CISC-RT-000010 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-220986r622190_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-110793

STIG-Legacy|V-101689

Vuln-ID|V-220986

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - bgp

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-220987r856398_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-110795

STIG-Legacy|V-101691

Vuln-ID|V-220987

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - eigrp

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - is-is

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - ospf

CISC-RT-000030 - The Cisco switch must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-220988r856399_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-110797

STIG-Legacy|V-101693

Vuln-ID|V-220988

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - bgp

CCI|CCI-000803

Rule-ID|SV-220989r622190_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-110799

STIG-Legacy|V-101695

Vuln-ID|V-220989

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - eigrp

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - is-is

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - ospf

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - rip

CISC-RT-000050 - The Cisco switch must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-220990r622190_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-110801

STIG-Legacy|V-101697

Vuln-ID|V-220990

CISC-RT-000060 - The Cisco switch must be configured to have all inactive layer 3 interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-220991r622190_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-110803

STIG-Legacy|V-101699

Vuln-ID|V-220991

CISC-RT-000080 - The Cisco switch must not be configured to have any feature enabled that calls home to the vendor.

CCI|CCI-002403

Rule-ID|SV-220993r856400_rule

STIG-ID|CISC-RT-000080

STIG-Legacy|SV-110807

STIG-Legacy|V-101703

Vuln-ID|V-220993

CISC-RT-000090 - The Cisco switch must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-220994r856401_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-110809

STIG-Legacy|V-101705

Vuln-ID|V-220994

CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

Rule-ID|SV-220995r856402_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-110811

STIG-Legacy|V-101707

Vuln-ID|V-220995

CISC-RT-000130 - The Cisco switch must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-220996r622190_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-110813

STIG-Legacy|V-101709

Vuln-ID|V-220996

CISC-RT-000140 - The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-220997r622190_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-110815

STIG-Legacy|V-101711

Vuln-ID|V-220997

CISC-RT-000150 - The Cisco switch must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-220998r856403_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-110817

STIG-Legacy|V-101713

Vuln-ID|V-220998

CISC-RT-000160 - The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-220999r856404_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-110819

STIG-Legacy|V-101715

Vuln-ID|V-220999

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

Rule-ID|SV-221000r856405_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-110821

STIG-Legacy|V-101717

Vuln-ID|V-221000

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - ip unreachables

CISC-RT-000180 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-221001r856406_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-110823

STIG-Legacy|V-101719

Vuln-ID|V-221001

CISC-RT-000190 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-221002r856407_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-110825

STIG-Legacy|V-101721

Vuln-ID|V-221002

CISC-RT-000200 - The Cisco switch must be configured to log all packets that have been dropped at interfaces via an ACL - ACL.

CCI|CCI-000134

Rule-ID|SV-221003r622190_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-110827

STIG-Legacy|V-101723

Vuln-ID|V-221003

CISC-RT-000210 - The Cisco switch must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-221004r622190_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-110829

STIG-Legacy|V-101725

Vuln-ID|V-221004

CISC-RT-000220 - The Cisco switch must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-221005r622190_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-110831

STIG-Legacy|V-101727

Vuln-ID|V-221005

CISC-RT-000230 - The Cisco switch must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-221006r622190_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-110833

STIG-Legacy|V-101729

Vuln-ID|V-221006

CISC-RT-000235 - The Cisco switch must be configured to have Cisco Express Forwarding enabled - ip

Rule-ID|SV-237750r648776_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-237750

CISC-RT-000235 - The Cisco switch must be configured to have Cisco Express Forwarding enabled - ipv6

CISC-RT-000236 - The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-237752r648780_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-237752

CISC-RT-000237 - The Cisco switch must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-237756r648787_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-237756

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception - access-group in

CCI|CCI-001109

Rule-ID|SV-221007r622190_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-110835

STIG-Legacy|V-101731

Vuln-ID|V-221007

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception - deny rule

CISC-RT-000250 - The Cisco perimeter switch must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-221008r622190_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-110837

STIG-Legacy|V-101733

Vuln-ID|V-221008

CISC-RT-000260 - The Cisco perimeter switch must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

Rule-ID|SV-221009r856408_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-110839

STIG-Legacy|V-101735

Vuln-ID|V-221009

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - access-group in

Rule-ID|SV-221010r863263_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-110841

STIG-Legacy|V-101737

Vuln-ID|V-221010

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 0.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 10.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 100.64.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 127.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 169.254.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 172.16.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.2.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.18.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.168.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 198.51.100.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 203.0.113.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 224.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 240.0.0.0

CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

Detections

Analytics

DISA STIG Cisco IOS XE Switch RTR v2r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Sep 19, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Mar 7, 2023 Miscellaneous Metadata updated. References updated.