CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies

CAT|II

CCI|CCI-001368

Rule-ID|SV-216641r531086_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-105993

STIG-Legacy|V-96855

Vuln-ID|V-216641

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols.

CCI|CCI-002205

Rule-ID|SV-216994r877983_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-105995

STIG-Legacy|V-96857

Vuln-ID|V-216994

CISC-RT-000030 - The Cisco router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-216995r877984_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-105997

STIG-Legacy|V-96859

Vuln-ID|V-216995

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication.

CCI|CCI-000803

Rule-ID|SV-216644r894618_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-105999

STIG-Legacy|V-96861

Vuln-ID|V-216644

CISC-RT-000050 - The Cisco router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-216645r819134_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-106001

STIG-Legacy|V-96863

Vuln-ID|V-216645

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-216646r531086_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-106003

STIG-Legacy|V-96865

Vuln-ID|V-216646

CISC-RT-000090 - The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-216649r855812_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-106009

STIG-Legacy|V-96871

Vuln-ID|V-216649

CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection.

Rule-ID|SV-216650r855813_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-106011

STIG-Legacy|V-96873

Vuln-ID|V-216650

CISC-RT-000130 - The Cisco router must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-216651r531086_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-106013

STIG-Legacy|V-96875

Vuln-ID|V-216651

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself

Rule-ID|SV-216652r531086_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-106015

STIG-Legacy|V-96877

Vuln-ID|V-216652

CISC-RT-000150 - The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-216653r855814_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-106017

STIG-Legacy|V-96879

Vuln-ID|V-216653

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-216654r855815_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-106019

STIG-Legacy|V-96881

Vuln-ID|V-216654

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Rule-ID|SV-216655r855816_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-106021

STIG-Legacy|V-96883

Vuln-ID|V-216655

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-216656r855817_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-106023

STIG-Legacy|V-96885

Vuln-ID|V-216656

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-216657r855818_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-106025

STIG-Legacy|V-96887

Vuln-ID|V-216657

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.

CCI|CCI-000134

Rule-ID|SV-216658r531086_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-106027

STIG-Legacy|V-96889

Vuln-ID|V-216658

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216659r531086_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-106029

STIG-Legacy|V-96891

Vuln-ID|V-216659

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-216660r531086_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-106031

STIG-Legacy|V-96893

Vuln-ID|V-216660

CISC-RT-000230 - The Cisco router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-216661r531086_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-106033

STIG-Legacy|V-96895

Vuln-ID|V-216661

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled

CCI|CCI-000366

Rule-ID|SV-229031r878127_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-229031

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-230039r647454_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-230039

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-230042r647455_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-230042

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception

CCI|CCI-001109

Rule-ID|SV-216662r531086_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-106035

STIG-Legacy|V-96897

Vuln-ID|V-216662

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-216663r531086_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-106037

STIG-Legacy|V-96899

Vuln-ID|V-216663

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Rule-ID|SV-216664r855819_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-106039

STIG-Legacy|V-96901

Vuln-ID|V-216664

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes

Rule-ID|SV-216665r863260_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-106041

STIG-Legacy|V-96903

Vuln-ID|V-216665

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space

Rule-ID|SV-216666r531086_rule

STIG-ID|CISC-RT-000280

STIG-Legacy|SV-106043

STIG-Legacy|V-96905

Vuln-ID|V-216666

CISC-RT-000290 - The Cisco perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

Rule-ID|SV-216667r531086_rule

STIG-ID|CISC-RT-000290

STIG-Legacy|SV-106045

STIG-Legacy|V-96907

Vuln-ID|V-216667

CISC-RT-000300 - The Cisco perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an Interior Gateway Protocol (IGP) peering with the NIPRNet or to other autonomous systems.

Rule-ID|SV-216668r531086_rule

STIG-ID|CISC-RT-000300

STIG-Legacy|SV-106047

STIG-Legacy|V-96909

Vuln-ID|V-216668

CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-216997r531086_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-106049

STIG-Legacy|V-96911

Vuln-ID|V-216997

CISC-RT-000320 - The Cisco perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-216670r531086_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-106051

STIG-Legacy|V-96913

Vuln-ID|V-216670

CISC-RT-000330 - The Cisco perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-216671r531086_rule

STIG-ID|CISC-RT-000330

STIG-Legacy|SV-106053

STIG-Legacy|V-96915

Detections

Analytics

DISA STIG Cisco IOS XE Router RTR v2r8

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Dec 12, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Nov 9, 2023 Miscellaneous Metadata updated.