CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies

CAT|II

CCI|CCI-001368

Rule-ID|SV-216735r531087_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-105815

STIG-Legacy|V-96677

Vuln-ID|V-216735

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - BGP

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-217002r856457_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-105817

STIG-Legacy|V-96679

Vuln-ID|V-217002

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - EIGRP

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - IS-IS

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - OSPF

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - RIP

CISC-RT-000030 - The Cisco router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-217003r856458_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-105819

STIG-Legacy|V-96681

Vuln-ID|V-217003

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - BGP

CCI|CCI-000803

Rule-ID|SV-216738r894621_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-105821

STIG-Legacy|V-96683

Vuln-ID|V-216738

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - EIGRP

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - IS-IS

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - OSPF

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - RIP

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - tcp ao

CISC-RT-000050 - The Cisco router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-216739r531087_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-105823

STIG-Legacy|V-96685

Vuln-ID|V-216739

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-216740r531087_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-105825

STIG-Legacy|V-96687

Vuln-ID|V-216740

CISC-RT-000070 - The Cisco router must be configured to have all non-essential capabilities disabled.

CCI|CCI-000381

Rule-ID|SV-216741r531087_rule

STIG-ID|CISC-RT-000070

STIG-Legacy|SV-105827

STIG-Legacy|V-96689

Vuln-ID|V-216741

CISC-RT-000080 - The Cisco router must not be configured to have any feature enabled that calls home to the vendor.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-217004r538985_rule

STIG-ID|CISC-RT-000080

STIG-Legacy|SV-105829

STIG-Legacy|V-96691

Vuln-ID|V-217004

CISC-RT-000130 - The Cisco router must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-216743r531087_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-105831

STIG-Legacy|V-96693

Vuln-ID|V-216743

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself

Rule-ID|SV-216744r531087_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-105833

STIG-Legacy|V-96695

Vuln-ID|V-216744

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

CCI|CCI-002385

Rule-ID|SV-216745r856436_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-105835

STIG-Legacy|V-96697

Vuln-ID|V-216745

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

Rule-ID|SV-216746r856437_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-105837

STIG-Legacy|V-96699

Vuln-ID|V-216746

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-216747r856438_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-105839

STIG-Legacy|V-96701

Vuln-ID|V-216747

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-216748r856439_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-105841

STIG-Legacy|V-96703

Vuln-ID|V-216748

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.

CCI|CCI-000134

Rule-ID|SV-216749r531087_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-105843

STIG-Legacy|V-96705

Vuln-ID|V-216749

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216750r531087_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-105845

STIG-Legacy|V-96707

Vuln-ID|V-216750

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-216751r531087_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-105847

STIG-Legacy|V-96709

Vuln-ID|V-216751

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled

Rule-ID|SV-230037r878128_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-230037

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-230040r532994_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-230040

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-230043r533001_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-230043

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception

CCI|CCI-001109

Rule-ID|SV-216752r531087_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-105849

STIG-Legacy|V-96711

Vuln-ID|V-216752

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-216753r531087_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-105851

STIG-Legacy|V-96713

Vuln-ID|V-216753

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

Rule-ID|SV-216754r856440_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-105853

STIG-Legacy|V-96715

Vuln-ID|V-216754

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes

Rule-ID|SV-216755r856441_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-105855

STIG-Legacy|V-96717

Vuln-ID|V-216755

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space

Rule-ID|SV-216756r531087_rule

STIG-ID|CISC-RT-000280

STIG-Legacy|SV-105857

STIG-Legacy|V-96719

Vuln-ID|V-216756

CISC-RT-000290 - The Cisco perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

Rule-ID|SV-216757r531087_rule

STIG-ID|CISC-RT-000290

STIG-Legacy|SV-105859

STIG-Legacy|V-96721

Vuln-ID|V-216757

CISC-RT-000300 - The Cisco perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

Rule-ID|SV-216758r531087_rule

STIG-ID|CISC-RT-000300

STIG-Legacy|SV-105861

STIG-Legacy|V-96723

Vuln-ID|V-216758

CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-217005r531087_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-105863

STIG-Legacy|V-96725

Vuln-ID|V-217005

CISC-RT-000320 - The Cisco perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-216760r531087_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-105865

STIG-Legacy|V-96727

Vuln-ID|V-216760

CISC-RT-000330 - The Cisco perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-216761r531087_rule

STIG-ID|CISC-RT-000330

STIG-Legacy|SV-105867

STIG-Legacy|V-96729

Detections

Analytics

DISA STIG Cisco IOS-XR Router RTR v2r3

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous