interface GigabitEthernet0/1 description UPLINK-CORE-01 ip address 10.42.1.2 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip access-group HARDEN-IN in ip access-group HARDEN-OUT out service-policy input QOS-INGRESS ! ip access-list extended HARDEN-MGMT deny tcp any any eq 23 deny tcp any any eq 80 permit tcp 10.0.0.0 0.255.255.255 any eq 22 permit tcp 10.0.0.0 0.255.255.255 any eq 443 deny ip any any log ! line vty 0 4 access-class HARDEN-MGMT in transport input ssh transport output none exec-timeout 5 0 logging synchronous ! snmp-server group ADMIN v3 priv read SNMP-RO snmp-server view SNMP-RO iso included snmp-server host 10.42.99.5 version 3 priv ADMIN ! ntp server 10.42.99.10 prefer ntp server 10.42.99.11 ntp authentication-key 1 md5 [REDACTED] ntp trusted-key 1 ! aaa new-model aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local aaa accounting exec default start-stop group tacacs+ !

policy global-protect from-zone untrust to-zone trust match source-address any destination-address any application ssl web-browsing action allow profile-setting strict ! profile vulnerability strict rule block-critical severity critical action reset-both threat-name any cve-any ! profile url-filtering strict category command-and-control action block category malware action block category phishing action block ! profile file-blocking strict file-type pe action block file-type encrypted-rar action block ! log-settings system informational log-settings config any log-settings hip-match any log-settings global-protect any ! device-group HEADQUARTERS panorama 10.42.0.5 collector-group LOG-COLLECTOR ! template HARDENING-BASE ntp-server 10.42.99.10 authentication-type symmetric-key dns-server primary 10.42.99.20 secondary 10.42.99.21 banner login "Authorized access only. Activity is logged." timezone US/Eastern ssh-management ciphers aes256-ctr,aes192-ctr management-profile MGMT-RESTRICTED !

reconfigd

A daemon for network configuration audit and remediation. Ingests device configs, evaluates them against security frameworks, and ships ready-to-paste fixes — with the context engineers actually need.

in development

frameworks NIST · CIS · STIG

vendors cisco · palo · forti · juniper · meraki

reconfigd — systemctl status

root@viacursor