PCI-DSS 4.0 Hardening Guide for Peplink

This is a practical hardening workflow for bringing a Peplink network in line with PCI-DSS 4.0, driven almost entirely from InControl so it scales to a fleet. It complements Peplink’s own hardening guide.

Prerequisites: Balance/MAX/EPX on current firmware, InControl access, a dedicated management VLAN, and ideally a SIEM for log monitoring.

1 — Unique credentials

InControl → Group → Device System Management: replace the default admin username, assign a unique/random password per device, keep secure backups, and rotate every ~180 days.

2 — Restrict management access

Authenticate via local/RADIUS/TACACS; optionally disable CLI/SSH consoles. Force HTTPS-only web admin, limit it to the LAN and the management VLAN, and block guest/staff networks. Apply the same to switches and APs.

3 — LCD front-panel security

Password-protect the device’s physical LCD to prevent local tampering.

4 — Multi-factor authentication

Organization Settings → enable Force Two-Factor Authentication for all users.

5 — Disable ICMP responses

For each WAN (see WAN Interfaces), uncheck Reply to ICMP Ping.

6 — Firewall: deny by default

Create a rule set named “PCI DSS 4”: default inbound = Deny, enable Intrusion & DoS Protection; optionally block risky regions (with logging) and allow only approved SaaS (Google Workspace, Microsoft 365).

7 — Content blocking

Block adware, malware, proxy/anonymizers, BitTorrent, DNS-over-SSL, DNSCrypt, and Tor; enable automatic URL-database updates.

8 — Segment the POS network

Create a dedicated POS VLAN (e.g. VLAN 200), disable inter-VLAN routing, and add three logged firewall rules: POS → approved servers (allow), POS → anything else (deny), other networks → POS (deny). Use a grouped network for the approved POS servers.

9 — Logging & monitoring

Enable logging on every firewall policy; under Device System Management → Logging, enable SNMP, NetFlow, and remote syslog to your SIEM.

10 — Review & document

Review firewall rules every 6 months, track changes in the operational log, and document segmentation (PCI-DSS 1.1.7).

11 — Incident response

Document procedures for rule changes and device installation (VLAN/IP documentation, service approval), train the team, and wire SIEM alerts to ticketing.