Section 5.0: Security

5.1 Device Access Control

Device access is the first security layer — if an attacker can reach the CLI, everything else is moot. The exam covers line protection, local users, and centralized AAA via TACACS+ and RADIUS.

Lines and Local Users

Cisco IOS exposes four line types:

Minimum secure baseline — every device should have:

R1(config)# hostname R1
R1(config)# ip domain-name corp.local
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# ip ssh time-out 60
R1(config)# ip ssh authentication-retries 3

R1(config)# username admin privilege 15 algorithm-type scrypt secret StrongP@ss123

R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# exec-timeout 10 0                   ! 10 min idle logout
R1(config-line)# logging synchronous

R1(config)# line vty 0 15
R1(config-line)# transport input ssh                  ! No Telnet!
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0
R1(config-line)# access-class SSH-MGMT in              ! Restrict source IPs

R1(config)# service password-encryption                ! Type 7 (weak — legacy only)
R1(config)# enable algorithm-type scrypt secret EnableP@ss  ! Type 9 scrypt (strong)
R1(config)# no ip http server                          ! Disable HTTP (insecure)
R1(config)# ip http secure-server                      ! Enable HTTPS only

AAA — Authentication, Authorization, Accounting

AAA centralizes identity enforcement. An AAA server (Cisco ISE, FreeRADIUS, TACACS.net) holds credentials, policy, and audit records. The three A’s:

• Authentication: proves identity (username/password, certificate, token)
• Authorization: determines allowed commands/resources (privilege levels, command sets)
• Accounting: logs what the authenticated user did (session start/stop, commands executed, bytes sent)

AAA configuration skeleton (TACACS+ admin login, RADIUS for 802.1X):

R1(config)# aaa new-model

! Define server groups
R1(config)# tacacs server ISE-PRI
R1(config-server-tacacs)# address ipv4 10.1.1.50
R1(config-server-tacacs)# key 7 CiscoTAC123!
R1(config)# aaa group server tacacs+ TAC-GRP
R1(config-sg-tacacs+)# server name ISE-PRI

R1(config)# radius server ISE-RAD
R1(config-radius-server)# address ipv4 10.1.1.50 auth-port 1812 acct-port 1813
R1(config-radius-server)# key 7 CiscoRAD456!

! Method lists — "default" applies everywhere; named lists applied per-line
R1(config)# aaa authentication login default group TAC-GRP local
R1(config)# aaa authentication dot1x default group ISE-RAD
R1(config)# aaa authorization exec default group TAC-GRP local if-authenticated
R1(config)# aaa authorization commands 15 default group TAC-GRP local
R1(config)# aaa accounting exec default start-stop group TAC-GRP
R1(config)# aaa accounting commands 15 default start-stop group TAC-GRP

R1# test aaa group TAC-GRP admin CiscoP@ss new-code     ! Verify reachability

5.2 Infrastructure Security — ACLs & CoPP

Access Control Lists (ACLs)

ACLs are the oldest and simplest packet filter. They are ordered permit/deny statements evaluated top-down with an implicit deny all at the end. First match wins — order statements from most-specific to most-general.

Wildcard masks are the inverse of subnet masks: 0 = must match, 1 = don’t care. 0.0.0.255 = last octet varies (a /24), 0.0.0.0 = exact host, host X is shorthand for X 0.0.0.0. Named ACLs support resequence and per-line insertion — strongly preferred over numbered.

Placement rules:

• Standard: close to the destination (source IP is all you have — placing near source could block legitimate flows to other destinations)
• Extended: close to the source (drop traffic before it consumes bandwidth)
• Apply with ip access-group NAME {in|out} on an interface
• Apply with access-class NAME {in|out} on VTY lines

Control Plane Policing (CoPP)

A router has three traffic “planes”:

• Data plane — transit packets forwarded by CEF hardware (never hit CPU)
• Control plane — packets destined to the router itself (OSPF hellos, SSH, BGP, SNMP, ARP, ICMP to RP address)
• Management plane — admin sessions (SSH, HTTPS, NETCONF)

Without protection, a DoS flood of ICMP, ARP, or TCP-SYN to the router’s IP can saturate the CPU and crash routing. CoPP uses an MQC (Modular QoS CLI) policy applied to the control-plane interface to rate-limit different classes of punted traffic.

Typical CoPP class model (from Cisco’s recommended template):

5.3 Secure REST API Access

Modern network management uses REST APIs on Catalyst Center, Meraki Dashboard, Cisco SD-WAN (vManage), ISE, and IOS-XE RESTCONF. Securing these APIs matters as much as securing SSH.

Example — Catalyst Center X-Auth-Token flow:

# Step 1: Authenticate with Basic Auth to get a 1-hour token
$ curl -sk -X POST \
    -H "Content-Type: application/json" \
    -u "apiuser:ApiP@ss123" \
    https://catc.corp.local/dna/system/api/v1/auth/token
{"Token":"eyJ0eXAiOiJKV1QiLCJhbGci..."}

# Step 2: Use that token for subsequent calls — NEVER send credentials again
$ curl -sk \
    -H "X-Auth-Token: eyJ0eXAiOiJKV1Qi..." \
    -H "Accept: application/json" \
    https://catc.corp.local/dna/intent/api/v1/network-device

5.4 Wireless Security

Wireless security hinges on two questions: who is the client? (authentication) and how are frames encrypted? (cipher). ENCOR covers four authentication models plus the WPA2/WPA3 cipher evolution.

Authentication Models

The EAPoL 4-Way Handshake

After association and (optional) 802.1X authentication, WPA derives session keys through the 4-way handshake. The goal is to mutually confirm possession of the PMK and install fresh PTK (Pairwise Transient Key) and GTK (Group Transient Key) on both sides, all without ever sending the PMK on the air.

WPA2 vs WPA3

Common EAP Methods

5.5 Network Security Design Components

Firewalls, NGFW, IPS

IOS Zone-Based Firewall (ZBF)

ZBF replaces the older CBAC (Context-Based Access Control) ip inspect model. Interfaces are assigned to zones; traffic between zones is controlled by zone-pair policies that reference class-maps and policy-maps.

R1(config)# zone security INSIDE
R1(config)# zone security OUTSIDE
R1(config)# zone security DMZ

R1(config)# interface GigabitEthernet0/0
R1(config-if)# zone-member security INSIDE
R1(config)# interface GigabitEthernet0/1
R1(config-if)# zone-member security OUTSIDE

! Classify what can go inside→outside
R1(config)# class-map type inspect match-any WEB-AND-DNS
R1(config-cmap)# match protocol http
R1(config-cmap)# match protocol https
R1(config-cmap)# match protocol dns

R1(config)# policy-map type inspect INSIDE-TO-OUTSIDE
R1(config-pmap)# class type inspect WEB-AND-DNS
R1(config-pmap-c)# inspect                          ! Stateful — allow return traffic
R1(config-pmap)# class class-default
R1(config-pmap-c)# drop log

R1(config)# zone-pair security IN-OUT source INSIDE destination OUTSIDE
R1(config-sec-zone-pair)# service-policy type inspect INSIDE-TO-OUTSIDE

Cisco TrustSec (SGT) and MACsec

Cisco TrustSec decouples access policy from IP address by classifying traffic with a Security Group Tag (SGT) — a 16-bit label assigned at the network edge (usually by ISE after 802.1X auth). SGTs ride with the frame to the enforcement point, where SGACLs (matrix-based access lists) control who can talk to whom by group, not subnet.

MACsec (IEEE 802.1AE) provides hop-by-hop Layer 2 encryption on Ethernet links. Every frame between two MACsec peers is encrypted with AES-GCM 128 or 256. Used for switch-to-switch trunk encryption, campus uplinks, and data-center fabric interconnect. Key agreement uses MKA (MACsec Key Agreement, 802.1X) or SAP (Cisco TrustSec proprietary).

Endpoint Security, Cisco Umbrella, SecureX

Defense in depth requires more than network controls. Key cloud-delivered layers:

• Cisco Secure Endpoint (formerly AMP for Endpoints) — host-based EDR: continuous file trajectory, retrospective detection, integration with threat grid sandboxing
• Cisco Umbrella — DNS-layer + Secure Web Gateway + CASB. Blocks connections to malicious domains at resolution time, before an IP is even contacted. Fast way to stop phishing, C2, crypto-mining
• Cisco Secure Email — inbound SPAM/phishing filtering, outbound DLP, BEC protection
• Cisco Duo — MFA (multi-factor authentication) for VPN, admin SSH, web apps. Push, OTP, FIDO2 WebAuthn
• Cisco SecureX / XDR — correlation platform: pulls telemetry from ISE, Umbrella, Secure Endpoint, Secure Firewall, Stealthwatch into one investigation view
• MFA everywhere — Duo on VPN and SSH via RADIUS Challenge-Response or SAML SSO on admin portals

