CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-group

CAT|II

CCI|CCI-001368

Rule-ID|SV-216735r531087_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-105815

STIG-Legacy|V-96677

Vuln-ID|V-216735

CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-list extended

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - BGP

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-217002r856457_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-105817

STIG-Legacy|V-96679

Vuln-ID|V-217002

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - EIGRP

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - IS-IS

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - OSPF

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - RIP

CISC-RT-000030 - The Cisco router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-217003r856458_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-105819

STIG-Legacy|V-96681

Vuln-ID|V-217003

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - BGP

CCI|CCI-000803

Rule-ID|SV-216738r894621_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-105821

STIG-Legacy|V-96683

Vuln-ID|V-216738

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - EIGRP

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - IS-IS

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - OSPF

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - RIP

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - tcp ao

CISC-RT-000050 - The Cisco router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-216739r531087_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-105823

STIG-Legacy|V-96685

Vuln-ID|V-216739

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-216740r531087_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-105825

STIG-Legacy|V-96687

Vuln-ID|V-216740

CISC-RT-000070 - The Cisco router must be configured to have all non-essential capabilities disabled.

CCI|CCI-000381

Rule-ID|SV-216741r531087_rule

STIG-ID|CISC-RT-000070

STIG-Legacy|SV-105827

STIG-Legacy|V-96689

Vuln-ID|V-216741

CISC-RT-000080 - The Cisco router must not be configured to have any feature enabled that calls home to the vendor.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-217004r538985_rule

STIG-ID|CISC-RT-000080

STIG-Legacy|SV-105829

STIG-Legacy|V-96691

Vuln-ID|V-217004

CISC-RT-000130 - The Cisco router must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-216743r531087_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-105831

STIG-Legacy|V-96693

Vuln-ID|V-216743

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - external

Rule-ID|SV-216744r531087_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-105833

STIG-Legacy|V-96695

Vuln-ID|V-216744

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - internal

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

CCI|CCI-002385

Rule-ID|SV-216745r856436_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-105835

STIG-Legacy|V-96697

Vuln-ID|V-216745

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

Rule-ID|SV-216746r856437_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-105837

STIG-Legacy|V-96699

Vuln-ID|V-216746

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-216747r856438_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-105839

STIG-Legacy|V-96701

Vuln-ID|V-216747

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-216748r856439_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-105841

STIG-Legacy|V-96703

Vuln-ID|V-216748

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.

CCI|CCI-000134

Rule-ID|SV-216749r531087_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-105843

STIG-Legacy|V-96705

Vuln-ID|V-216749

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216750r531087_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-105845

STIG-Legacy|V-96707

Vuln-ID|V-216750

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-216751r531087_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-105847

STIG-Legacy|V-96709

Vuln-ID|V-216751

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled - ip

Rule-ID|SV-230037r878128_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-230037

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled - ipv6

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-230040r532994_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-230040

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-230043r533001_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-230043

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - access-group in

CCI|CCI-001109

Rule-ID|SV-216752r531087_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-105849

STIG-Legacy|V-96711

Vuln-ID|V-216752

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - deny rule

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-216753r531087_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-105851

STIG-Legacy|V-96713

Vuln-ID|V-216753

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

Rule-ID|SV-216754r856440_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-105853

STIG-Legacy|V-96715

Vuln-ID|V-216754

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - access-group in

Rule-ID|SV-216755r856441_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-105855

STIG-Legacy|V-96717

Vuln-ID|V-216755

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 0.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 10.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 100.64.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 127.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 169.254.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 172.16.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.2.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.18.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.168.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 198.51.100.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 203.0.113.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 224.0.0.0

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space - ISP access list

Rule-ID|SV-216756r531087_rule

STIG-ID|CISC-RT-000280

STIG-Legacy|SV-105857

STIG-Legacy|V-96719

Vuln-ID|V-216756

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space - ISP interface

CISC-RT-000290 - The Cisco perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

Rule-ID|SV-216757r531087_rule

STIG-ID|CISC-RT-000290

STIG-Legacy|SV-105859

STIG-Legacy|V-96721

Vuln-ID|V-216757

CISC-RT-000300 - The Cisco perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

Detections

Analytics

DISA STIG Cisco IOS-XR Router RTR v2r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous