CISC-RT-000010 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-220419r622190_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-110685

STIG-Legacy|V-101581

Vuln-ID|V-220419

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - bgp

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-220468r856248_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-110687

STIG-Legacy|V-101583

Vuln-ID|V-220468

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - eigrp

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - is-is

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - ospf

CISC-RT-000030 - The Cisco switch must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-220469r856249_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-110689

STIG-Legacy|V-101585

Vuln-ID|V-220469

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - bgp

CCI|CCI-000803

Rule-ID|SV-220422r622190_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-110691

STIG-Legacy|V-101587

Vuln-ID|V-220422

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - eigrp

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - is-is

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - ospf

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - rip

CISC-RT-000050 - The Cisco switch must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-220423r622190_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-110693

STIG-Legacy|V-101589

Vuln-ID|V-220423

CISC-RT-000060 - The Cisco switch must be configured to have all inactive Layer 3 interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-220424r622190_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-110695

STIG-Legacy|V-101591

Vuln-ID|V-220424

CISC-RT-000080 - The Cisco switch must not be configured to have any feature enabled that calls home to the vendor.

CCI|CCI-002403

Rule-ID|SV-220470r856250_rule

STIG-ID|CISC-RT-000080

STIG-Legacy|SV-110699

STIG-Legacy|V-101595

Vuln-ID|V-220470

CISC-RT-000090 - The Cisco switch must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-220427r856231_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-110701

STIG-Legacy|V-101597

Vuln-ID|V-220427

CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

Rule-ID|SV-220428r856232_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-110703

STIG-Legacy|V-101599

Vuln-ID|V-220428

CISC-RT-000130 - The Cisco switch must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-220429r622190_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-110705

STIG-Legacy|V-101601

Vuln-ID|V-220429

CISC-RT-000140 - The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-220430r622190_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-110707

STIG-Legacy|V-101603

Vuln-ID|V-220430

CISC-RT-000150 - The Cisco switch must be configured to have gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-220431r856233_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-110709

STIG-Legacy|V-101605

Vuln-ID|V-220431

CISC-RT-000160 - The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-220432r856234_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-110711

STIG-Legacy|V-101607

Vuln-ID|V-220432

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

Rule-ID|SV-220433r856235_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-110713

STIG-Legacy|V-101609

Vuln-ID|V-220433

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - ip unreachables

CISC-RT-000180 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-220434r856236_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-110715

STIG-Legacy|V-101611

Vuln-ID|V-220434

CISC-RT-000190 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-220435r856237_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-110717

STIG-Legacy|V-101613

Vuln-ID|V-220435

CISC-RT-000200 - The Cisco switch must be configured to log all packets that have been dropped at interfaces via an access control list (ACL).

CCI|CCI-000134

Rule-ID|SV-220436r622190_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-110719

STIG-Legacy|V-101615

Vuln-ID|V-220436

CISC-RT-000210 - The Cisco switch must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-220437r622190_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-110721

STIG-Legacy|V-101617

Vuln-ID|V-220437

CISC-RT-000220 - The Cisco switch must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-220438r622190_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-110723

STIG-Legacy|V-101619

Vuln-ID|V-220438

CISC-RT-000230 - The Cisco switch must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-220439r622190_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-110725

STIG-Legacy|V-101621

Vuln-ID|V-220439

CISC-RT-000235 - The Cisco switch must be configured to have Cisco Express Forwarding enabled - ip

Rule-ID|SV-237749r648775_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-237749

CISC-RT-000235 - The Cisco switch must be configured to have Cisco Express Forwarding enabled - ipv6

CISC-RT-000236 - The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-237751r648779_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-237751

CISC-RT-000237 - The Cisco switch must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-237755r648786_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-237755

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception - access-group in

CCI|CCI-001109

Rule-ID|SV-220440r622190_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-110727

STIG-Legacy|V-101623

Vuln-ID|V-220440

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception - deny rule

CISC-RT-000250 - The Cisco perimeter switch must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-220441r622190_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-110729

STIG-Legacy|V-101625

Vuln-ID|V-220441

CISC-RT-000260 - The Cisco perimeter switch must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

Rule-ID|SV-220442r856238_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-110731

STIG-Legacy|V-101627

Vuln-ID|V-220442

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - access-group in

Rule-ID|SV-220443r863240_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-110733

STIG-Legacy|V-101629

Vuln-ID|V-220443

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 0.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 10.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 100.64.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 127.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 169.254.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 172.16.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.2.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.18.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.168.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 198.51.100.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 203.0.113.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 224.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 240.0.0.0

CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

Detections

Analytics

DISA STIG Cisco IOS Switch RTR v2r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Sep 12, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Mar 7, 2023 Miscellaneous Metadata updated. References updated.