{"id":3450,"date":"2026-10-28T06:23:19","date_gmt":"2026-10-28T13:23:19","guid":{"rendered":"https:\/\/cyber.mag212.com\/tools\/cisco-config-checker\/"},"modified":"2026-10-28T09:02:08","modified_gmt":"2026-10-28T16:02:08","slug":"cisco-config-checker","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/tools\/cisco-config-checker\/","title":{"rendered":"V\u00e9rificateur de renforcement de la configuration Cisco"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-cisco-config-checker\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style>\n<section class=\"hero\"><div class=\"kick\">MAG212 CYBER \u00b7 Tools<\/div><h2>Cisco config <span>hardening checker.<\/span><\/h2><p>Paste a Cisco IOS or IOS XE running-config from a router or switch. Get a security score, every weakness ranked by severity, and the exact commands to fix it \u2014 without the config ever leaving your browser.<\/p><div class=\"toc\"><a href=\"#m212cc-tool\">Check a config<\/a><a href=\"#m212cc-about\">What it checks<\/a><\/div><\/section>\n<style>.m212x textarea{width:100%;min-height:240px;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font:13px\/1.5 \"JetBrains Mono\",\"DejaVu Sans Mono\",monospace}\n.m212x .cc-res{display:none;margin-top:18px}\n.m212x .cc-score{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:#060a0f;border:1px solid var(--line2);border-radius:12px;padding:18px 20px;margin-bottom:14px}\n.m212x .cc-big{font-size:52px;font-weight:800;line-height:1;min-width:96px}\n.m212x .cc-f{border:1px solid var(--line2);border-left-width:4px;border-radius:10px;padding:12px 14px;margin-bottom:10px;background:var(--panel2)}\n.m212x .cc-f.h{border-left-color:var(--red)}.m212x .cc-f.m{border-left-color:var(--amber)}.m212x .cc-f.l{border-left-color:var(--cyan)}\n.m212x .cc-f b{display:block;margin-bottom:4px}.m212x .cc-f p{margin:0 0 6px;color:#cdd8e2;font-size:14.5px}\n.m212x .cc-f pre{margin:6px 0 0;font-size:12.5px;white-space:pre-wrap}\n.m212x .cc-f .ev{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",monospace;font-size:12.5px;color:var(--mute);word-break:break-all}\n.m212x details{margin-top:10px}.m212x summary{cursor:pointer;font-weight:700}\n.m212x .cc-pass{font-size:14px;color:#cdd8e2;padding:5px 0;border-bottom:1px solid var(--line)}<\/style>\n<section class=\"sec\" id=\"m212cc-tool\"><h3>Check a config<\/h3>\n<p class=\"lead\">Run <code>show running-config<\/code> and paste the output. Remove real passwords, keys and public IP addresses first if you&#8217;re unsure \u2014 the checker only needs the structure.<\/p>\n<textarea id=\"m212ccin\" aria-label=\"Cisco running configuration\" spellcheck=\"false\" placeholder=\"hostname SW1&#10;!&#10;enable secret 9 ...&#10;...\"><\/textarea>\n<div style=\"display:flex;gap:8px;flex-wrap:wrap;margin-top:10px\"><button type=\"button\" class=\"pri\" id=\"m212ccgo\">Check config<\/button><button type=\"button\" id=\"m212ccex\">Load a weak sample config<\/button><button type=\"button\" id=\"m212ccclr\">Clear<\/button><\/div>\n<p class=\"small\" style=\"margin-top:10px\">\ud83d\udd12 Your config is analysed only in your browser. It is never uploaded, sent or stored.<\/p>\n<div class=\"cc-res\" id=\"m212ccres\">\n<div class=\"cc-score\"><div class=\"cc-big\" id=\"m212ccsc\"><\/div><div><div id=\"m212ccgr\" class=\"pill p-n\" style=\"font-size:14px\"><\/div><div class=\"small\" id=\"m212ccsum\" style=\"margin-top:8px\"><\/div><\/div><\/div>\n<div id=\"m212ccf\"><\/div>\n<details><summary id=\"m212ccpsum\">Checks passed<\/summary><div id=\"m212ccp\" style=\"margin-top:8px\"><\/div><\/details>\n<div class=\"callout\" style=\"margin-top:14px\"><b>Automated checks are a starting point.<\/b> They read the configuration text only. They can&#8217;t see your software version, known CVEs, physical security or how the device is reached. Test every change in a maintenance window, and keep a console or out-of-band path open before changing VTY or AAA settings.<\/div>\n<\/div><\/section>\n<section class=\"sec\" id=\"m212cc-about\"><h3>What it checks<\/h3><div class=\"grid\">\n<div class=\"card\"><b>\ud83d\udd11 Passwords &amp; accounts<\/b><p>enable password vs secret, weak type 5\/7 hashes, plain-text usernames, AAA, login brute-force protection.<\/p><\/div>\n<div class=\"card\"><b>\ud83d\udda5\ufe0f Management access<\/b><p>Telnet vs SSH, SSH v2, VTY access-class, exec timeouts, HTTP\/HTTPS servers (CVE-2023-20198), banners.<\/p><\/div>\n<div class=\"card\"><b>\ud83d\udce1 Services &amp; SNMP<\/b><p>Default SNMP communities, SNMPv3, small servers, finger, PAD, source routing, CDP.<\/p><\/div>\n<div class=\"card\"><b>\ud83d\udcdc Logging &amp; time<\/b><p>Remote syslog, timestamps, NTP \u2014 the evidence you need during an incident.<\/p><\/div>\n<div class=\"card\"><b>\ud83d\udd0c Switch ports<\/b><p>BPDU Guard, trunk native VLAN, DTP negotiation, allowed VLANs, unused ports left enabled, DHCP snooping and DAI.<\/p><\/div>\n<div class=\"card\"><b>\ud83d\udd01 Control plane<\/b><p>OSPF, EIGRP and HSRP authentication \u2014 tie-ins to our <a href=\"\/learn\/ospf-cheat-sheet\/\">OSPF<\/a>, <a href=\"\/learn\/eigrp-cheat-sheet\/\">EIGRP<\/a> and <a href=\"\/learn\/first-hop-redundancy\/\">FHRP<\/a> guides.<\/p><\/div>\n<\/div><p class=\"small\" style=\"margin-top:12px\">Based on Cisco&#8217;s IOS XE hardening guidance and common audit baselines such as the CIS Cisco IOS benchmark. Need a full audit of your network? <a href=\"\/services\/\">Talk to MAG212 CYBER<\/a>.<\/p><\/section>\n<p class=\"small noprint\" style=\"margin:-8px 0 18px;padding:0 4px\">\u2696\ufe0f For education and use on systems you own or are authorised to test. Results are automated guidance, not a professional audit. See our <a href=\"\/terms-of-use\/\">terms of use<\/a> and <a href=\"\/privacy-policy\/\">privacy policy<\/a>.<\/p>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, plus security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<script>\n(function(){\nvar root=document.getElementById('m212-cisco-config-checker'); if(!root) return;\nvar SAMPLE=['hostname BRANCH-SW1','!','enable password cisco123','!','username admin password 0 Admin2024','!','no aaa new-model','ip domain name branch.example.com','!','interface GigabitEthernet1\/0\/1',' description Uplink to core',' switchport mode trunk','!','interface GigabitEthernet1\/0\/2',' switchport mode access',' switchport access vlan 10',' spanning-tree portfast','!','interface GigabitEthernet1\/0\/3',' switchport mode access',' switchport access vlan 20','!','interface GigabitEthernet1\/0\/4','!','interface Vlan10',' ip address 10.10.10.2 255.255.255.0',' standby 10 ip 10.10.10.1',' standby 10 priority 110','!','router ospf 1',' network 10.10.10.0 0.0.0.255 area 0','!','ip http server','ip http secure-server','!','snmp-server community public RO','snmp-server community private RW','!','line con 0',' logging synchronous','line vty 0 4',' password cisco',' login',' transport input all',' exec-timeout 0 0','line vty 5 15',' login','!','end'].join('\\n');\nfunction parse(t){\n  var lines=String(t).replace(\/\\r\/g,'').split('\\n'), g=[], blocks=[], cur=null;\n  lines.forEach(function(l){ if(\/^\\s*!\/.test(l)) { return; } if(\/^\\s*$\/.test(l)) return; if(\/^\\S\/.test(l)){ var s=l.trim(); g.push(s); cur={head:s,kids:[]}; blocks.push(cur); } else if(cur){ cur.kids.push(l.trim()); } });\n  return {g:g,blocks:blocks};\n}\nfunction has(arr,re){ return arr.some(function(x){ return re.test(x); }); }\nfunction find(arr,re){ return arr.filter(function(x){ return re.test(x); }); }\nfunction check(text){\n  var c=parse(text), g=c.g, B=c.blocks, F=[], OK=[];\n  if(!g.length) return null;\n  function bad(sev,title,why,fix,ev){ F.push({sev:sev,title:title,why:why,fix:fix,ev:ev||''}); }\n  function ok(t){ OK.push(t); }\n  var ifs=B.filter(function(b){ return \/^interface\\s\/i.test(b.head); });\n  var vtys=B.filter(function(b){ return \/^line\\s+vty\/i.test(b.head); });\n  var isSwitch=ifs.some(function(b){ return has(b.kids,\/^switchport\/); });\n  var ep=find(g,\/^enable password\/);\n  if(ep.length) bad('h','\"enable password\" is used','It is stored in clear text or reversible type 7. Anyone who sees the config gets privileged access.','no enable password\\nenable algorithm-type scrypt secret <strong-password>',ep[0].replace(\/(password)\\s+(\\d\\s+)?\\S+\/,'$1 ******'));\n  var es=find(g,\/^enable (algorithm-type \\S+ )?secret\/);\n  if(!es.length){ if(!ep.length) bad('h','No enable secret configured','Privileged EXEC mode is unprotected or relies on other methods.','enable algorithm-type scrypt secret <strong-password>'); }\n  else if(has(es,\/^enable secret 5 \/)) bad('m','Enable secret uses MD5 (type 5)','Type 5 hashes can be cracked offline. Type 9 (scrypt) or 8 (PBKDF2-SHA256) are recommended.','enable algorithm-type scrypt secret <strong-password>','enable secret 5 ******');\n  else ok('Enable secret uses a strong hash');\n  var up=find(g,\/^username\\s+\\S+.*\\spassword\\s\/);\n  if(up.length) bad('h','Local users with \"password\" instead of \"secret\"','Type 0 or type 7 passwords are clear text or trivially reversible.','username <name> privilege 15 algorithm-type scrypt secret <strong-password>',up.length+' account(s), e.g. '+up[0].replace(\/(password)\\s+(\\d\\s+)?\\S+\/,'$1 ******'));\n  else if(has(g,\/^username\\s+\\S+.*\\ssecret 5 \/)) bad('m','Local users hashed with MD5 (type 5)','Upgrade to type 9 (scrypt).','username <name> algorithm-type scrypt secret <strong-password>');\n  else if(has(g,\/^username\\s\/)) ok('Local user accounts use secrets');\n  if(has(g,\/password 7 |^line|password 0 \/)) if(!has(g,\/^service password-encryption\/)) if(has(g.concat([].concat.apply([],B.map(function(b){ return b.kids; }))),\/password\/)) bad('l','\"service password-encryption\" is missing','It only applies weak type 7 obfuscation, but it stops passwords being readable over someone\\'s shoulder.','service password-encryption');\n  if(has(g,\/^aaa new-model\/)) ok('AAA is enabled'); else bad('m','AAA is not enabled','Without AAA you can\\'t use per-user authentication, TACACS+\/RADIUS or command accounting.','aaa new-model\\naaa authentication login default local\\naaa authorization exec default local');\n  if(has(g,\/^login block-for\/)) ok('Login brute-force protection (login block-for)'); else bad('l','No login brute-force protection','Repeated password guessing against SSH is not slowed down.','login block-for 120 attempts 5 within 60\\nlogin on-failure log');\n  if(has(g,\/^ip ssh version 2\/)) ok('SSH version 2 enforced'); else bad('m','SSH version 2 is not enforced','SSHv1 has known cryptographic weaknesses. Some releases accept v1 unless v2 is set.','ip ssh version 2\\ncrypto key generate rsa modulus 3072');\n  vtys.forEach(function(v){\n    var ti=find(v.kids,\/^transport input\/);\n    if(!ti.length) bad('m',v.head+': transport input not set','The allowed protocols depend on the platform default, which on older releases includes Telnet.','transport input ssh',v.head);\n    else if(\/telnet|\\ball\\b\/.test(ti[0])) bad('h',v.head+': Telnet is allowed','Telnet sends usernames, passwords and every command in clear text.','line '+v.head.replace(\/^line\\s+\/,'')+'\\n transport input ssh',ti[0]);\n    else ok(v.head+': SSH only');\n    if(!has(v.kids,\/^access-class\/)) bad('m',v.head+': no access-class','Anyone who can reach the device can try to log in.','ip access-list standard MGMT\\n permit 10.99.0.0 0.0.0.255\\nline '+v.head.replace(\/^line\\s+\/,'')+'\\n access-class MGMT in',v.head); else ok(v.head+': access-class applied');\n    if(has(v.kids,\/^exec-timeout 0( 0)?$\/)) bad('m',v.head+': sessions never time out','Abandoned admin sessions stay open indefinitely.','line '+v.head.replace(\/^line\\s+\/,'')+'\\n exec-timeout 10 0',v.kids.filter(function(k){ return \/^exec-timeout\/.test(k); })[0]);\n    if(has(v.kids,\/^password\/)) if(!has(v.kids,\/^login (local|authentication)\/)) bad('m',v.head+': shared line password','Everyone uses the same password and there is no record of who logged in.','line '+v.head.replace(\/^line\\s+\/,'')+'\\n no password\\n login local',v.head);\n  });\n  if(has(g,\/^ip http server\/)) bad('h','HTTP web server is enabled','The IOS XE web UI was mass-exploited in 2023 (CVE-2023-20198). Disable it unless you need it.','no ip http server',' ip http server');\n  else ok('HTTP server disabled');\n  if(has(g,\/^ip http secure-server\/)) bad('m','HTTPS web server is enabled','Also affected by CVE-2023-20198 on unpatched IOS XE. If you need it, restrict it with an ACL and patch.','no ip http secure-server\\n! or: ip http access-class ipv4 MGMT','ip http secure-server');\n  if(has(g,\/^banner (motd|login|exec)\/)) ok('Login banner configured'); else bad('l','No login banner','A warning banner supports legal action against unauthorised access in many jurisdictions.','banner login ^\\nAuthorised access only. Activity is monitored and logged.\\n^');\n  var sc=find(g,\/^snmp-server community\\s\/);\n  sc.forEach(function(s){ var p=s.split(\/\\s+\/), name=p[2]||'', rest=p.slice(3);\n    if(\/^(public|private|cisco|secret|admin)$\/i.test(name)) bad('h','Default\/guessable SNMP community \"'+name+'\"','Default communities are the first thing attackers try. '+(\/RW\/i.test(s)?'With RW access an attacker can change the configuration.':''),'no snmp-server community '+name+'\\n! use SNMPv3:\\nsnmp-server group NMS v3 priv\\nsnmp-server user nms NMS v3 auth sha <auth-pass> priv aes 128 <priv-pass>',s.replace(name,'******'));\n    else if(\/RW\/i.test(s)) bad('h','SNMP read-write community','SNMPv2c RW lets anyone who knows the string change the config, over an unencrypted protocol.','no snmp-server community <string> RW',s.replace(name,'******'));\n    else if(rest.length<2) bad('m','SNMP community without an ACL','Any host can query the device.','snmp-server community <string> RO SNMP-ACL',s.replace(name,'******'));\n  });\n  if(sc.length) bad('l','SNMPv1\/v2c in use','Community strings travel in clear text. SNMPv3 with auth and priv encrypts and authenticates.','snmp-server group NMS v3 priv\\nsnmp-server user nms NMS v3 auth sha <auth-pass> priv aes 128 <priv-pass>'); else ok('No SNMPv1\/v2c communities');\n  var svc=find(g,\/^(service (tcp|udp)-small-servers|service finger|ip finger|ip bootp server|service config)$\/);\n  if(svc.length) bad('m','Legacy services enabled','Small servers, finger, BOOTP and network config loading add attack surface and are rarely needed.',svc.map(function(s){ return 'no '+s; }).join('\\n'),svc.join(', '));\n  if(!has(g,\/^no service pad\/)) bad('l','\"no service pad\" missing','X.25 PAD is unused on modern networks.','no service pad'); else ok('PAD service disabled');\n  if(!has(g,\/^no ip source-route\/)) bad('l','IP source routing not disabled','Source-routed packets can bypass routing and filtering decisions.','no ip source-route'); else ok('Source routing disabled');\n  if(!has(g,\/^no cdp run\/)) bad('l','CDP is running globally','CDP advertises model, software version and addresses to anyone on the link. Keep it on infrastructure links, disable it on user and internet-facing ports.','! per edge interface:\\n no cdp enable\\n! or globally:\\nno cdp run');\n  if(has(g,\/^service timestamps log datetime\/)) ok('Log timestamps'); else bad('l','Log timestamps not set','Without accurate timestamps you can\\'t correlate events during an incident.','service timestamps log datetime msec localtime show-timezone\\nservice timestamps debug datetime msec localtime show-timezone');\n  if(has(g,\/^logging (host|server|\\d)\/)) ok('Remote syslog configured'); else bad('m','No remote syslog server','Logs stored only on the device are lost on reload and can be erased by an attacker.','logging host 10.99.0.20\\nlogging trap informational');\n  if(has(g,\/^ntp server\/)) ok('NTP configured'); else bad('l','No NTP server','Device clocks drift, which breaks log correlation and certificate checks.','ntp server 10.99.0.10');\n  if(isSwitch){\n    var acc=ifs.filter(function(b){ return has(b.kids,\/^switchport mode access\/); }), gbg=has(g,\/^spanning-tree portfast (edge )?bpduguard default\/);\n    var nobg=acc.filter(function(b){ return !has(b.kids,\/^spanning-tree bpduguard enable\/); });\n    if(!gbg) if(nobg.length) bad('m','Access ports without BPDU Guard','A user plugging in a switch can create a loop or take over the spanning tree.','spanning-tree portfast edge bpduguard default\\n! or per port:\\ninterface <port>\\n spanning-tree portfast\\n spanning-tree bpduguard enable',nobg.length+' port(s): '+nobg.slice(0,5).map(function(b){ return b.head.replace(\/^interface\\s+\/,''); }).join(', '));\n    if(gbg) ok('BPDU Guard default on PortFast ports');\n    var tr=ifs.filter(function(b){ return has(b.kids,\/^switchport mode trunk\/); });\n    var tnn=tr.filter(function(b){ return !has(b.kids,\/^switchport trunk native vlan\/); });\n    if(tnn.length) bad('m','Trunks using native VLAN 1','VLAN 1 as native VLAN enables VLAN-hopping by double tagging. Use an unused dedicated native VLAN.','interface <trunk>\\n switchport trunk native vlan 999',tnn.map(function(b){ return b.head.replace(\/^interface\\s+\/,''); }).join(', '));\n    var tdtp=tr.filter(function(b){ return !has(b.kids,\/^switchport nonegotiate\/); });\n    if(tdtp.length) bad('l','DTP negotiation left on trunks','Dynamic Trunking Protocol can be abused to negotiate a trunk from a user port.','interface <trunk>\\n switchport nonegotiate',tdtp.map(function(b){ return b.head.replace(\/^interface\\s+\/,''); }).join(', '));\n    var tall=tr.filter(function(b){ return !has(b.kids,\/^switchport trunk allowed vlan\/); });\n    if(tall.length) bad('l','Trunks allow all VLANs','Prune trunks to the VLANs they need to limit broadcast and attack scope.','interface <trunk>\\n switchport trunk allowed vlan 10,20,99',tall.map(function(b){ return b.head.replace(\/^interface\\s+\/,''); }).join(', '));\n    var dyn=ifs.filter(function(b){ return \/Ethernet\/i.test(b.head); }).filter(function(b){ return !has(b.kids,\/^switchport mode\/); }).filter(function(b){ return !has(b.kids,\/^(no switchport|ip address|channel-group)\/); });\n    var unused=dyn.filter(function(b){ return !has(b.kids,\/^shutdown\/); });\n    if(unused.length) bad('m','Ports with no mode set and not shut down','They default to dynamic trunking on many platforms and are open to anyone who plugs in.','interface range <ports>\\n switchport mode access\\n switchport access vlan 998\\n shutdown',unused.length+' port(s): '+unused.slice(0,5).map(function(b){ return b.head.replace(\/^interface\\s+\/,''); }).join(', '));\n    if(has(g,\/^ip dhcp snooping$\/)) ok('DHCP snooping enabled'); else bad('l','DHCP snooping not enabled','Rogue DHCP servers can hand out a malicious gateway or DNS server.','ip dhcp snooping\\nip dhcp snooping vlan 10,20\\ninterface <uplink>\\n ip dhcp snooping trust');\n    if(has(g,\/^ip arp inspection vlan\/)) ok('Dynamic ARP Inspection enabled'); else bad('l','Dynamic ARP Inspection not enabled','Without DAI, ARP spoofing lets an attacker intercept traffic on the VLAN (requires DHCP snooping).','ip arp inspection vlan 10,20\\ninterface <uplink>\\n ip arp inspection trust');\n  }\n  var hsrp=ifs.filter(function(b){ return has(b.kids,\/^standby \\d+ ip\/); }).filter(function(b){ return !has(b.kids,\/^standby \\d+ authentication\/); });\n  if(hsrp.length) bad('l','HSRP without authentication','A host on the VLAN can send higher-priority hellos and take over the gateway.','interface <svi>\\n standby <grp> authentication md5 key-chain HSRP-KEYS',hsrp.map(function(b){ return b.head.replace(\/^interface\\s+\/,''); }).join(', '));\n  if(has(g,\/^router