Network Hardening

Network hardening is about controlling what traffic flows in, out, and through your environment and making sure that when something malicious does get in, it can’t move freely. A lot of breaches that look sophisticated in hindsight were actually enabled by basic network misconfigurations: flat networks with no segmentation, exposed management interfaces, cleartext protocols still running, firewall rules nobody’s reviewed in years. This page covers the core principles and practical steps for hardening networks at both the perimeter and internally.

Core Principles

Before getting into specifics, these are the ideas everything else builds on: Least privilege for network traffic - traffic should only be allowed if there’s an explicit business reason for it. “Allow all outbound” is not a default you want. Defense in depth - don’t rely on a single control. Layer your defenses: perimeter firewall, internal segmentation, host-based firewall, IDS/IPS. Visibility first - you can’t defend what you can’t see. Logging and monitoring is part of network hardening, not an afterthought. Assume breach - design your network assuming an attacker will eventually get inside the perimeter. Segmentation and east-west traffic controls limit how far they can go.

Network Segmentation

A flat network where every device can talk to every other device is an attacker’s dream. Segmentation limits lateral movement by controlling which systems can communicate with which.

VLANs

VLANs (Virtual Local Area Networks) are the standard way to segment at Layer 2:

Common VLAN structure:
- VLAN 10: Management (network devices, servers)
- VLAN 20: Servers / DMZ
- VLAN 30: Workstations / End users
- VLAN 40: Guest / Untrusted devices
- VLAN 50: IoT / OT devices
- VLAN 99: Native VLAN (untagged - change from default VLAN 1)

Key rules:

Never use VLAN 1 as your native/default VLAN - it’s the default on all switches and a known attack vector (VLAN hopping)
Inter-VLAN routing should go through a firewall, not just a router, so you can apply access control
Strictly segregate management traffic - your management VLAN should not be reachable from user VLANs

Zero Trust Network Architecture

The modern approach moves beyond perimeter-based thinking:

Never trust, always verify - even internal traffic
Every access request is authenticated and authorized, regardless of network location
Microsegmentation at the workload level, not just VLAN level
Works well alongside tools like software-defined perimeters and identity-aware proxies

Firewall Hardening

Rules Principles

Good firewall rule hygiene:
Default deny - block everything, then allow explicitly
Most specific rules first
Each rule has a documented business justification
Rules are reviewed and cleaned up regularly (quarterly minimum)
No "any/any" rules - ever
Separate rules for inbound and outbound
Log denied traffic (at minimum) for visibility

Perimeter Firewall

For the external-facing firewall, the questions to answer for every allowed service:

Does this service need to be internet-facing, or can it be VPN-only?
Is access restricted by source IP where possible?
Is the service patched and actively maintained?
Is TLS enforced?
Is there rate limiting or DDoS protection in front of it?

Services that should almost never be directly internet-facing:
- RDP (3389) - use a VPN or RD Gateway instead
- SSH (22) - consider VPN + jump host, or at minimum restrict to known IPs
- SMB (445) - never expose to the internet
- Telnet (23) - never, full stop
- Database ports (3306, 5432, 1433) - never expose directly
- SNMP (161) - restrict to management network only
- WinRM (5985/5986) - management only, never internet-facing

Internal Firewall / East-West Controls

Most organizations focus on north-south traffic (in/out of the network) but ignore east-west (internal traffic). This is exactly how ransomware and APTs spread:

Deploy internal firewalls between segments
Apply ACLs on inter-VLAN routing
Use host-based firewalls as a second layer (Windows Firewall, UFW)
Consider a software-defined perimeter or microsegmentation solution for cloud/hybrid environments

Disable Insecure Protocols

Switch/Router Level

On Cisco IOS (adapt for other platforms):

# Disable CDP on external-facing interfaces (leaks device info)
interface GigabitEthernet0/0
  no cdp enable

# Disable Telnet - use SSH only
line vty 0 15
  transport input ssh
  login local

# Enable SSH v2 only
ip ssh version 2
crypto key generate rsa modulus 4096

# Disable HTTP management interface - use HTTPS only
no ip http server
ip http secure-server

# Disable unused services
no service finger
no service tcp-small-servers
no service udp-small-servers
no ip source-route
no ip proxy-arp

Protocol-Level Decisions

Protocol	Status	Replacement
Telnet	Disable	SSH
FTP	Disable	SFTP / FTPS / SCP
HTTP	Disable/redirect	HTTPS (TLS 1.2+)
SNMPv1/v2c	Disable	SNMPv3 with auth+priv
TLS 1.0/1.1	Disable	TLS 1.2 minimum, TLS 1.3 preferred
RC4 / MD5 cipher suites	Disable	AES-GCM, ChaCha20
Weak Diffie-Hellman (< 2048-bit)	Disable	ECDHE, DHE with 2048+
SMBv1	Disable	SMBv3 with signing
LLMNR / NBT-NS	Disable	DNS only
WEP / WPA	Disable	WPA2/WPA3 Enterprise

DNS Hardening

DNS is critical infrastructure and a common attack vector - DNS tunneling, hijacking, poisoning.