Hands-On Labs

R1(config)# hostname CORE-R1
R1(config)# ip domain-name corp.local
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# ip ssh time-out 60
R1(config)# ip ssh authentication-retries 3
R1(config)# no ip http server
R1(config)# ip http secure-server

R1(config)# username admin privilege 15 algorithm-type scrypt secret StrongP@ss123
R1(config)# enable algorithm-type scrypt secret EnableP@ss

R1(config)# ip access-list standard SSH-MGMT
R1(config-std-nacl)# permit 10.99.0.0 0.0.0.255
R1(config-std-nacl)# deny any log

R1(config)# line vty 0 15
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0
R1(config-line)# access-class SSH-MGMT in
R1(config-line)# logging synchronous

R1# show ip ssh
R1# show ssh                                   ! Active sessions
R1# show users

SW1(config)# aaa new-model

SW1(config)# tacacs server ISE-TAC
SW1(config-server-tacacs)# address ipv4 10.1.1.50
SW1(config-server-tacacs)# key CiscoTAC123!
SW1(config-server-tacacs)# single-connection

SW1(config)# aaa group server tacacs+ TAC-GRP
SW1(config-sg-tacacs+)# server name ISE-TAC

SW1(config)# radius server ISE-RAD
SW1(config-radius-server)# address ipv4 10.1.1.50 auth-port 1812 acct-port 1813
SW1(config-radius-server)# key CiscoRAD456!

SW1(config)# aaa authentication login default group TAC-GRP local
SW1(config)# aaa authorization exec default group TAC-GRP local if-authenticated
SW1(config)# aaa authorization commands 15 default group TAC-GRP local
SW1(config)# aaa accounting exec default start-stop group TAC-GRP
SW1(config)# aaa accounting commands 15 default start-stop group TAC-GRP

! Keep this local user as emergency break-glass account
SW1(config)# username breakglass privilege 15 algorithm-type scrypt secret BgP@ss789!

SW1(config)# aaa authentication dot1x default group radius
SW1(config)# dot1x system-auth-control

SW1(config)# interface GigabitEthernet0/10
SW1(config-if)# switchport mode access
SW1(config-if)# authentication port-control auto
SW1(config-if)# authentication host-mode multi-auth
SW1(config-if)# dot1x pae authenticator
SW1(config-if)# mab                                  ! MAC auth bypass for non-dot1x devices

SW1# test aaa group TAC-GRP admin CiscoP@ss new-code
SW1# show authentication sessions interface Gi0/10 details

R1(config)# ip access-list extended COPP-CRITICAL
R1(config-ext-nacl)# permit ospf any any
R1(config-ext-nacl)# permit tcp any any eq bgp
R1(config-ext-nacl)# permit tcp any eq bgp any

R1(config)# ip access-list extended COPP-MGMT
R1(config-ext-nacl)# permit tcp 10.99.0.0 0.0.0.255 any eq 22
R1(config-ext-nacl)# permit udp any any eq snmp
R1(config-ext-nacl)# permit udp any any eq ntp

R1(config)# ip access-list extended COPP-ICMP
R1(config-ext-nacl)# permit icmp any any echo
R1(config-ext-nacl)# permit icmp any any echo-reply
R1(config-ext-nacl)# permit icmp any any ttl-exceeded
R1(config-ext-nacl)# permit icmp any any unreachable

R1(config)# class-map match-any CRITICAL
R1(config-cmap)# match access-group name COPP-CRITICAL
R1(config)# class-map match-any MGMT
R1(config-cmap)# match access-group name COPP-MGMT
R1(config)# class-map match-any ICMP
R1(config-cmap)# match access-group name COPP-ICMP

R1(config)# policy-map COPP-POLICY
R1(config-pmap)# class CRITICAL
R1(config-pmap-c)# police 4000000 conform-action transmit exceed-action transmit
R1(config-pmap)# class MGMT
R1(config-pmap-c)# police 2000000 conform-action transmit exceed-action drop
R1(config-pmap)# class ICMP
R1(config-pmap-c)# police 500000 conform-action transmit exceed-action drop
R1(config-pmap)# class class-default
R1(config-pmap-c)# police 1000000 conform-action transmit exceed-action drop

R1(config)# control-plane
R1(config-cp)# service-policy input COPP-POLICY

R1# show policy-map control-plane input     ! Hit + drop counters per class

R1(config)# zone security INSIDE
R1(config)# zone security OUTSIDE
R1(config)# zone security DMZ

R1(config)# interface GigabitEthernet0/0
R1(config-if)# description LAN
R1(config-if)# zone-member security INSIDE
R1(config)# interface GigabitEthernet0/1
R1(config-if)# description Internet
R1(config-if)# zone-member security OUTSIDE
R1(config)# interface GigabitEthernet0/2
R1(config-if)# description DMZ
R1(config-if)# zone-member security DMZ

R1(config)# class-map type inspect match-any USER-TRAFFIC
R1(config-cmap)# match protocol http
R1(config-cmap)# match protocol https
R1(config-cmap)# match protocol dns
R1(config-cmap)# match protocol icmp

R1(config)# policy-map type inspect INSIDE-TO-OUTSIDE
R1(config-pmap)# class type inspect USER-TRAFFIC
R1(config-pmap-c)# inspect
R1(config-pmap)# class class-default
R1(config-pmap-c)# drop log

R1(config)# zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
R1(config-sec-zone-pair)# service-policy type inspect INSIDE-TO-OUTSIDE

R1# show zone-pair security
R1# show policy-map type inspect zone-pair IN-TO-OUT

WLC(config)# aaa new-model
WLC(config)# radius server ISE-1
WLC(config-radius-server)# address ipv4 10.1.1.50 auth-port 1812 acct-port 1813
WLC(config-radius-server)# key CiscoRAD456!

WLC(config)# aaa group server radius ISE-GRP
WLC(config-sg-radius)# server name ISE-1

WLC(config)# aaa authentication dot1x CORP-AUTH group ISE-GRP
WLC(config)# aaa authorization network CORP-AUTH group ISE-GRP
WLC(config)# aaa accounting identity CORP-AUTH start-stop group ISE-GRP

WLC(config)# wlan CORP-WIFI 1 CORP-WIFI
WLC(config-wlan)# no security wpa wpa2
WLC(config-wlan)# security wpa wpa3
WLC(config-wlan)# security wpa akm dot1x-sha256
WLC(config-wlan)# security wpa wpa3 ciphers aes
WLC(config-wlan)# security dot1x authentication-list CORP-AUTH
WLC(config-wlan)# security pmf mandatory                 ! Protected Management Frames
WLC(config-wlan)# no shutdown

WLC# show wlan name CORP-WIFI
WLC# show wireless client summary

SW1(config)# aaa new-model
SW1(config)# aaa authentication dot1x default group radius
SW1(config)# aaa authorization network default group radius
SW1(config)# aaa accounting dot1x default start-stop group radius

SW1(config)# cts authorization list default
SW1(config)# radius-server host 10.1.1.50 pac key CiscoRAD456!

SW1(config)# cts credentials id SW1 password CtsP@ss789
SW1# show cts pacs                                   ! Verify PAC provisioned
SW1# show cts environment-data                       ! SGT→name mappings

SW1(config)# interface GigabitEthernet1/0/48
SW1(config-if)# cts manual
SW1(config-if-cts-manual)# policy static sgt 2 trusted
SW1(config-if-cts-manual)# propagate sgt

! SXP peer — propagate IP-SGT bindings to upstream device that does not support inline
SW1(config)# cts sxp enable
SW1(config)# cts sxp default password CtsSxpP@ss
SW1(config)# cts sxp connection peer 10.1.2.1 password default mode local speaker

SW1# show cts sxp connections
SW1# show cts role-based sgt-map all

SW2(config)# cts role-based enforcement
SW2(config)# cts role-based enforcement vlan-list 10

SW2(config)# ip access-list role-based GUEST-TO-FINANCE
SW2(config-rb-acl)# permit tcp dst eq 443
SW2(config-rb-acl)# deny ip

SW2(config)# cts role-based permissions from 30 to 100 GUEST-TO-FINANCE

SW2# show cts role-based permissions
SW2# show cts role-based counters

SW1(config)# key chain MACSEC-KC macsec
SW1(config-keychain-macsec)# key 01
SW1(config-keychain-macsec-key)# cryptographic-algorithm aes-256-cmac
SW1(config-keychain-macsec-key)# key-string ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789
SW1(config-keychain-macsec-key)# lifetime local 00:00:00 Jan 1 2026 infinite

SW1(config)# mka policy STRONG-MKA
SW1(config-mka-policy)# key-server priority 100
SW1(config-mka-policy)# macsec-cipher-suite gcm-aes-256

SW1(config)# interface TenGigabitEthernet1/1/1
SW1(config-if)# macsec network-link
SW1(config-if)# mka policy STRONG-MKA
SW1(config-if)# mka pre-shared-key key-chain MACSEC-KC

SW1# show macsec interface TenGigabitEthernet1/1/1
SW1# show mka sessions detail