# Cisco Security Audit

> Generate Python scripts that audit Cisco device security posture. Use when the user wants to check security hardening, compliance, ACL review, or vulnerability assessment of Cisco devices.

- Skill: `bradmccloskey/cisco-security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bradmccloskey/cisco-security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bradmccloskey/cisco-security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: bradmccloskey (https://skillmd.com/u/bradmccloskey)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bradmccloskey/cisco-security-audit

---


## Cisco Security Audit Scripts

Write Python scripts that audit and validate Cisco device security. Follow these standards:

### Audit Categories

#### Device Hardening (CIS Benchmark / STIG aligned)
- Check for `service password-encryption`
- Verify `enable secret` (not `enable password`)
- Ensure `no ip http server` (or HTTPS only with ACL)
- Check `login block-for` and `login delay` settings
- Verify unused interfaces are shut down and in a blackhole VLAN
- Check banner motd / login presence
- Verify `no cdp run` on external interfaces
- Check `no ip source-route`, `no ip directed-broadcast`
- Verify VTY line ACLs and `transport input ssh`
- Ensure `ip ssh version 2` and no Telnet

#### AAA & Access Control
- Verify AAA new-model configuration
- Check TACACS+/RADIUS server configuration
- Validate local fallback account exists
- Review privilege levels and role-based access
- Check console and AUX line security

#### Routing Security
- Verify routing protocol authentication (OSPF MD5/SHA, BGP MD5, EIGRP)
- Check for route filtering on external peers
- Validate uRPF (unicast reverse path forwarding)
- Check for `no ip proxy-arp` on appropriate interfaces

#### ACL Review
- Parse and analyze all ACLs
- Flag overly permissive rules (`permit ip any any`)
- Identify shadowed rules (unreachable ACEs)
- Check ACL application to interfaces (in/out)
- Verify management ACLs on VTY lines

#### ASA / Firewall Specific
- Validate security levels on interfaces
- Check NAT rules for exposure
- Review access-group assignments
- Verify failover configuration
- Check for any-to-any rules

### Output Requirements
- Compliance score (percentage of checks passed)
- Categorized findings: CRITICAL / HIGH / MEDIUM / LOW / INFO
- Each finding includes: description, current config, expected config, remediation command
- CSV/JSON export for reporting
- Support for baseline comparison over time

### Libraries to Use
- `netmiko` for config collection
- `ciscoconfparse` or `ttp` for config parsing
- `re` for regex-based checks
- `rich` for formatted audit reports
- `jinja2` for HTML report generation (optional)

### Security Requirements for the Script Itself
- NEVER hardcode credentials
- Use environment variables or secure vault
- Log audit actions (who ran what, when)
- Do not modify any device configuration (read-only audit)