switch-template.txt

! ================================================================
! S W I T C H - [DEVICE-NAME]
! ================================================================


! Declare SDM Template
! --------------------
sdm prefer dual-ipv4-and-ipv6 default


! Reload now...

enable
configure terminal

! Set Hostname
! ------------
hostname [HOSTNAME]


! Disable DNL
! -----------
no ip domain-lookup


! Enable Unicast Routing
! ----------------------
ipv6 unicast-routing


! Start Layer 3 Routing
! ---------------------
ip routing


! Set Enable Password
! -------------------
enable secret [ENABLE-PASSWORD]


! Set Console Password
! --------------------
line console 0
	motd-banner
	logging synchronous
	password [CONSOLE-PASSWORD]
	exec-timeout [MINUTES (0)] [SECONDS (0)]
	login
	exit


! Configure Ports For Secure Access
! ---------------------------------
line vty [(PORT-RANGE (0 15)]
	motd-banner
	logging synchronous
	password [PORT-PASSWORD]
	exec-timeout [MINUTES (0)] [SECONDS (0)]
	transport input [CONNECTION-TYPE (telnet) | (ssh))
	login [DB-LOCATION (local)]
	exit


! Write Banner MOTD
! -----------------
banner motd [BANNER-MODT (+This is a secure system. Authorized Access Only!+)]


! Create VLAN(s)
! --------------
vlan [VLAN-ID]
	name [VLAN-NAME]
	exit


! Implement VTP
! -------------
vtp domain [DOMAIN-NAME]
vtp mode [(server) | (client) | (transparent)]

! Activate VTP Server
exit
vtp primary
configure terminal


! Configure Virtual Interface(s)
! ------------------------------
interface vlan [VLAN-ID]
	description [VLAN-DESCRIPTION]
	ip address [(dhcp)] | [IPv4-ADDRESS] [IPv4-SUBNET-MASK]
	ipv6 address [(dhcp)] | [IPv6-ADDRESS/IPv6-PREFIX]
	ipv6 address [fe80::LLA-Address] link-local
	no shutdown
	exit


! Enable RSTP/MST, Portfast And BPDU Guard On All Access Ports
! --------------------------------------------------------
spanning-tree mode [(rapid-pvst) | (mst)]
spanning-tree portfast default
spanning-tree portfast bpduguard default


! Configure Trunk Interface(s), DTP, STP, Trunking, VLANs
! -------------------------------------------------------
interface [(range)] [PORT-TYPE (gig/fa)] [PORT-NUMBER(S) (0/0, 0/1/1, ...)]
	description [PORT-DESCRIPTION]
	switchport trunk encapsulation dot1q
	switchport mode trunk
	switchport nonegotiate
	switchport trunk native vlan [VLAN-ID]
	switchport trunk allowed vlan [VLAN-ID-LIST]
	switchport priority extend cos [DEVICE-PRIORITY (1-7)]
	mls qos cos [CLASS-OF-SERVICE (1-7)]
	mls qos trust [cos | device cisco-phone | dscp | ip-precedence]
	spanning-tree [vlan [VLAN-ID]] cost [COST]
	spanning-tree [vlan [VLAN-ID]] port-priority [PRIORITY]
	mdix auto
	speed auto
	duplex auto
	no shutdown
	exit


! Configure Access Interface(s), DTP, STP, Trunking, VLANs
! --------------------------------------------------------
interface [(range)] [PORT-TYPE (gig/fa)] [PORT-NUMBER(S) (0/0, 0/1/1, ...)]
	description [PORT-DESCRIPTION]
	switchport mode access
	switchport nonegotiate
	switchport access vlan [VLAN-ID]
	switchport voice vlan [VLAN-ID]
	switchport priority extend cos [DEVICE-PRIORITY (1-7)]
	mls qos cos [CLASS-OF-SERVICE (1-7)]
	mls qos trust [cos | device cisco-phone | dscp | ip-precedence]
	spanning-tree [vlan [VLAN-ID]] cost [COST]
	spanning-tree [vlan [VLAN-ID]] port-priority [PRIORITY]
	mdix auto
	speed auto
	duplex auto
	no shutdown
	exit

! Adding Security Configurations (not available for all switches)
! ---------------------------------------------------------------
! auto secure
service password-encryption
security passwords min-length [MIN-PASSWORD-LENGTH]
login block-for [TIMOUT-DURATION (180)] attempts [ATTEMPTS (3)] within [TIMESPAN (20)]


! Mitigate ARP & DHCP Attacks
! ---------------------------
ip dhcp snooping
ip dhcp snooping vlan [VLAN-ID]
ip arp inspection vlan [VLAN-ID]
ip arp inspection validate src-mac dst-mac ip


