CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-216551r531085_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-105641

STIG-Legacy|V-96503

Vuln-ID|V-216551

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - BGP

CCI|CCI-002205

Rule-ID|SV-216986r877977_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-105643

STIG-Legacy|V-96505

Vuln-ID|V-216986

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - EIGRP

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - IS-IS

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - OSPF

CISC-RT-000030 - The Cisco router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-216987r877978_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-105645

STIG-Legacy|V-96507

Vuln-ID|V-216987

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - BGP

CCI|CCI-000803

Rule-ID|SV-216554r892362_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-105647

STIG-Legacy|V-96509

Vuln-ID|V-216554

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - EIGRP

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - IS-IS

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - OSPF

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - RIP

CISC-RT-000050 - The Cisco router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-216555r531085_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-105649

STIG-Legacy|V-96511

Vuln-ID|V-216555

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-216556r531085_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-105651

STIG-Legacy|V-96513

Vuln-ID|V-216556

CISC-RT-000090 - The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-216559r856180_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-105657

STIG-Legacy|V-96519

Vuln-ID|V-216559

CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

Rule-ID|SV-216560r856181_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-105659

STIG-Legacy|V-96521

Vuln-ID|V-216560

CISC-RT-000130 - The Cisco router must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-216561r531085_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-105661

STIG-Legacy|V-96523

Vuln-ID|V-216561

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-216562r531085_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-105663

STIG-Legacy|V-96525

Vuln-ID|V-216562

CISC-RT-000150 - The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-216563r856182_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-105665

STIG-Legacy|V-96527

Vuln-ID|V-216563

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-216564r856183_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-105667

STIG-Legacy|V-96529

Vuln-ID|V-216564

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Rule-ID|SV-216565r856184_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-105669

STIG-Legacy|V-96531

Vuln-ID|V-216565

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-216566r856185_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-105671

STIG-Legacy|V-96533

Vuln-ID|V-216566

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-216567r856186_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-105673

STIG-Legacy|V-96535

Vuln-ID|V-216567

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via an ACL.

CCI|CCI-000134

Rule-ID|SV-216568r531085_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-105675

STIG-Legacy|V-96537

Vuln-ID|V-216568

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216569r531085_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-105677

STIG-Legacy|V-96539

Vuln-ID|V-216569

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-216570r531085_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-105679

STIG-Legacy|V-96541

Vuln-ID|V-216570

CISC-RT-000230 - The Cisco router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-216571r531085_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-105681

STIG-Legacy|V-96543

Vuln-ID|V-216571

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled.

CCI|CCI-000366

Rule-ID|SV-229030r878127_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-229030

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-230038r531386_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-230038

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-230041r532998_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-230041

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

CCI|CCI-001109

Rule-ID|SV-216572r531085_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-105683

STIG-Legacy|V-96545

Vuln-ID|V-216572

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-216573r531085_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-105685

STIG-Legacy|V-96547

Vuln-ID|V-216573

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Rule-ID|SV-216574r856187_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-105687

STIG-Legacy|V-96549

Vuln-ID|V-216574

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.

Rule-ID|SV-216575r863237_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-105689

STIG-Legacy|V-96551

Vuln-ID|V-216575

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

Rule-ID|SV-216576r531085_rule

STIG-ID|CISC-RT-000280

STIG-Legacy|SV-105691

STIG-Legacy|V-96553

Vuln-ID|V-216576

CISC-RT-000290 - The Cisco perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

Rule-ID|SV-216577r531085_rule

STIG-ID|CISC-RT-000290

STIG-Legacy|SV-105693

STIG-Legacy|V-96555

Vuln-ID|V-216577

CISC-RT-000300 - The Cisco perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

Rule-ID|SV-216578r531085_rule

STIG-ID|CISC-RT-000300

STIG-Legacy|SV-105695

STIG-Legacy|V-96557

Vuln-ID|V-216578

CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-216989r531085_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-105697

STIG-Legacy|V-96559

Vuln-ID|V-216989

CISC-RT-000320 - The Cisco perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-216580r531085_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-105699

Detections

Analytics

DISA STIG Cisco IOS Router RTR v2r4

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous