Cisco SG300/350 Config Hardening

Switch harderning for SG300 and SG350 switches.

Edge Port Config

STP enable: RSTP (preferred), MST, etc

Default enable, not custom config is required.

BPDU guard enable: cannot connect switch/uplink, only desktop/laptop

With lockout and auto release in 1 minute

! 60 second auto recovery, global commands
configure terminal
errdisable recovery interval 60
errdisable recovery cause stp-bpdu-guard
errdisable recovery cause stp-loopback-guard
spanning-tree loopback-guard

! Range interface settings for all **ACCESS/EDGE PORTS**
! DO NOT SET THIS FOR UPLINK PORTS!
configure terminal
interface range GE 1 - 26
 spanning-tree portfast
 spanning-tree bpduguard enable

Broadcast storm limit

Broadcast, unknow unicast: rate limit to 100Kbps
Multicast traffic: 10Mbps
Switch will drop packets exeeding bandwidth limit
Switch port will NOT be disabled during storm condition
Configure for all ports (edge and uplink)

interface range GE 1 - 28
 storm-control broadcast kbps 100
 storm-control unicast kbps 100
 storm-control multicast kbps 10000

Security Suite Settings

! Global settings
configure terminal
security-suite enable global-rules-only
security-suite dos protect add stacheldraht
security-suite dos protect add invasor-trojan
security-suite dos protect add back-orifice-trojan

Disable smart ports

Smart ports create dynamic configuration which is not recommended for production switches.

! show macro auto ports
configure terminal
  macro auto diasbled
  interfac range GE 1-26
    no macro auto smartport
    no macro auto persistent