Detections
Analytics

DISA STIG Cisco IOS XE Router RTR v2r2

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: DISA STIG Cisco IOS XE Router RTR v2r2

Updated: 3/22/2022

Authority: DISA STIG

Plugin: Cisco

Revision: 1.3

Estimated Item Count: 152

Audit Items

DescriptionCategories
CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-group
CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-list extended
CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - BGP
CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - EIGRP

SYSTEM AND COMMUNICATIONS PROTECTION

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - IS-IS

ACCESS CONTROL

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - OSPF

ACCESS CONTROL

CISC-RT-000030 - The Cisco router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

ACCESS CONTROL

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - BGP
CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - EIGRP
CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - IS-IS

SYSTEM AND COMMUNICATIONS PROTECTION

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - OSPF

IDENTIFICATION AND AUTHENTICATION

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - RIP

SYSTEM AND COMMUNICATIONS PROTECTION

CISC-RT-000050 - The Cisco router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

IDENTIFICATION AND AUTHENTICATION

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

ACCESS CONTROL

CISC-RT-000070 - The Cisco router must be configured to have all non-essential capabilities disabled.

CONFIGURATION MANAGEMENT

CISC-RT-000080 - The Cisco router must not be configured to have any feature enabled that calls home to the vendor.

SYSTEM AND COMMUNICATIONS PROTECTION

CISC-RT-000090 - The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CONFIGURATION MANAGEMENT

CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection - DoS attacks by employing control plane protection.

CONFIGURATION MANAGEMENT

CISC-RT-000130 - The Cisco router must be configured to restrict traffic destined to itself.
CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - external
CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - internal
CISC-RT-000150 - The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.

SYSTEM AND COMMUNICATIONS PROTECTION

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

SYSTEM AND COMMUNICATIONS PROTECTION

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

SYSTEM AND COMMUNICATIONS PROTECTION

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

SYSTEM AND COMMUNICATIONS PROTECTION

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.
CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

SYSTEM AND COMMUNICATIONS PROTECTION

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.
CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.
CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.
CISC-RT-000230 - The Cisco router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

CONFIGURATION MANAGEMENT

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled - ip

CONFIGURATION MANAGEMENT

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled - ipv6

CONFIGURATION MANAGEMENT

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

CONFIGURATION MANAGEMENT

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

CONFIGURATION MANAGEMENT

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - access-group in
CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - deny rule
CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.
CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - access-group in
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 0.0.0.0
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 10.0.0.0
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 100.64.0.0
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 127.0.0.0
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 169.254.0.0
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 172.16.0.0
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.0.0
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.2.0
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.18.0.0
CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.168.0.0