# Security Configuration

**URL:** <https://community.netwrix.com/t/security-configuration/120934>\
**Category:** Cisco Command Library\
**Tags:** security\
**Created:** [January 14, 2026, 8:28pm UTC](https://community.netwrix.com/t/security-configuration/120934 "2026-01-14T20:28:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Netwrix-Team](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/netwrix-team/32/3102_2.png) [@Netwrix-Team](https://community.netwrix.com/u/Netwrix-Team)\
**Post date:** [January 14, 2026, 8:28pm UTC](https://community.netwrix.com/t/security-configuration/120934/1 "2026-01-14T20:28:54Z")

</div>

You can configure access lists to restrict and allow traffic to and from your Cisco device. Use the following commands:

| Command | Description |
| --- | --- |
| `password <pass-value>` | Lists the password that is required if the login command (with no other parameters) is configured |
| `username name password <pass-value>` | Defines one of possibly multiple user names and associated passwords used for user authentication. It is used when the login local line configuration command has been used. |
| `enable password <pass-value>` | Defines the password required when using the enable command |
| `enable secret <pass-value>` | Sets the password required for any user to enter enable mode |
| `service password-encryption` | Directs the Cisco IOS software to encrypt the passwords, CHAP secrets and similar data saved in its configuration file |
| `ip access-list {standard | extended} {acl-name | acl-number}` | Creates a standard or extended ACL |
| `permit source <source-wildcar>` | Adds permit rules for a Standard ACL |
| `deny source <source-wildcard>` | Adds deny rules for an Extended ACL |
| `ip access-group {acl-name | acl-number} {in | out}` | Applies an ACL to an interface |
| `show access-lists [acl-name | acl-number]` | Displays ACL configuration |
| `no ip access-list {standard | extended} {acl-name | acl-number}` | Removes an ACL |

Below are commands to help you troubleshoot and perform basic diagnostics:

```auto
NorthOfficeRouter (config) taccess-list 25 deny 152.1€8.1.0 0.0.0.255
NorthOfficeRouter (config) access-list 25 permit any
NorthOf£iceRouter (config) tend
NorthOfficeRoutert
¥SYS-5-CONFIG_I: Configured from console by console
NorthOfficeRoutertshow access-lists 25
Standard IP access list 25
deny 192.168.1.0 0.0.0.255
permit any
NorthOfficeRoutert

```

## Configuring SSH and Remote Access

Use the following commands to configure SSH and remote access:

| Command | Description |
| --- | --- |
| `hostname <name>` | Sets a hostname (if not already configured) |
| `ip domain-name [domain-name]` | Configures an IP domain name |
| `crypto key generate rsa` | Generates an RSA key pair for SSH |
| `ip ssh version 2` | Configures SSH version 2 |
| `username [username] privilege [level] secret [password]` | Creates a local user account |
| `line vty [line-range]`  
`transport input ssh`  
`login local` | Configures VTY lines for SSH access |

The output below shows the generation of the RSA keys:

```auto
NorthOfficeRoutergconfig t
Enter configuration commands, one per line. End with CNTL/Z.
NorthOfficeRouter (config) #ip domain-name Cisco
NorthOfficeRouter (config) #crypto key generate rsa
The name for the keys will be: NorthOfficeRouter. Cisco
Choose the size of the key modulus in the range of 3€0 to 4086 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [S12]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable... [0K]
NorthOfficeRouter (confia) #

```

## Implementing Port Security

Use the following commands to implement port security:

| Command | Description |
| --- | --- |
| `switchport port-security` | Enables port security on the interface |
| `switchport port-security maximum <number>` | Sets the maximum number of secure MAC addresses on the port |
| `switchport port-security mac-address {mac-addr | {sticky [mac-addr]}}` | Adds a MAC address to the list of secure MAC addresses and optionally configures them as sticky on the interface |
| `switchport port-security violation {shutdown | restrict | protect}` | Sets the action to be taken when a security violation is detected |
| `show port security [interface interface-id]` | Displays information about security options configured on the interface |

The example below shows the process of configuring port security on a switch port.

```auto
Switch (config) #interface FastEthernet0/7
Switch (config-if)#switchport mode access
Switch (config-if) #switchport port-security
Switch (config-if)#switchport port-security mac-address sticky
Switch (config-if)#

```

## Managing User Accounts

You can use the following commands to manage user accounts:

| Command | Description |
| --- | --- |
| `username <username> privilege <level> secret <password>` | Creates a local user account |
| `show users` | Displays current user sessions |
| `no username <username>` | Removes a user account |
| `security passwords min-length <length>` | Sets password complexity requirements |