Tutorials · Security
How to Secure the Management of Switches, Routers and Access Points
A hardening checklist for every network device: strong credentials, SSH only, a management VLAN, access lists and logging.
Before you start
- Admin access to each device
Step by step
Change default credentials
Set a unique, strong admin password per device and store it in a password manager. Remove unused accounts.
Use encrypted management only
Enable SSH and HTTPS; disable Telnet and plain HTTP.
ip ssh version 2 no ip telnet server ip http secure-server no ip http server
Isolate management
Put management interfaces in a dedicated VLAN reachable only from admin workstations or a jump host.
Restrict who can connect
Allow management only from trusted subnets.
ip access-list standard MGMT permit 10.99.0.0 0.0.0.255 line vty 0 15 access-class MGMT in
Log and timestamp
Send logs to a syslog server and keep clocks in sync with NTP (see the monitoring tutorials).
Back up configurations
Keep a copy of every configuration after changes (see the backup tutorial).
Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.
Pro tips
- Disable unused services such as CDP/LLDP on Internet-facing ports and UPnP on gateways.
- Use two-factor authentication on cloud management portals.
FAQ
Frequently asked questions
Why disable Telnet?
Telnet sends passwords in clear text. SSH encrypts the session.
Keep learning
Related guides
Enable 2FA for admin accounts
Read more →Edge devices under attack
Read more →How to Enable 802.1X Port Authentication on Switches
Stop unknown devices from using your network ports: configure 802.1X with RADIUS and MAC-authentication bypass for printers and cameras.
Read more →How to Segment IoT and CCTV Devices From Your Main Network
Put cameras, smart TVs, sensors and building systems in their own VLANs so one compromised device cannot reach your business systems.
Read more →How to Write Firewall Rules That Actually Protect You
Default-deny, least privilege and clean rule bases: practical rules for any firewall or gateway.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.