Cisco Catalyst SD-WAN Security & Configuration Audit — Certified Engineer Needed

Scope of Work 1. Controller and management plane vManage hardening review: RBAC and user roles, local vs TACACS+/RADIUS/SAML authentication, session and password policy, API/REST access, audit logging and log export, backup posture, cluster configuration vBond/vSmart hardening and reachability exposure Version and patch review against published Cisco security advisories/PSIRT for the running releases Certificate posture: CA method in use (Cisco-hosted, enterprise root CA, manual), certificate lifecycle, expiry risk, root CA distribution, device allow-list/serial file integrity 2. Control plane OMP configuration review: route advertisement, path selection, filtering, graceful restart, TLOC handling DTLS/TLS control connection posture, control policy review at vSmart Site/system ID structure, organization name and controller trust model 3. Data plane and transport IPsec/DTLS data plane settings: rekey timers, anti-replay, integrity/encryption suites, pairwise keys TLOC and color configuration: restrict/public-private exposure, tunnel interface allowed services (SSH, NETCONF, HTTPS, ICMP, SNMP, etc.) — flagging anything unnecessarily exposed on public transports TLOC extension review where used 4. Policy and segmentation Centralized and localized policy review (control, data, app-aware routing, cflowd) VPN/segment isolation validation — confirming that intended segmentation is actually enforced by policy, not just documented Service insertion and traffic hairpinning review 5. Edge/service-side security Zone-Based Firewall policy review on cEdge UTD/security virtual image features in use: Snort IPS/IDS, URL filtering, AMP, TLS/SSL decryption — signature currency, fail-open vs fail-closed behavior, logging DIA (Direct Internet Access) and NAT policy review, split-tunnel exposure Local device hardening: management access, SNMP, NetFlow, syslog, NTP, console/AUX, banner, unused services 6. Configuration consistency and drift Template vs configuration-group usage, device templates vs CLI add-ons, out-of-band/manual changes and drift from the intended baseline Duplicate, orphaned, or unused policies and objects Change management and configuration backup practices