Network devices control who can talk to what. If an attacker takes over a core switch or finds a weak firewall rule, every other control becomes easier to bypass. That is why it pays to audit routers, switches and firewalls regularly, not just servers and applications.
This guide explains how to plan the audit, which tools help, and what to check on each type of device. The checklist works for Cisco, Juniper, Fortinet, Palo Alto and most other vendors.
Scope of the audit
Start by listing every device in scope:
- core, distribution and access switches;
- internet and WAN routers;
- perimeter and internal firewalls, including cloud security groups;
- wireless controllers and VPN gateways.
Then collect the network diagram, current configurations, firmware versions and any previous audit reports. If the diagram does not match reality, record that as your first finding.
Useful tools
- Configuration analysis: tools such as Nipper or vendor best-practice analysers review configs offline.
- Firewall rule analysis: firewall management tools, or a careful spreadsheet review, find shadowed and unused rules.
- Scanning: Nmap confirms which ports are actually reachable.
- Vulnerability scanning: tools like OpenVAS or Nessus check firmware against known flaws.
- Logs: the SIEM or syslog server shows whether devices really send their logs.
Step-by-step process
- Plan: agree on scope, timing and read-only access with the network team.
- Gather: export configurations and rule bases, and note firmware versions.
- Review: compare each configuration with your hardening baseline, such as CIS Benchmarks.
- Test: scan from inside and outside to confirm what is exposed.
- Interview: ask how changes, backups and emergency access work in practice.
- Report: rank findings by risk, and agree on owners and dates.
Checklist: all network devices
- The vendor still supports the firmware, and it has patches for known vulnerabilities.
- Management uses SSH or HTTPS only; Telnet and plain HTTP are disabled.
- Admin logins go through TACACS+ or RADIUS with MFA, plus one emergency local account.
- Only an admin network or jump host can reach management interfaces.
- No default accounts, passwords or SNMP community strings remain.
- Devices use SNMPv3 instead of SNMPv1 or v2c.
- Every device shows a login banner.
- Logs go to a central server, and clocks sync with NTP.
- A tool backs up configurations automatically, and every change follows change management.
- Unused services, such as HTTP servers, CDP on edge ports or source routing, stay disabled.
For more on device authentication, read our guide to AAA in networking.
Extra checks for switches
- Unused ports stay shut down and sit in an unused VLAN.
- Port security or 802.1X limits which devices can connect.
- DHCP snooping, Dynamic ARP Inspection and BPDU guard run where suitable.
- Trunk ports allow only the VLANs they need, and the native VLAN is not VLAN 1.
- VTP is in transparent or off mode, or version 3 with a password.
Router-specific checks
- Routing protocol neighbours authenticate, for example with OSPF or BGP authentication.
- Route filters stop unexpected prefixes from being accepted or advertised.
- Anti-spoofing filters drop traffic with private or bogus source addresses at the edge.
- Infrastructure ACLs protect the router’s own control plane.
Firewall rule base checks
- The rule base follows “deny by default”, with an explicit final deny rule.
- No broad “any-any” rules exist without a documented, approved reason.
- Every rule has an owner, a business reason and a review date.
- The team removes unused, duplicate or shadowed rules.
- Owners review the rules at least every six months.
- Inspection features, such as IPS and TLS inspection, match your policy.
- The team tests high availability failover.
Common findings
Typical audit results include old firmware with public vulnerabilities, shared admin passwords, Telnet still enabled on a few switches, and firewall rules nobody can explain. Fortunately, most of these are cheap to fix once you know about them.
Related guides
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
