1

I have to extend our corporate lan to remote location on which we can not control the physical access to the switch.

What are the best practices in this case/scenario? So, I will shut down password recovery. I will shutdown all unused ports. Maybe disable console access? What about usb port?

  • I wouldn't shut the management or console ports off completely, in case something goes wrong and you need someone local to the switch to assist with getting it back online again, and may need those ports to view logs to figure out what's going on. I'd just lock down access to specific remote host IPs and use SSH (instead of Telnet), and set up AAA to apply to the console interfaces so they're restricted. The rest is fine as long as you keep track of the password and never need the password recovery feature. The USB port shares the Console port's AAA config. – Jesse P. Feb 6 at 16:25
  • Ok, when you said: "set up AAA to apply to the console interfaces so they're restricted. The USB port shares the Console port's AAA config"...can you post some commands for this? Because I do not have AAA server on this network can I configure the switch for local authentication and authorization? – John Feb 6 at 16:56
  • If you search, Cisco has documents regarding the hardening of its network devices. In fact, I do not think you can disable the console interface, but you can certainly configure some protection. – Ron Maupin Feb 6 at 17:07
1

Best practice: buy a lockable wall mount rack cabinet and put the switch in it.

  • Ok, I respect your professional opinion but can you be more specific what are the possibilities to compromise the switch in that environment? What is his weak spot? – John Feb 6 at 17:00
  • 2
    Weakness: saws, crowbars and sledgehammers – Mike Pennington Feb 6 at 17:02
  • Ok, then I will buy armored, bulletproof wall mount rack. Thanks for advice. – John Feb 6 at 17:05
  • 1
    If you’re that concerned be sure that your security team installs a video camera to watch the rack area – Mike Pennington Feb 6 at 17:30
  • 3
    If you use a lockable cabinet, you should also include some kind of tamper alarm to alert you when Mike comes with his sledgehammer. – Ron Trunk Feb 6 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.