Physical access control restricts who can physically reach and handle a device or facility. A locked cabinet reduces exposure, but physical protection alone is insufficient because anyone reaching a console port could access the CLI. section 5.1 section 11.2.2
For Cisco device security, remember these operational points:
- Secure the console line as well as the surrounding equipment; enter line con 0 from global configuration mode. section 5.1
- The console line is a logical CLI-management pathway, and Cisco devices have only one console line, so one user can connect at a time. section 5.1
- Console protection can use line password authentication or user account authentication; remote SSH access uses separate VTY lines. section 5.1
Selecting the console line
Switch(config)# line con 0 changes the prompt to Switch(config-line)# and selects the first—and only—console line for security configuration. section 5.1
