Playbook: hardening a new access switch
In short: Secure the management plane first (accounts, SSH, no Telnet), then lock down the ports (unused ports off, port security, BPDU guard, DHCP snooping), then make sure you can see and recover (logs, time, backups).
Checklist
- Accounts: remove default credentials, create named admin users, use an enable secret.
- Management access: SSH version 2 only; disable Telnet and the HTTP server; restrict management to an admin VLAN or ACL.
- Unused ports: shut them down and place them in an unused "parking" VLAN.
- Access ports: force access mode, enable PortFast with BPDU guard, and limit MAC addresses with port security.
- DHCP snooping: stop rogue DHCP servers; trust only the uplink.
- Trunks: disable auto-negotiation, change the native VLAN, allow only the VLANs needed.
- Visibility: send logs to a syslog server, sync time with NTP, use SNMPv3 rather than v1/v2c.
- Recovery: save the configuration and keep a backup copy off the device.
Example configuration (Cisco IOS)
hostname SW-ACCESS-01
ip domain-name example.local
service password-encryption
enable secret <strong-secret>
username netadmin privilege 15 secret <strong-password>
banner motd ^Authorised access only. Activity is logged.^
! SSH only
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 15
login local
transport input ssh
exec-timeout 10 0
no ip http server
no ip http secure-server
! Unused ports
interface range GigabitEthernet0/20 - 24
switchport mode access
switchport access vlan 999
shutdown
! User access ports
interface range GigabitEthernet0/2 - 19
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict
! DHCP snooping
ip dhcp snooping
ip dhcp snooping vlan 10,20
interface GigabitEthernet0/1
ip dhcp snooping trust
! Logs and time
logging host 10.0.0.50
ntp server 10.0.0.1
end
copy running-config startup-configAdapt interface numbers, VLANs and server addresses to your network, and test in a lab (Packet Tracer, GNS3 or EVE-NG) before changing production equipment.
Key takeaways
- Secure management first: named accounts, SSH only, no Telnet or HTTP.
- Shut unused ports and park them in an unused VLAN.
- PortFast + BPDU guard, port security and DHCP snooping on access ports.
- Logs, NTP and backups make incidents recoverable.
Tracks your learning on this device only. See your progress on the learning paths.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.