CISC-ND-000010 - The Cisco router must be configured to limit the number of concurrent management sessions to an organization-defined number.

CAT|II

CCI|CCI-000054

Rule-ID|SV-216522r879511_rule

STIG-ID|CISC-ND-000010

STIG-Legacy|SV-105509

STIG-Legacy|V-96371

Vuln-ID|V-216522

CISC-ND-000140 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - access-class deny

CCI|CCI-001368

Rule-ID|SV-216523r879533_rule

STIG-ID|CISC-ND-000140

STIG-Legacy|SV-105517

STIG-Legacy|V-96379

Vuln-ID|V-216523

CISC-ND-000140 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - access-class permit

CISC-ND-000140 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - line default

CISC-ND-000140 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - vty-pool

CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes - aaa auth

CCI|CCI-000044

Rule-ID|SV-216524r879546_rule

STIG-ID|CISC-ND-000150

STIG-Legacy|SV-105519

STIG-Legacy|V-96381

Vuln-ID|V-216524

CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes - line console

CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes - line default

CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes - server host

CISC-ND-000160 - The Cisco router must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

CCI|CCI-000048

Rule-ID|SV-216525r879547_rule

STIG-ID|CISC-ND-000160

STIG-Legacy|SV-105521

STIG-Legacy|V-96383

Vuln-ID|V-216525

CISC-ND-000250 - The Cisco router must be configured to generate audit records when successful/unsuccessful attempts to logon with access privileges occur.

CCI|CCI-000172

Rule-ID|SV-216526r879561_rule

STIG-ID|CISC-ND-000250

STIG-Legacy|SV-105531

STIG-Legacy|V-96393

Vuln-ID|V-216526

CISC-ND-000280 - The Cisco router must produce audit records containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-216527r879564_rule

STIG-ID|CISC-ND-000280

STIG-Legacy|SV-105533

STIG-Legacy|V-96395

Vuln-ID|V-216527

CISC-ND-000290 - The Cisco router must produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216528r929028_rule

STIG-ID|CISC-ND-000290

STIG-Legacy|SV-105535

STIG-Legacy|V-96397

Vuln-ID|V-216528

CISC-ND-000470 - The Cisco router must be configured to be configured to prohibit the use of all unnecessary and nonsecure functions and services.

CAT|I

CCI|CCI-000382

Rule-ID|SV-216529r879588_rule

STIG-ID|CISC-ND-000470

STIG-Legacy|SV-105541

STIG-Legacy|V-96403

Vuln-ID|V-216529

CISC-ND-000490 - The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - aaa auth

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-216530r879589_rule

STIG-ID|CISC-ND-000490

STIG-Legacy|SV-105545

STIG-Legacy|V-96407

Vuln-ID|V-216530

CISC-ND-000490 - The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - username

CISC-ND-000490 - The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - username groups

CISC-ND-000530 - The Cisco router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ssh version

CCI|CCI-001941

Rule-ID|SV-216531r879597_rule

STIG-ID|CISC-ND-000530

STIG-Legacy|SV-105551

STIG-Legacy|V-96413

Vuln-ID|V-216531

CISC-ND-000720 - The Cisco router must be configured to terminate all network connections associated with device management after five minutes of inactivity - line console

CCI|CCI-001133

Rule-ID|SV-216532r916342_rule

STIG-ID|CISC-ND-000720

STIG-Legacy|SV-105559

STIG-Legacy|V-96421

Vuln-ID|V-216532

CISC-ND-000720 - The Cisco router must be configured to terminate all network connections associated with device management after five minutes of inactivity - line default

CISC-ND-000980 - The Cisco router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements - logging archive

CCI|CCI-001849

Rule-ID|SV-216533r879730_rule

STIG-ID|CISC-ND-000980

STIG-Legacy|SV-105581

STIG-Legacy|V-96443

Vuln-ID|V-216533

CISC-ND-000980 - The Cisco router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements - logging buffered

CISC-ND-001000 - The Cisco router must be configured to generate an alert for all audit failure events - logging host

CCI|CCI-001858

Rule-ID|SV-216534r879733_rule

STIG-ID|CISC-ND-001000

STIG-Legacy|SV-105585

STIG-Legacy|V-96447

Vuln-ID|V-216534

CISC-ND-001030 - The Cisco router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources - NTP_SERVER_1

CCI|CCI-000366

CCI|CCI-001893

Rule-ID|SV-216535r879746_rule

STIG-ID|CISC-ND-001030

STIG-Legacy|SV-105587

STIG-Legacy|V-96449

Vuln-ID|V-216535

CISC-ND-001030 - The Cisco router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources - NTP_SERVER_2

CISC-ND-001040 - The Cisco router must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.

CCI|CCI-001889

Rule-ID|SV-216536r879748_rule

STIG-ID|CISC-ND-001040

STIG-Legacy|SV-105589

STIG-Legacy|V-96451

Vuln-ID|V-216536

CISC-ND-001050 - The Cisco router must be configured to record time stamps for log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) - clock timezone

CCI|CCI-001890

Rule-ID|SV-216537r879747_rule

STIG-ID|CISC-ND-001050

STIG-Legacy|SV-105591

STIG-Legacy|V-96453

Vuln-ID|V-216537

CISC-ND-001050 - The Cisco router must be configured to record time stamps for log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) - service timestamps

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server group

CCI|CCI-001967

Rule-ID|SV-216538r879768_rule

STIG-ID|CISC-ND-001130

STIG-Legacy|SV-105601

STIG-Legacy|V-96463

Vuln-ID|V-216538

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server host

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server user

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server view V3READ

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server view V3WRITE

CISC-ND-001140 - The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm - snmp-server group

CCI|CCI-000068

Rule-ID|SV-216539r879768_rule

STIG-ID|CISC-ND-001140

STIG-Legacy|SV-105603

STIG-Legacy|V-96465

Vuln-ID|V-216539

CISC-ND-001140 - The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm - snmp-server user

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp authenticate

Rule-ID|SV-216540r879768_rule

STIG-ID|CISC-ND-001150

STIG-Legacy|SV-105605

STIG-Legacy|V-96467

Vuln-ID|V-216540

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp authentication-key

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp NTP_SERVER_1 authentication-key

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp NTP_SERVER_2 authentication-key

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp trusted-key

CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.

CCI|CCI-002890

Rule-ID|SV-216541r879784_rule

STIG-ID|CISC-ND-001200

STIG-Legacy|SV-105611

STIG-Legacy|V-96473

Vuln-ID|V-216541

CISC-ND-001210 - The Cisco router must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.

CCI|CCI-003123

Rule-ID|SV-216542r879785_rule

STIG-ID|CISC-ND-001210

STIG-Legacy|SV-105613

STIG-Legacy|V-96475

Vuln-ID|V-216542

CISC-ND-001310 - The Cisco router must be configured to off-load log records onto a different system than the system being audited.

CCI|CCI-001851

Rule-ID|SV-216543r879886_rule

STIG-ID|CISC-ND-001310

STIG-Legacy|SV-105615

STIG-Legacy|V-96477

Vuln-ID|V-216543

CISC-ND-001370 - The Cisco router must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access - aaa authentication login

CCI|CCI-000370

Rule-ID|SV-216544r916111_rule

STIG-ID|CISC-ND-001370

STIG-Legacy|SV-105621

STIG-Legacy|V-96483

Vuln-ID|V-216544

CISC-ND-001370 - The Cisco router must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access - line console

CISC-ND-001370 - The Cisco router must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access - line default

CISC-ND-001370 - The Cisco router must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access - server host

CISC-ND-001410 - The Cisco router must be configured to back up the configuration when changes occur.

CCI|CCI-000537

Rule-ID|SV-216545r916221_rule

STIG-ID|CISC-ND-001410

STIG-Legacy|SV-105629

STIG-Legacy|V-96491

Vuln-ID|V-216545

CISC-ND-001440 - The Cisco router must be configured to obtain its public key certificates from an appropriate certificate policy through an approved service provider - crypto pki trustpoint

Detections

Analytics

DISA STIG Cisco IOS-XR Router NDM v2r4

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Jun 17, 2024 Miscellaneous Metadata updated.
Revision 1.1 Apr 3, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.