Network Security Audit

Systematic security assessment for Cisco IOS-XE devices following industry best practices and CIS benchmarks.

When to Use

Security posture assessment for compliance (SOC2, PCI-DSS, NIST, CIS)
Pre-deployment security review
Incident response — checking for unauthorized access or configuration
Hardening audit for new devices
Periodic security validation

Security Audit Procedure

Step 1: Pull Running Configuration

Always start by capturing the full running config for analysis:

PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "python3 -u $PYATS_MCP_SCRIPT" pyats_show_running_config '{"device_name":"R1"}'

Scan the full config for the checks below.

Step 2: Management Plane Hardening

Check these items in the running config:

Check	What to Look For	Finding If Missing
SSH version	`ip ssh version 2`	CRITICAL: SSHv1 vulnerable to MITM
Telnet disabled	No `transport input telnet` on VTY lines	CRITICAL: Telnet sends cleartext credentials
VTY ACL	`access-class` on VTY lines	HIGH: Unrestricted management access
Console timeout	`exec-timeout` on console (not 0 0)	MEDIUM: Unattended console sessions
VTY timeout	`exec-timeout` on VTY lines (not 0 0)	MEDIUM: Stale management sessions
Password encryption	`service password-encryption`	MEDIUM: Type 0 passwords visible
Enable secret	`enable secret` (not `enable password`)	HIGH: Enable password uses weak hash
Login banner	`banner login` or `banner motd`	LOW: Legal/compliance requirement
HTTP server disabled	`no ip http server`	MEDIUM: Unnecessary attack surface
HTTPS server	`ip http secure-server` if web management needed	MEDIUM: Use HTTPS not HTTP
Aux port disabled	`no exec` on aux line	LOW: Unused port open

Step 3: AAA Configuration

PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "python3 -u $PYATS_MCP_SCRIPT" pyats_run_show_command '{"device_name":"R1","command":"show aaa servers"}'

AAA checks in running config:

aaa new-model enabled
aaa authentication login configured (not just local)
aaa authorization exec configured
aaa accounting configured for commands and connections
TACACS+ or RADIUS server defined with encryption
Local fallback account exists (in case AAA server unreachable)
aaa authentication enable uses enable secret not enable password

Step 4: Access Control Lists

PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "python3 -u $PYATS_MCP_SCRIPT" pyats_run_show_command '{"device_name":"R1","command":"show ip access-lists"}'

ACL analysis:

Check hit counts — ACEs with 0 matches may be unnecessary or misplaced
Look for overly permissive rules (permit ip any any)
Verify explicit deny at the end with logging (deny ip any any log)
Check ACL is applied to the correct interface and direction
Verify VTY access-class restricts management to known networks
Look for ACLs referenced in route-maps, NAT, or other features

Step 5: Control Plane Policing (CoPP)

Check in running config for:

control-plane section with service-policy
CoPP policy-map classifying and rate-limiting traffic to the CPU
Protection against: ICMP floods, TTL-expired floods, fragmentation attacks, ARP storms

PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "python3 -u $PYATS_MCP_SCRIPT" pyats_run_show_command '{"device_name":"R1","command":"show policy-map control-plane"}'

Step 6: Routing Protocol Security

OSPF authentication:

Check for ip ospf authentication message-digest on interfaces
Or area-level: area X authentication message-digest
Verify ip ospf message-digest-key is configured

BGP security:

neighbor X password (MD5 authentication)
neighbor X ttl-security hops N (GTSM — Generalized TTL Security Mechanism)
neighbor X prefix-list or neighbor X maximum-prefix (prefix limits)
Check for bogon filtering on eBGP peers

EIGRP authentication:

Named mode: af-interface with authentication mode md5 and authentication key-chain
Classic mode: ip authentication mode eigrp and ip authentication key-chain eigrp

Step 7: Infrastructure Security

Check in running config:

Feature	Config	Purpose
uRPF	`ip verify unicast source reachable-via rx`	Anti-spoofing
TCP keepalives	`service tcp-keepalives-in`, `service tcp-keepalives-out`	Dead session cleanup
CDP restricted	`no cdp enable` on external interfaces	Information leak prevention
LLDP restricted	`no lldp transmit` / `no lldp receive` on external	Information leak prevention
IP source routing disabled	`no ip source-route`	Prevent source-routed attacks
Directed broadcast disabled	`no ip directed-broadcast` per interface	Smurf attack prevention
ICMP redirects disabled	`no ip redirects` per interface	MITM prevention
Proxy ARP disabled	`no ip proxy-arp` on external interfaces	ARP spoofing prevention
Gratuitous ARP	`no ip gratuitous-arps`	ARP cache poisoning prevention
IP unreachables limited	`no ip unreachables` on external	Reconnaissance prevention
Timestamps	`service timestamps log datetime msec localtime`	Forensics
Logging buffer	`logging buffered` with adequate size	Event capture
Remote logging	`logging host X.X.X.X`	Centralized log collection

Step 8: Encryption & Credentials

PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "python3 -u $PYATS_MCP_SCRIPT" pyats_run_show_command '{"device_name":"R1","command":"show crypto key mypubkey rsa"}'

Check:

RSA key size >= 2048 bits (CRITICAL if < 1024)
SSH version 2 only
No Type 0 (cleartext) passwords in running config
Enable secret uses Type 8 or Type 9 (scrypt) if available
SNMP community strings are not "public" or "private"
SNMPv3 preferred over v2c

Step 9: SNMP Security

PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "python3 -u $PYATS_MCP_SCRIPT" pyats_run_show_command '{"device_name":"R1","command":"show snmp"}'

Checks:

No default community strings (public, private, cisco)
RO communities have ACL restricting source
RW communities have ACL restricting source (or don't exist at all)
SNMPv3 with authPriv preferred
SNMP traps configured to central monitoring

Security Report Format

Device: R1 | IOS-XE 17.x.x
Security Audit Date: YYYY-MM-DD

CRITICAL FINDINGS (Fix Immediately):
  1. [C-001] SSHv1 enabled — upgrade to SSH version 2 only
  2. [C-002] No VTY access-class — management plane exposed

HIGH FINDINGS (Fix This Week):
  3. [H-001] No OSPF authentication on Gi1 — route injection risk
  4. [H-002] SNMP community 'public' with no ACL

MEDIUM FINDINGS (Fix This Month):
  5. [M-001] No CoPP policy — CPU vulnerable to floods
  6. [M-002] HTTP server enabled — disable or restrict

LOW / INFORMATIONAL:
  7. [L-001] No login banner configured
  8. [I-001] CDP enabled globally (acceptable on internal interfaces)

Summary: 2 Critical | 2 High | 2 Medium | 2 Low

ISE Integration (MISSION02 Enhancement)

When ISE is available ($ISE_MCP_SCRIPT is set), extend the security audit with identity verification:

Verify Device is Registered as NAD

Check that the device is registered in ISE as a Network Access Device:

ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 $MCP_CALL "python3 -u $ISE_MCP_SCRIPT" network_devices '{}'

Flags:

Device not registered as NAD → CRITICAL: Not participating in ISE enforcement
Device registered but no RADIUS/TACACS config on device → HIGH: ISE configured but device not using it

Check Active Sessions on Device

ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 $MCP_CALL "python3 -u $ISE_MCP_SCRIPT" active_sessions '{}'

Filter sessions for this device's IP to see authenticated endpoints.

NVD CVE Vulnerability Scan

After Step 1 (show version), extract the IOS-XE version and scan for known vulnerabilities:

python3 $MCP_CALL "npx -y nvd-cve-mcp-server" search_cves '{"keyword":"Cisco IOS XE 17.9.4","resultsPerPage":10}'

For each CVE found:

Check CVSS score (flag CVSS >= 7.0)
Cross-reference running config for exposure (e.g., CVE requires HTTP server → check if ip http server is configured)
Produce exposure correlation: CVE + running-config = actual risk

Severity mapping:

CVSS >= 9.0 → CRITICAL
CVSS >= 7.0 → HIGH
CVSS >= 4.0 → MEDIUM
CVSS < 4.0 → LOW

Fleet-Wide Security Audit (pCall)

Run the full 9-step audit on ALL devices simultaneously using multiple exec commands. Aggregate findings across the fleet and sort by severity for prioritized remediation.

GAIT Audit Trail

Record the security audit in GAIT:

python3 $MCP_CALL "python3 -u $GAIT_MCP_SCRIPT" gait_record_turn '{"input":{"role":"assistant","content":"Security audit on R1: 2 CRITICAL (no enable secret, telnet enabled), 2 HIGH, 2 MEDIUM, 2 LOW findings.","artifacts":[]}}'

pyats-security