Router And Switch (L2,L3) Audit Check List

Disable Unneeded Services
Are unused interfaces disabled?	Unused interfaces on the router should be disabled. Router(config-if)# shutdown
Is DNS lookups for the router turned off ?	This client service is enabled by default and is not required on most routers. The following command is used to turn DNS lookup off. Router(config)#no ip domain-lookup
Is TCP small servers and UDP small servers service disabled on the router? {applicable before Cisco IOS 11.3}	These services are rarely used and hence can be disabled. This is disabled by default after Cisco IOS 11.3 Router(config)#no service tcp-small-servers Router(config)#no service udp-small-servers

Checklist for Auditing Layer 2 Devices

1.      Verify that administrators avoid using VLAN 1.

2.      Evaluate the use of trunk autonegotiation.

3.      Verify that Spanning-Tree Protocol attack mitigation is enabled (BPDU Guard, Root Guard).

4.      Evaluate the use of VLANs on the network.

5.      Disable all unused ports, and put them in an unused VLAN.

6.      Evaluate use of the VLAN Trunking Protocol (VTP) in the environment.

7.      Verify that thresholds exist that limit broadcast/multicast traffic on ports.

Checklist for Auditing Windows Servers

1.      Obtain the system information and service pack version, and compare with policy requirements.

2.      Determine if the server is running the company-provisioned firewall.

3.      Determine if the server is running a company-provisioned antivirus program.

4.      Ensure that all approved patches are installed per your server management policy.

5.      Determine if the server is running a company-provisioned patch-management solution.

6.      Review and verify startup information.

7.      Determine what services are enabled on the system and validate their necessity with the system administrator. For necessary services, review and evaluate procedures for assessing vulnerabilities associated with those services and keeping them patched.

8.      Ensure that only approved applications are installed on the system per your server management policy.