! Configure trusted (infrastructural) links
! -----------------------------------------
interface [(range)] [PORT-TYPE (gig/fa)] [PORT-NUMBER(S) (0/0, 0/1/1, ...)]
	ip dhcp snooping trust
	ip arp inspection trust
	exit


! Mitigate Reconnaisance Attacks
! ------------------------------
no cdp run
no lldp run


! Add Port Security
! -----------------
interface [(range)] [PORT-TYPE (gig/fa)] [PORT-NUMBER(S) (0/0, 0/1/1, ...)]
	switchport port-security
	switchport port-security maximum [MAX-ADDRESSES (1-132)]
	switchport port-security mac-address [STATIC-MAC | sticky]
	switchport port-security violation [restict | protect | shutdown]
	switchport port-security aging time [MINUTES (10)] | type [absolute | inactivity]
	exit


! Create Trunk Links For EtherChannel/LACP/PAgP, Layer 2/3
! --------------------------------------------------------
interface range [PORT-TYPE (gig/fa)] [PORT-NUMBER(S) (0/0, 0/1/1, ...)]
	shutdown
	no switchport
	channel-protocol [lacp | pagp]
	channel-group [GROUP-NUMBER (1-6)] mode [active (LACP) | auto (try PAgP) | desirable (PAgP) | on (only EtherChannel) | passive (try LACP)]
	no shutdown
	exit

interface port-channel [GROUP-NUMBER (1-6]
	description [DECRIPTION]
	switchport mode trunk
	ip address [PORT-IP] [PORT-NETMASK]
	ipv6 address [(dhcp)] | [IPv6-ADDRESS/IPv6-PREFIX]
	ipv6 address [fe80::LLA-Address] link-local
	exit


! Set Load-Balancing Method
! -------------------------
port-channel load-balance [src-dest-mac | src-dest-ip | src-dest-port]


! Create DHCP-Pool(s)
! -------------------
ip dhcp excluded-address [START-IP-ADDRESS] [END-IP-ADDRESS(included)]
ip dhcp pool [POOLNAME]
	network [NETWORK-IP-ADDRESS] [NETWORK-IP-SUBNET-MASK]
	default-router [IP-ADDRESS]
	dns-server [IP-ADDRESS]
	domain-name [DOMAIN-NAME(www.example.net)]
	lease [LEASE-DURATION(days hours minutes | infinite)]
	exit


! Implement General Spanning Tree Settings
! ----------------------------------------
spanning-tree mode rapid-pvst
spanning-tree pathcost method long
spanning-tree vlan [VLAN-ID] priority [PRIORITY]
spanning-tree vlan [VLAN-ID] root [primary | secondary]
spanning-tree vlan [VLAN-ID] hello-time 3
spanning-tree vlan [VLAN-ID] forward-time 10
spanning-tree vlan [VLAN-ID] max-age 20


! Declare Default Gateway
! -----------------------
ip default-gateway [IPv4-DEFAULT-GATEWAY]
ip route 0.0.0.0 0.0.0.0 [IPv4-DEFAULT-GATEWAY]
ipv6 route ::/0 [IPv6-DEFAULT-GATEWAY]


! Disable Unused Services
! -----------------------
! no ip http server


! Configuring SSH-Access
! ----------------------
ip domain-name [DOMAIN-NAME]
username [USERNAME] secret [SSH-PASSWORD]
username [USERNAME] privilege [PRIVILEGE-LEVEL (0-16)]
crypto key generate rsa general-keys modulus [MODULUS-LENGTH (2048)]
ip ssh version 2


! Define ACLs & Device Access
! ---------------------------
! Standard
ip access-list standard [ACL-NUMBER (1-99) | ACL-NAME]
	remark [ACL-REMARK]
	[SEQ-NUMBER] [deny | permit] [any | host [HOST-IP] | [NETWORK-ADDRESS] [WILDCARD MASK]] [any | host [HOST-IP] | [NETWORK-ADDRESS] [WILDCARD MASK]]
	deny any any
	exit

! Extended
ip access-list extended [ACL-NUMBER (100-199) | ACL-NAME]
	remark [ACL-REMARK]
	[SEQ-NUMBER] [deny | permit] [icmp | ip | tcp | udp | ospf] [any | host [HOST-IP] | [NETWORK-ADDRESS] [WILDCARD MASK]] [any | host [HOST-IP] | [NETWORK-ADDRESS] [WILDCARD MASK]] eq [PORT-NUMBER]
	deny ip any any
	exit

interface [PORT-TYPE (gig/fa)] [PORT-NUMBER (0/0, 0/1/1, ...)]
	ip access-group [ACL-NUMBER | ACL-NAME] [in | out]
	exit

line vty [(PORT-RANGE(0 15)]
	ip access-class [ACL-NAME] [in | out]
	exit


! Save Configuration
! ------------------
do write memory