Management protocols like NETCONF access network elements on well-known ports. Which design practice hardens a network device implementation?

While specifying the source interface for SSH can control which interface is used for outbound SSH connections from the device, it does not directly limit inbound access to the device's management plane, which is the focus of hardening.

Limiting access to management ports (like 830 for NETCONF), restricting which source IP addresses or clients can connect, and securing the SSH VTY (Virtual Terminal Line) access are all crucial steps to reduce the attack surface and prevent unauthorized access to a network device's management plane.

CoPP (Control Plane Policing) protects the device's CPU from excessive traffic by rate-limiting packets destined for the control plane, which is a good security practice but broader than hardening access to well-known management ports.

Configuring `ip http secure-server` enables secure HTTPS access to the device's web interface, but it doesn't cover NETCONF access on port 830 or general SSH VTY hardening.