CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-216735r531087_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-105815

STIG-Legacy|V-96677

Vuln-ID|V-216735

CISC-RT-000050 - The Cisco router must be configured to enable routing protocol authentication using FIPS 198-1 algorithms with keys not exceeding 180 days of lifetime.

CCI|CCI-000803

CCI|CCI-002205

Rule-ID|SV-216739r929061_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-105823

STIG-Legacy|V-96685

Vuln-ID|V-216739

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-216740r531087_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-105825

STIG-Legacy|V-96687

Vuln-ID|V-216740

CISC-RT-000070 - The Cisco router must be configured to have all non-essential capabilities disabled.

CCI|CCI-000381

Rule-ID|SV-216741r531087_rule

STIG-ID|CISC-RT-000070

STIG-Legacy|SV-105827

STIG-Legacy|V-96689

Vuln-ID|V-216741

CISC-RT-000130 - The Cisco router must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-216743r531087_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-105831

STIG-Legacy|V-96693

Vuln-ID|V-216743

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - ICMP packets destined to itself

Rule-ID|SV-216744r531087_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-105833

STIG-Legacy|V-96695

Vuln-ID|V-216744

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

CCI|CCI-002385

Rule-ID|SV-216745r856436_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-105835

STIG-Legacy|V-96697

Vuln-ID|V-216745

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

Rule-ID|SV-216746r856437_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-105837

STIG-Legacy|V-96699

Vuln-ID|V-216746

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-216747r856438_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-105839

STIG-Legacy|V-96701

Vuln-ID|V-216747

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-216748r856439_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-105841

STIG-Legacy|V-96703

Vuln-ID|V-216748

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.

CCI|CCI-000134

Rule-ID|SV-216749r531087_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-105843

STIG-Legacy|V-96705

Vuln-ID|V-216749

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216750r531087_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-105845

STIG-Legacy|V-96707

Vuln-ID|V-216750

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-216751r531087_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-105847

STIG-Legacy|V-96709

Vuln-ID|V-216751

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled.

CCI|CCI-000366

Rule-ID|SV-230037r878128_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-230037

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-230040r532994_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-230040

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-230043r533001_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-230043

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

CCI|CCI-001109

Rule-ID|SV-216752r531087_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-105849

STIG-Legacy|V-96711

Vuln-ID|V-216752

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-216753r531087_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-105851

STIG-Legacy|V-96713

Vuln-ID|V-216753

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Rule-ID|SV-216754r856440_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-105853

STIG-Legacy|V-96715

Vuln-ID|V-216754

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.

Rule-ID|SV-216755r856441_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-105855

STIG-Legacy|V-96717

Vuln-ID|V-216755

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

Rule-ID|SV-216756r531087_rule

STIG-ID|CISC-RT-000280

STIG-Legacy|SV-105857

STIG-Legacy|V-96719

Vuln-ID|V-216756

CISC-RT-000290 - The Cisco perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

Rule-ID|SV-216757r531087_rule

STIG-ID|CISC-RT-000290

STIG-Legacy|SV-105859

STIG-Legacy|V-96721

Vuln-ID|V-216757

CISC-RT-000300 - The Cisco perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

Rule-ID|SV-216758r531087_rule

STIG-ID|CISC-RT-000300

STIG-Legacy|SV-105861

STIG-Legacy|V-96723

Vuln-ID|V-216758

CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-217005r531087_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-105863

STIG-Legacy|V-96725

Vuln-ID|V-217005

CISC-RT-000320 - The Cisco perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-216760r531087_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-105865

STIG-Legacy|V-96727

Vuln-ID|V-216760

CISC-RT-000330 - The Cisco perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-216761r531087_rule

STIG-ID|CISC-RT-000330

STIG-Legacy|SV-105867

STIG-Legacy|V-96729

Vuln-ID|V-216761

CISC-RT-000340 - The Cisco perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-216762r531087_rule

STIG-ID|CISC-RT-000340

STIG-Legacy|SV-105869

STIG-Legacy|V-96731

Vuln-ID|V-216762

CISC-RT-000350 - The Cisco perimeter router must be configured to block all packets with any IP options.

Rule-ID|SV-217006r856461_rule

STIG-ID|CISC-RT-000350

STIG-Legacy|SV-105871

STIG-Legacy|V-96733

Vuln-ID|V-217006

CISC-RT-000360 - The Cisco perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

Rule-ID|SV-216764r856442_rule

STIG-ID|CISC-RT-000360

STIG-Legacy|SV-105873

STIG-Legacy|V-96735

Vuln-ID|V-216764

CISC-RT-000370 - The Cisco perimeter router must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.

Rule-ID|SV-216765r856443_rule

STIG-ID|CISC-RT-000370

STIG-Legacy|SV-105875

STIG-Legacy|V-96737

Vuln-ID|V-216765

CISC-RT-000380 - The Cisco perimeter router must be configured to have Proxy ARP disabled on all external interfaces.

Rule-ID|SV-216766r856444_rule

STIG-ID|CISC-RT-000380

STIG-Legacy|SV-105877

STIG-Legacy|V-96739

Vuln-ID|V-216766

CISC-RT-000390 - The Cisco perimeter router must be configured to block all outbound management traffic.

Rule-ID|SV-216767r531087_rule

STIG-ID|CISC-RT-000390

Detections

Analytics

DISA STIG Cisco IOS-XR Router RTR v2r4

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Aug 26, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Jun 17, 2024 Miscellaneous Metadata updated.