CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-group

CAT|II

CCI|CCI-001368

Rule-ID|SV-105641r1_rule

STIG-ID|CISC-RT-000010

Vuln-ID|V-96503

CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-list extended

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - BGP

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-105643r3_rule

STIG-ID|CISC-RT-000020

Vuln-ID|V-96505

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - EIGRP

800-53|SC-8(1)

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - IS-IS

800-53|AC-4

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - OSPF

CISC-RT-000030 - The Cisco router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

800-53|AC-4(17)

Rule-ID|SV-105645r2_rule

STIG-ID|CISC-RT-000030

Vuln-ID|V-96507

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - BGP

CCI|CCI-000803

Rule-ID|SV-105647r1_rule

STIG-ID|CISC-RT-000040

Vuln-ID|V-96509

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - EIGRP

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - IS-IS

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - OSPF

800-53|IA-7

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - RIP

CISC-RT-000050 - The Cisco router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-105649r1_rule

STIG-ID|CISC-RT-000050

Vuln-ID|V-96511

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-105651r1_rule

STIG-ID|CISC-RT-000060

Vuln-ID|V-96513

CISC-RT-000070 - The Cisco router must be configured to have all non-essential capabilities disabled.

800-53|CM-7

CCI|CCI-000381

Rule-ID|SV-105653r1_rule

STIG-ID|CISC-RT-000070

Vuln-ID|V-96515

CISC-RT-000080 - The Cisco router must not be configured to have any feature enabled that calls home to the vendor.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-105655r2_rule

STIG-ID|CISC-RT-000080

Vuln-ID|V-96517

CISC-RT-000090 - The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-105657r1_rule

STIG-ID|CISC-RT-000090

Vuln-ID|V-96519

CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

800-53|CM-6

CSCv6|3.1

Rule-ID|SV-105659r1_rule

STIG-ID|CISC-RT-000120

Vuln-ID|V-96521

CISC-RT-000130 - The Cisco router must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-105661r1_rule

STIG-ID|CISC-RT-000130

Vuln-ID|V-96523

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - external

Rule-ID|SV-105663r2_rule

STIG-ID|CISC-RT-000140

Vuln-ID|V-96525

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - internal

CISC-RT-000150 - The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.

800-53|SC-5

Rule-ID|SV-105665r1_rule

STIG-ID|CISC-RT-000150

Vuln-ID|V-96527

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-105667r1_rule

STIG-ID|CISC-RT-000160

Vuln-ID|V-96529

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

Rule-ID|SV-105669r1_rule

STIG-ID|CISC-RT-000170

Vuln-ID|V-96531

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

800-53|SC-7(16)

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-105671r1_rule

STIG-ID|CISC-RT-000180

Vuln-ID|V-96533

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-105673r1_rule

STIG-ID|CISC-RT-000190

Vuln-ID|V-96535

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via an ACL.

CCI|CCI-000134

Rule-ID|SV-105675r1_rule

STIG-ID|CISC-RT-000200

Vuln-ID|V-96537

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-105677r1_rule

STIG-ID|CISC-RT-000210

Vuln-ID|V-96539

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-105679r1_rule

STIG-ID|CISC-RT-000220

Vuln-ID|V-96541

CISC-RT-000230 - The Cisco router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

CSCv6|9.1

Rule-ID|SV-105681r1_rule

STIG-ID|CISC-RT-000230

Vuln-ID|V-96543

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - access-group in

CCI|CCI-001109

Rule-ID|SV-105683r1_rule

STIG-ID|CISC-RT-000240

Vuln-ID|V-96545

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - deny rule

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-105685r2_rule

STIG-ID|CISC-RT-000250

Vuln-ID|V-96547

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

Rule-ID|SV-105687r2_rule

STIG-ID|CISC-RT-000260

Vuln-ID|V-96549

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - access-group in

Rule-ID|SV-105689r1_rule

STIG-ID|CISC-RT-000270

Vuln-ID|V-96551

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 0.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 10.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 100.64.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 127.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 169.254.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 172.16.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.2.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.18.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.168.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 198.51.100.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 203.0.113.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 224.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 240.0.0.0

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space - ISP access list

Rule-ID|SV-105691r2_rule

STIG-ID|CISC-RT-000280

Vuln-ID|V-96553

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space - ISP interface

CISC-RT-000290 - The Cisco perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

Rule-ID|SV-105693r2_rule

STIG-ID|CISC-RT-000290

Vuln-ID|V-96555

CISC-RT-000300 - The Cisco perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

Rule-ID|SV-105695r1_rule

STIG-ID|CISC-RT-000300

Vuln-ID|V-96557

CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-105697r2_rule

STIG-ID|CISC-RT-000310

Vuln-ID|V-96559

CISC-RT-000320 - The Cisco perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-105699r1_rule

STIG-ID|CISC-RT-000320

Vuln-ID|V-96561

CISC-RT-000330 - The Cisco perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-105701r1_rule

STIG-ID|CISC-RT-000330

Vuln-ID|V-96563

CISC-RT-000340 - The Cisco perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-105703r1_rule

STIG-ID|CISC-RT-000340

Vuln-ID|V-96565

CISC-RT-000350 - The Cisco perimeter router must be configured to block all packets with any IP options.

Rule-ID|SV-105705r2_rule

STIG-ID|CISC-RT-000350

Vuln-ID|V-96567

CISC-RT-000360 - The Cisco perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

Rule-ID|SV-105707r1_rule

STIG-ID|CISC-RT-000360

Vuln-ID|V-96569

CISC-RT-000370 - The Cisco perimeter router must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.

Rule-ID|SV-105709r1_rule

STIG-ID|CISC-RT-000370

Vuln-ID|V-96571

CISC-RT-000380 - The Cisco perimeter router must be configured to have Proxy ARP disabled on all external interfaces.

Rule-ID|SV-105711r1_rule

STIG-ID|CISC-RT-000380

Vuln-ID|V-96573

CISC-RT-000390 - The Cisco perimeter router must be configured to block all outbound management traffic - ip access-group EXTERNAL_ACL_OUTBOUND out

Detections

Analytics

DISA STIG Cisco IOS Router RTR v1r4

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous