Best Practices: How should you be configuring your network switches?

Networks today are used for almost everything you do; whether it be supporting your business, providing communication, or delivering entertainment the list goes on and on. With this being said, it is pivotal to understand every element of your network in order to get the most out of it. A fundamental element in every network is the switch, which is used across the board from small/home office (SOHO) to major ISPs (Internet Service Providers). If your switches are not configured properly disaster may occur, inviting attackers to take advantage of your network.

Below are our best practice Do’s and Don’ts for proper switch configuration to ensure that you are protected.

Dos:

1. Add hostname to differentiate switch in large networks.
2. Create intricate passwords and always enable encryption.
3. Disable TELNET! Use SSH instead. (Requires crypto image on Cisco)
4. Configure ACLs to restrict access to SSH console if possible.
5. Comment configuration lines as much as possible.
6. Regularly backup your switch startup configuration to FTP or TFTP.
7. Use SNMP v2 or higher for monitoring and administration.
8. Ports connecting to other switches and ISPs should always have descriptions providing clarity to all administrators.
9. Disable Aux port when not required.
10. Keep switch firmware upgraded.
11. Set up a syslog server and configure all network devices to log in to it, verifying that each syslog server is successfully receiving events from every device.
12. If your switch provides it, enable DHCP guarding to block rogue DHCP servers.
13. Shutdown the unused ports or add them to the VLAN with no access.

 Don’ts:

1. Do not use default VLAN. VLAN 1 on cisco switches.
2. Do not use SNMPv1 because credentials are sent in clear text.
3. Switches have auto-negotiate function.  Do not statically set duplex and speed unless absolutely necessary.
4. Do not use DHCP to assign IP addresses to critical IT systems (switches, firewalls, servers, and the like).  Instead assign static IPs, and make sure that those statically assigned IPs are excluded from the DHCP lease range.
5. Do not store passwords in plain text. You may use hashing algorithms(ex-MD5) if available. Public key authentication would also be a better choice.