ospf\/)){ var all=[].concat.apply([],B.map(function(b){ return b.kids; })); if(has(all,\/authentication|ospf authentication\/)) ok('OSPF authentication present'); else bad('l','OSPF without authentication','A rogue router can form an adjacency and inject routes.','key chain OSPF-KEYS\\n key 1\\n  key-string <secret>\\n  cryptographic-algorithm hmac-sha-256\\ninterface <if>\\n ip ospf authentication key-chain OSPF-KEYS'); }\n  if(has(g,\/^router eigrp\/)){ var all2=[].concat.apply([],B.map(function(b){ return b.kids; })); if(has(all2,\/authentication\/)) ok('EIGRP authentication present'); else bad('l','EIGRP without authentication','A rogue router can peer and inject routes.','! named mode:\\nrouter eigrp CORP\\n address-family ipv4 unicast autonomous-system 100\\n  af-interface default\\n   authentication mode hmac-sha-256 <secret>'); }\n  var W={h:15,m:7,l:3}, score=100; F.forEach(function(f){ score-=W[f.sev]; }); if(score<0) score=0;\n  F.sort(function(a,b){ var o={h:0,m:1,l:2}; return o[a.sev]-o[b.sev]; });\n  return {score:score,F:F,OK:OK,isSwitch:isSwitch,lines:g.length};\n}\nfunction esc(t){ var d=document.createElement('div'); d.textContent=t==null?'':String(t); return d.innerHTML; }\nfunction run(){\n  var r=check(document.getElementById('m212ccin').value), box=document.getElementById('m212ccres');\n  if(!r){ box.style.display='none'; return; } box.style.display='block';\n  var sc=document.getElementById('m212ccsc'), gr=document.getElementById('m212ccgr'), g;\n  if(r.score>=90) g=['Strong','p-l']; else if(r.score>=70) g=['Fair','p-m']; else if(r.score>=40) g=['Weak','p-h']; else g=['Critical gaps','p-c'];\n  sc.textContent=r.score; gr.className='pill '+g[1]; gr.textContent=g[0]; sc.style.color=getComputedStyle(gr).color;\n  var n={h:0,m:0,l:0}; r.F.forEach(function(f){ n[f.sev]++; });\n  document.getElementById('m212ccsum').textContent=n.h+' high \u00b7 '+n.m+' medium \u00b7 '+n.l+' low \u00b7 '+r.OK.length+' passed \u00b7 '+(r.isSwitch?'switch':'router')+' config detected';\n  var L={h:'HIGH',m:'MEDIUM',l:'LOW'};\n  document.getElementById('m212ccf').innerHTML=r.F.map(function(f){ return '<div class=\"cc-f '+f.sev+'\"><b>'+L[f.sev]+' \u00b7 '+esc(f.title)+'<\/b><p>'+esc(f.why)+'<\/p>'+(f.ev?'<div class=\"ev\">Found: '+esc(f.ev)+'<\/div>':'')+'<pre>'+esc(f.fix)+'<\/pre><\/div>'; }).join('') || '<p>No issues found by the automated checks. \ud83c\udf89<\/p>';\n  document.getElementById('m212ccpsum').textContent='Checks passed ('+r.OK.length+')';\n  document.getElementById('m212ccp').innerHTML=r.OK.map(function(o){ return '<div class=\"cc-pass\">\u2705 '+esc(o)+'<\/div>'; }).join('');\n}\ndocument.getElementById('m212ccgo').addEventListener('click',run);\ndocument.getElementById('m212ccex').addEventListener('click',function(){ document.getElementById('m212ccin').value=SAMPLE; run(); });\ndocument.getElementById('m212ccclr').addEventListener('click',function(){ document.getElementById('m212ccin').value=''; document.getElementById('m212ccres').style.display='none'; });\nwindow.m212cc=check;\n})();\n<\/script>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>MAG212 CYBER \u00b7 Tools Cisco config hardening checker. Paste a Cisco IOS or IOS XE running-config from a router or switch. Get a security score, every weakness ranked by severity, and the exact commands to fix it \u2014 without the config ever leaving your browser. Check a configWhat it checks Check a config Run show [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3386,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3450","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3450"}],"version-history":[{"count":1,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3450\/revisions"}],"predecessor-version":[{"id":3468,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3450\/revisions\/3468"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3386"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}