1

I have to extend our corporate lan to remote location on which we can not control the physical access to the switch.

What are the best practices in this case/scenario? So, I will shut down password recovery. I will shutdown all unused ports. Maybe disable console access? What about usb port?

Improve this question
4
  • I wouldn't shut the management or console ports off completely, in case something goes wrong and you need someone local to the switch to assist with getting it back online again, and may need those ports to view logs to figure out what's going on. I'd just lock down access to specific remote host IPs and use SSH (instead of Telnet), and set up AAA to apply to the console interfaces so they're restricted. The rest is fine as long as you keep track of the password and never need the password recovery feature. The USB port shares the Console port's AAA config.
    – Jesse P.
    Feb 6, 2019 at 16:25
  • Ok, when you said: "set up AAA to apply to the console interfaces so they're restricted. The USB port shares the Console port's AAA config"...can you post some commands for this? Because I do not have AAA server on this network can I configure the switch for local authentication and authorization?
    – John
    Feb 6, 2019 at 16:56
  • If you search, Cisco has documents regarding the hardening of its network devices. In fact, I do not think you can disable the console interface, but you can certainly configure some protection.
    – Ron Maupin ♦
    Feb 6, 2019 at 17:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 14, 2019 at 20:03

1 Answer 1

Reset to default
1

Best practice: buy a lockable wall mount rack cabinet and put the switch in it.

Improve this answer
5
  • Ok, I respect your professional opinion but can you be more specific what are the possibilities to compromise the switch in that environment? What is his weak spot?
    – John
    Feb 6, 2019 at 17:00
  • 2
    Weakness: saws, crowbars and sledgehammers
    – Mike Pennington
    Feb 6, 2019 at 17:02
  • Ok, then I will buy armored, bulletproof wall mount rack. Thanks for advice.
    – John
    Feb 6, 2019 at 17:05
  • 1
    If you’re that concerned be sure that your security team installs a video camera to watch the rack area
    – Mike Pennington
    Feb 6, 2019 at 17:30
  • 3
    If you use a lockable cabinet, you should also include some kind of tamper alarm to alert you when Mike comes with his sledgehammer.
    – Ron Trunk
    Feb 6, 2019 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.