Cisco IOS Cookbook, 2nd Edition

Disabling Router Lines

Problem

You want to disable your router’s AUX port to help prevent unauthorized access.

Solution

To completely disable access via the router’s AUX port, use the following set of commands:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#line aux 0
Router1(config-line)#transport input none
Router1(config-line)#no exec
Router1(config-line)#exec-timeout 0 1
Router1(config-line)#no password
Router1(config-line)#exit
Router1(config)#end
Router1#

You can disable access to the router through the VTY lines as follows:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#access-list 98 deny any log
Router1(config)#line vty 0 4
Router1(config-line)#transport input none
Router1(config-line)#exec-timeout 0 1
Router1(config-line)#no exec
Router1(config-line)#access-class 98 in
Router1(config-line)#exit
Router1(config)#end
Router1#

Discussion

It is extremely important to secure access to your routers. The most effective way to secure router ports is to simply disable them if they aren’t needed. Of course, it isn’t always feasible to disable all router ports, but you can improve security by disabling any unused ones. For instance, network administrators rarely use the router’s AUX port, so they should consider disabling it. If your routers are physically close to the administrators so that remote access is not necessary, you might want to disable the VTY ports as well to provide ...