================================================================
SD Tech Solutions — Managed Switch Hardening Template  (v1.0)
================================================================
Applies to any managed switch (Cisco/Netgear/TP-Link/UniFi/Aruba).
Pair with vlan-base-config.txt. Work top to bottom; every line is
checkable — verify by content, not by assumption.

MANAGEMENT PLANE
 [ ] Management IP lives on the MGMT VLAN (99) only — no IP on
     VLAN 1, no management reachable from user/guest VLANs.
 [ ] Web UI: HTTPS only (disable HTTP). CLI: SSHv2 only (disable
     telnet). Disable SNMP, or v3 authPriv with unique creds.
 [ ] Default admin account renamed or disabled; unique local
     account per administrator; strong passphrases in the vault.
 [ ] Firmware updated at deployment + on a quarterly check.
 [ ] Config backup exported after every change (see below).

LAYER-2 PROTECTIONS
 [ ] BPDU Guard on every access port (blocks rogue switches).
 [ ] Root Guard on downlinks if multiple switches.
 [ ] Storm control (broadcast ~1-5%) on access ports.
 [ ] DHCP snooping ON: trust only the uplink port; every access
     port untrusted (blocks rogue DHCP servers).
 [ ] Dynamic ARP inspection ON where supported (uses snooping DB).
 [ ] Port security on access ports: max 2-3 MACs (PC + phone),
     violation = restrict + log. Skip on AP/uplink ports.
 [ ] All unused ports: shutdown + parked in dead VLAN 999.
 [ ] Native VLAN on trunks = 999 (dead), never 1; allowed-VLAN
     lists explicit on every trunk.

VISIBILITY
 [ ] Syslog -> central collector (<SYSLOG_IP>), NTP -> internal
     source so log timestamps line up.
 [ ] LLDP/CDP enabled ONLY on uplinks/infrastructure ports,
     disabled on user ports.
 [ ] Interface descriptions on every port ("what plugs in here"),
     so audits don't need a tone generator.

CONFIG BACKUP DISCIPLINE
 [ ] After every change: export config to the documentation store.
 [ ] Filename convention: <site>-<switch>-YYYYMMDD.cfg
 [ ] Quarterly: diff the running config against the last export —
     undocumented drift is a finding, not an annoyance.

SIGN-OFF
 Site: __________________  Switch: __________________
 Applied by: _____________  Date: ____________
 Deviations (why + approved by): ______________________________

Deployed by SD Tech Solutions · sd-techsolutions.com
