Mental model
Password strength alone stopped mattering years ago. Attackers dump hash databases, rent GPUs, and brute-force at billions of hashes per second. Real security comes from layering: something you know (password), plus something you have (phone / token / certificate), plus something you are (biometric).
For the CCNA, you’ll be asked to identify the layers of a “modern” policy — not to memorise a specific vendor’s product.
The layers of a modern password policy
| Layer | What it does | Cisco IOS support |
|---|---|---|
| Length + complexity | Longest single factor; a 16-char passphrase is ~2^80 harder than 8-char complex | security passwords min-length 12 |
| Rotation | Force change on cadence (30/60/90 days) — NIST 800-63B (2017) actually discourages mandatory rotation unless there’s evidence of compromise | username X secret 5 <hash> per user; TACACS/RADIUS backend handles cadence |
| History / no-reuse | Don’t accept the last N passwords | Backend AAA (TACACS+/RADIUS) — IOS doesn’t store history natively |
| Lockout on failure | Freeze the account after N wrong tries | login block-for <sec> attempts <n> within <sec> |
| Encryption at rest | Passwords never stored in plaintext | service password-encryption (weak, Type 7) or enable secret (Type 5/8/9 hashed) |
| MFA / 2FA | Add “something you have” | RADIUS to a backend that speaks TOTP / push (Duo, Cisco ISE, Okta) |
| Certificates | Public/private keypair replaces password | crypto pki for VPN + SSH pubkey auth |
| Biometrics | Fingerprint / face — usually paired with a certificate | Endpoint (laptop / phone), not the network device |
| Passwordless (FIDO2/WebAuthn) | Hardware-backed keypair per site | Endpoint OS + IdP; not a device-CLI concern |
What NIST 800-63B says today (2017 revision)
- Length ≥ 8 (12+ recommended for admin accounts).
- No mandatory periodic rotation unless compromise is suspected.
- No enforced complexity rules (e.g., “must have a symbol”) — they push users to predictable substitutions.
- Block common passwords — check against known-breached lists (Have I Been Pwned, RockYou).
- Enable MFA for anything privileged or remote-accessible.
Older policies you’ll still see on the exam (rotate every 90 days, require symbol/upper/number) exist in Cisco’s blueprint for historical continuity but the NIST modern guidance is the direction the industry is moving.
Real Cisco IOS knobs
! Minimum length on all newly-configured passwords
R1(config)# security passwords min-length 12
! Lockout: 3 wrong tries within 60 seconds → block logins for 300 seconds
R1(config)# login block-for 300 attempts 3 within 60
! Log every failed login (populates syslog for SIEM correlation)
R1(config)# login on-failure log
! Log every successful login (audit trail)
R1(config)# login on-success log
! Store enable password as a Type-5 MD5 hash (not the weak Type-7)
R1(config)# enable secret NeverT3llMe
! User accounts — always use `secret` (hashed), not `password` (Type-7-reversible)
R1(config)# username admin privilege 15 secret Sup3rL0ngPassphrase
! Encrypt Type-7 passwords already stored in config
R1(config)# service password-encryption
! SSH pubkey auth for a user (certificate-adjacent — no password needed)
R1(config)# ip ssh pubkey-chain
R1(config-ssh-pubkey)# username admin
R1(conf-ssh-pubkey-user)# key-string
R1(conf-ssh-pubkey-data)# AAAAB3NzaC1yc2EAAA...
R1(conf-ssh-pubkey-data)# exit
MFA on Cisco: the RADIUS / TACACS+ handoff
Cisco IOS itself doesn’t do TOTP or push-approval. The pattern is:
- IOS uses
aaa authentication login default group RADGROUP local. - Login attempts hit a RADIUS server (Cisco ISE, Duo Auth Proxy, Aruba ClearPass).
- That server does the MFA challenge — TOTP code, phone push, hardware key.
- Only if MFA passes does RADIUS respond
Access-Acceptand IOS lets you in.
The relevant CCNA topic page is AAA — it covers TACACS+ / RADIUS server config in depth.
Password vs secret vs Type-5 vs Type-7 vs Type-8/9
| Type | Command | Storage | Strength | Notes |
|---|---|---|---|---|
| Type-0 (plaintext) | enable password | Cleartext | None | Never use |
| Type-7 (Vigenere) | password 7 ... (after service password-encryption) | Reversible with online tools | None | Obfuscation only |
| Type-4 (SHA-256, no salt) | enable secret 4 (deprecated by Cisco 2013) | Hashed | Weak | Deprecated |
| Type-5 (MD5 + salt) | enable secret X (default older IOS) | Hashed + salt | Medium | Legacy default |
| Type-8 (PBKDF2 SHA-256) | enable secret 8 ... (IOS 15.3+) | Hashed + salt + iterations | Strong | Prefer this |
| Type-9 (scrypt) | enable secret 9 ... (IOS 15.3+) | Hashed + memory-hard | Strong | Prefer this |
Rule: use Type-8 or Type-9 on any modern IOS device. If you must fall back, Type-5 is the last acceptable choice.
The #1 mistake
“Complexity = security.” Password1! satisfies the classic Cisco default template — uppercase, digit, symbol — but is guessable in seconds. A 20-character passphrase like correct-horse-battery-staple-42 has vastly more entropy and is easier for a human to remember. Length beats symbols; length + MFA beats everything.
Quick verification
R1# show login
Login state and configuration information:
Secure Login is enabled
Quiet-Mode is enabled
Block-for state is enabled
Login-attempts allowed: 3
Login-quiet-time: 300 seconds
Ongoing login-time is 60 seconds
R1# show running-config | include enable|secret|username|login
security passwords min-length 12
enable secret 8 $8$Fkkw3ISPRQEmiE$/PqxlP...
login block-for 300 attempts 3 within 60
login on-failure log
login on-success log
username admin privilege 15 secret 8 $8$Ax...