# On resolvers - disable recursion for external queries (prevent open resolver abuse)
# BIND example:
options {
    recursion yes;
    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; };  # Internal only
    allow-query { any; };
};

# Enable DNSSEC validation on resolvers
options {
    dnssec-validation auto;
};

For enterprise environments:

Use DNS filtering services (Cisco Umbrella, Cloudflare Gateway, NextDNS) to block malicious domains
Implement DNS over HTTPS (DoH) or DNS over TLS (DoT) to prevent DNS eavesdropping
Monitor DNS query logs - unusual patterns (high-entropy domains, uncommon TLDs, large TXT records) can indicate C2 or exfiltration
Restrict which systems can make external DNS queries - route everything through internal resolvers

Wireless Network Hardening

Authentication

WPA3 Enterprise is the current gold standard for corporate wireless
WPA2 Enterprise (802.1X) with EAP-TLS (certificate-based auth) is acceptable if WPA3 isn’t available
Never use WPA2-PSK (pre-shared key) for corporate networks - a single leaked key compromises everything
PEAP with MSCHAPv2 is common but has known weaknesses - prefer EAP-TLS

Network Design

Wireless network segmentation:
- Corporate SSID: WPA3/WPA2 Enterprise, VLAN to corporate segment
- Guest SSID: Isolated VLAN, internet only, no internal access
- IoT SSID: Separate VLAN, restricted internal access

# Additional wireless hardening (router/AP level):
- Disable WPS (Wi-Fi Protected Setup) - has known brute-force vulnerabilities
- Disable UPnP
- Change default admin credentials on APs before deployment
- Use 802.11r (Fast BSS Transition) only if you understand the trade-offs
- Enable client isolation on guest networks (clients can't see each other)
- Regularly rotate PSKs on any PSK-based networks (e.g., IoT)

Rogue AP Detection

Monitor for unauthorized wireless access points:

Enable Wireless Intrusion Prevention (WIPS) on your wireless infrastructure if available
Tools like Kismet or airodump-ng can detect rogue APs during assessments
Most enterprise wireless controllers (Cisco, Aruba, Ubiquiti Enterprise) have rogue AP detection built in

SNMP Hardening

SNMP (Simple Network Management Protocol) is used for monitoring network devices - and frequently misconfigured.

# Never use SNMPv1 or SNMPv2c in production - community strings are plaintext
# Use SNMPv3 with authentication and privacy:

# SNMPv3 config example (Cisco IOS)
snmp-server group MONITORING v3 priv
snmp-server user monitoruser MONITORING v3 auth sha AuthPassword123 priv aes 128 PrivPassword123
snmp-server host 10.0.1.5 version 3 priv monitoruser

# Restrict which hosts can query SNMP
access-list 10 permit 10.0.1.5
snmp-server community REMOVED RO 10   # Remove all v1/v2c communities
no snmp-server community public
no snmp-server community private

Network Access Control (NAC)

NAC ensures that only authorized, compliant devices can connect to your network:

802.1X - Port-based authentication standard. Requires devices to authenticate before getting network access.
Cisco ISE - Enterprise NAC platform with rich policy capabilities
Aruba ClearPass - Another widely deployed NAC solution
PacketFence - Open-source NAC option

Typical enforcement policy:

Compliant corporate device + valid certificate = full corporate network access
Personal/unknown device = guest VLAN only
Quarantine VLAN for non-compliant devices (missing patches, AV not running, etc.)

Network Monitoring and IDS/IPS

Intrusion Detection / Prevention

Tool	Type	What it does
Snort	Open-source IDS/IPS	Signature-based detection, widely used
Suricata	Open-source IDS/IPS	Multi-threaded, supports PCAP and inline mode
Zeek (Bro)	Network analysis framework	Generates structured logs for threat hunting
Security Onion	Platform	Bundles Suricata, Zeek, Wazuh, Kibana into a ready-to-use NSM stack

NetFlow / Traffic Analysis

NetFlow (or IPFIX/sFlow) provides metadata about network conversations without full packet capture - efficient for large environments:

# Configure NetFlow export on Cisco IOS
ip flow-export destination 10.0.1.100 9996
ip flow-export version 9
ip flow-cache timeout active 1

interface GigabitEthernet0/0
  ip flow ingress
  ip flow egress

Collectors: ntopng, Elastiflow, Scrutinizer, Kentik

Packet Capture Points

Strategic TAP/SPAN points for full packet capture:

Internet perimeter (ingress/egress)
DMZ boundary
Key internal segments (server VLAN, DC traffic)
Wireless controllers (if possible)

Management Network (OOB)

Your network management infrastructure (switches, routers, firewalls, servers) should be on a separate out-of-band (OOB) management network:

Management network principles:
- Dedicated VLAN/segment for management interfaces
- No user traffic crosses the management network
- Strict ACLs - only management workstations and jump hosts can access
- Separate authentication (don't reuse user domain credentials for network device admin)
- All management traffic encrypted (SSH, HTTPS - never Telnet or HTTP)
- Log all management sessions (session recording is ideal)

Dedicated jump hosts (bastion hosts) provide an audit point for all management access:

All admin sessions go through the jump host
Sessions are logged and optionally recorded
MFA required at the jump host
Jump host itself is heavily hardened and monitored

DDoS Mitigation

For internet-facing services:

Upstream scrubbing - Most ISPs offer DDoS scrubbing services at the edge, before traffic reaches your network
CDN with DDoS protection - Cloudflare, Akamai, AWS Shield can absorb volumetric attacks
Rate limiting - Configure at the firewall, load balancer, and application level
BGP blackholing - Work with your ISP to null-route attack traffic upstream
Anycast routing - Distributes traffic across multiple points, reducing impact of volumetric attacks

Useful Tools

Tool	What it’s for
Nmap	Network discovery and port scanning - know your own exposure
Nessus / OpenVAS	Vulnerability scanning including network devices
Wireshark	Packet analysis
Zeek	Network traffic analysis and log generation
Suricata / Snort	IDS/IPS
Security Onion	Full NSM platform - great for building a monitoring capability
Netdisco	Network device discovery and topology mapping
Nipper	Automated network device configuration auditing
testssl.sh	Test TLS configuration on any HTTPS service
sslyze	Python-based SSL/TLS scanner
Scapy	Python library for crafting and analyzing packets

Quick Win Checklist

Reference

CIS Benchmarks for Network Devices - Cisco, Juniper, Palo Alto, Fortinet specific guides
NIST SP 800-41 - Guidelines on Firewalls and Firewall Policy
Security Onion Documentation - Network security monitoring platform
testssl.sh - Check TLS configs on any HTTPS endpoint

Network hardening is largely about discipline - maintaining consistent standards across a fleet of devices that changes constantly, enforcing rules that create friction, and keeping visibility over what’s actually happening on the wire.

Welcome

Awesome Resources

Red Teaming 101

Blue Teaming 101

GRC 101

General IT Knowledge

Network

Network Hardening

Core Principles

Network Segmentation

VLANs

Zero Trust Network Architecture

Firewall Hardening

Rules Principles

Perimeter Firewall

Internal Firewall / East-West Controls

Disable Insecure Protocols

Switch/Router Level

Protocol-Level Decisions

DNS Hardening

Wireless Network Hardening

Authentication

Network Design

Rogue AP Detection

SNMP Hardening

Network Access Control (NAC)

Network Monitoring and IDS/IPS

Intrusion Detection / Prevention

NetFlow / Traffic Analysis

Packet Capture Points

Management Network (OOB)

DDoS Mitigation

Useful Tools

Quick Win Checklist

Reference

​Network Hardening

​Core Principles

​Network Segmentation

​VLANs

​Zero Trust Network Architecture

​Firewall Hardening

​Rules Principles

​Perimeter Firewall

​Internal Firewall / East-West Controls

​Disable Insecure Protocols

​Switch/Router Level

​Protocol-Level Decisions

​DNS Hardening

​Wireless Network Hardening

​Authentication

​Network Design

​Rogue AP Detection

​SNMP Hardening

​Network Access Control (NAC)

​Network Monitoring and IDS/IPS

​Intrusion Detection / Prevention

​NetFlow / Traffic Analysis

​Packet Capture Points

​Management Network (OOB)

​DDoS Mitigation

​Useful Tools

​Quick Win Checklist

​Reference

Network Hardening

Core Principles

Network Segmentation

VLANs

Zero Trust Network Architecture

Firewall Hardening

Rules Principles

Perimeter Firewall

Internal Firewall / East-West Controls

Disable Insecure Protocols

Switch/Router Level

Protocol-Level Decisions

DNS Hardening

Wireless Network Hardening

Authentication

Network Design

Rogue AP Detection

SNMP Hardening

Network Access Control (NAC)

Network Monitoring and IDS/IPS

Intrusion Detection / Prevention

NetFlow / Traffic Analysis

Packet Capture Points

Management Network (OOB)

DDoS Mitigation

Useful Tools

Quick Win Checklist

Reference