2, 2048 recommended) SW-CORE-01(config)# crypto key generate rsa modulus 2048 ! 3. Enforce SSH Version 2 SW-CORE-01(config)# ip ssh version 2 ! 4. Create a local administrative user account SW-CORE-01(config)# username admin privilege 15 secret AdminPass2026! ! 5. Configure VTY lines to require local login and accept SSH only SW-CORE-01(config)# line vty 0 15 SW-CORE-01(config-line)# login local SW-CORE-01(config-line)# transport input ssh SW-CORE-01(config-line)# exit ``` *CCNA Exam Trap:* If you omit `transport input ssh`, VTY lines may default to `transport input all` or `transport input telnet`, leaving unencrypted access open. ## 5. Adding a Legal Notice (Message of the Day Banner) A Message of the Day (MOTD) banner provides legal notice prior to authentication, warning unauthorized users that access is monitored. ```cisco SW-CORE-01(config)# banner motd # ***************************************************************** * UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS STRICTLY * * PROHIBITED. ALL ACTIVITIES ARE MONITORED AND LOGGED. * ***************************************************************** # ``` *Exam Tip:* The character following `banner motd` (in this case `#`) acts as the **delimiting character**. The banner message ends when that same character is typed again. Avoid using words like "Welcome" in enterprise banners for legal compliance reasons. ## 6. Disabling Inactive and Unused Switch Ports Physical security matters just as much as line authentication. Any open RJ45 wall jack connected to an enabled switchport is an open door into your network. Best practice is to shut down all unused interfaces and assign them to an unused "parking lot" VLAN: ```cisco SW-CORE-01(config)# interface range FastEthernet 0/10 - 24, GigabitEthernet 0/2 SW-CORE-01(config-if-range)# description UNUSED_PORTS_SHUTDOWN SW-CORE-01(config-if-range)# switchport mode access SW-CORE-01(config-if-range)# switchport access vlan 999 SW-CORE-01(config-if-range)# shutdown SW-CORE-01(config-if-range)# exit ``` ## 7. Basic Layer 2 Hardening: Port Security For active user-facing access ports, **Port Security** limits the MAC addresses allowed to send frames through a switchport, preventing unauthorized rogue switches or MAC flooding attacks. ```cisco SW-CORE-01(config)# interface FastEthernet 0/1 SW-CORE-01(config-if)# switchport mode access SW-CORE-01(config-if)# switchport port-security SW-CORE-01(config-if)# switchport port-security maximum 2 SW-CORE-01(config-if)# switchport port-security mac-address sticky SW-CORE-01(config-if)# switchport port-security violation restrict SW-CORE-01(config-if)# exit ``` ### CCNA Violation Modes to Memorize - **Protect**: Drops unauthorized frames silently; no syslog generated, port stays up. - **Restrict**: Drops unauthorized frames; logs syslog message and increments violation counter; port stays up. - **Shutdown** *(Default)*: Drops unauthorized frames; logs syslog message and immediately puts the port into `err-disabled` state. ## 8. Verifying and Saving Your Configuration Always verify your changes and save the active configuration from RAM (`running-config`) to non-volatile RAM (`startup-config`): ```cisco SW-CORE-01# show running-config SW-CORE-01# show ip ssh SW-CORE-01# show port-security SW-CORE-01# copy running-config startup-config ``` ## Summary Checklist for CCNA Baseline Switch Security | Hardening Item | Key Command | CCNA Exam Focus | | --- | --- | --- | | Console Password | `line con 0` → `password ` → `login` | Understand `login` requirement | | Privileged Mode | `enable secret ` | `secret` (hashed) vs `password` (plain) | | Hide Cleartext Pwds | `service password-encryption` | Type 7 reversible obfuscation | | SSH Setup | `crypto key generate rsa` → `transport input ssh` | Hostname + domain name prerequisite | | Local Accounts | `username secret ` + `login local` | Local database authentication | | Legal Notice | `banner motd ##` | Delimiter syntax & compliance | | Unused Interfaces | `interface range ...` → `shutdown` | Parking lot VLAN + administrative down | | Port Security | `switchport port-security violation ` | Protect vs Restrict vs Shutdown | Securing network switches forms the frontline barrier for any enterprise infrastructure. For more security tooling and defensive workflows, check out our work on [LinuSec](blog/entries/designing-linusec.html.md) and Python-based [reconnaissance tools](blog/entries/username-recon-python-script.html.md).