Some Security Cisco Commands

line con 0
logging synchronous ##### 开启日志同步，如果不敲这条命令，自动弹出日志的时候如果你在配置设备，你就会发现日志信息会把你敲入的命令分隔开，影响输入。敲上这条命令之后日志信息不会分隔你敲到一半的命令行。
transport preferred none #### https://blog.51cto.com/xpvista/177844 , 线上不允许任何协议选择。系统通常假设不认识的命令为主机名。如果协议设置为none，则系统不再作这个假设，不认识的命令不能建立连接。
line vty 0 4
logging synchronous
transport preferred none
transport input ssh
line vty 5 15
password 7 045802150C2E
logging synchronous
transport input none
!
ip telnet source-interface Vlan10
ip ftp source-interface Vlan10
ip tftp source-interface Vlan10
ip ssh time-out 60
ip ssh source-interface Vlan10
ip ssh version 2
!

logging trap notifications ## https://zhidao.baidu.com/question/1733168285133876827.html ,logging trap debugging 指定日志级别，可选的级别有0－7共八个级别，0最高，7最低。这八个级别分别为：
logging source-interface Vlan10
logging host 10.50.51.

interface Vlan10
ip address 10.45.38. 255.255.255.0
no ip redirects ### https://blog.youkuaiyun.com/a9254778/article/details/7308484 ,
no ip unreachables
no ip proxy-arp
!

interface GigabitEthernet0/2
description Uplink
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
srr-queue bandwidth share 1 70 25 5
priority-queue out
udld port aggressive
mls qos trust dscp
ip dhcp snooping trust
！

interface FastEthernet0/48
switchport access vlan 185
switchport mode access
switchport voice vlan 186
no logging event link-status
srr-queue bandwidth share 1 70 25 5
priority-queue out
no snmp trap link-status
spanning-tree portfast
service-policy input edge_edge_edge_edge_qos_marking
!

class-map match-all video_payload
match access-group name acl_video_payload
class-map match-all voice_payload
match access-group name acl_voice_payload
class-map match-all voice_control
match access-group name acl_voice_control
!
policy-map edge_edge_edge_edge_qos_marking
class voice_control
set ip dscp cs3
police 1000000 8000 exceed-action drop
class voice_payload
set ip dscp ef
police 1000000 8000 exceed-action drop
class video_payload
set dscp 63
!
vlan internal allocation policy ascending
!
errdisable recovery cause udld
errdisable recovery cause bpduguard
errdisable recovery cause security-violation
errdisable recovery cause channel-misconfig (STP)
errdisable recovery cause pagp-flap
errdisable recovery cause dtp-flap
errdisable recovery cause link-flap
errdisable recovery cause sfp-config-mismatch
errdisable recovery cause gbic-invalid
errdisable recovery cause l2ptguard
errdisable recovery cause psecure-violation
errdisable recovery cause port-mode-failure
errdisable recovery cause dhcp-rate-limit
errdisable recovery cause mac-limit
errdisable recovery cause vmps
errdisable recovery cause storm-control
errdisable recovery cause inline-power
errdisable recovery cause arp-inspection
errdisable recovery cause loopback
errdisable recovery cause small-frame
errdisable recovery interval 30
!
no dot1x logging verbose
!
mls qos queue-set output 1 threshold 1 200 200 50 400
mls qos queue-set output 1 threshold 2 400 400 50 400
mls qos queue-set output 1 buffers 10 50 20 20
no mls qos rewrite ip dscp
mls qos
epm access-control Open
!
ip dhcp snooping vlan 1,185-186
no ip dhcp snooping information option
ip dhcp snooping
ip device tracking probe use-svi
ip device tracking probe delay 10
ip device tracking
!
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
!