CISC-RT-000010 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-110961r1_rule

STIG-ID|CISC-RT-000010

Vuln-ID|V-101857

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - bgp

800-53|AC-4(17)

800-53|CM-6

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-110963r1_rule

STIG-ID|CISC-RT-000020

Vuln-ID|V-101859

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - eigrp

800-53|SC-8(1)

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - is-is

800-53|IA-7

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - ospf

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols - rip

CISC-RT-000030 - The Cisco switch must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-110965r1_rule

STIG-ID|CISC-RT-000030

Vuln-ID|V-101861

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - bgp

CCI|CCI-000803

Rule-ID|SV-110967r1_rule

STIG-ID|CISC-RT-000040

Vuln-ID|V-101863

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - eigrp

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - is-is

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - ospf

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication - rip

CISC-RT-000050 - The Cisco switch must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-110969r1_rule

STIG-ID|CISC-RT-000050

Vuln-ID|V-101865

CISC-RT-000060 - The Cisco switch must be configured to have all inactive layer 3 interfaces disabled.

800-53|AC-4

CAT|III

CCI|CCI-001414

Rule-ID|SV-110971r1_rule

STIG-ID|CISC-RT-000060

Vuln-ID|V-101867

CISC-RT-000070 - The Cisco switch must be configured to have all non-essential capabilities disabled.

800-53|CM-7

CCI|CCI-000381

Rule-ID|SV-110973r1_rule

STIG-ID|CISC-RT-000070

Vuln-ID|V-101869

CISC-RT-000080 - The Cisco switch must not be configured to have any feature enabled that calls home to the vendor.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-110975r1_rule

STIG-ID|CISC-RT-000080

Vuln-ID|V-101871

CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

CCI|CCI-002385

CSCv6|3.1

Rule-ID|SV-110977r1_rule

STIG-ID|CISC-RT-000120

Vuln-ID|V-101873

CISC-RT-000130 - The Cisco switch must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-110979r1_rule

STIG-ID|CISC-RT-000130

Vuln-ID|V-101875

CISC-RT-000140 - The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself. - external

Rule-ID|SV-110981r1_rule

STIG-ID|CISC-RT-000140

Vuln-ID|V-101877

CISC-RT-000140 - The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself. - internal

CISC-RT-000150 - The Cisco switch must be configured to have Gratuitous ARP disabled on all external interfaces.

800-53|SC-5

Rule-ID|SV-110983r1_rule

STIG-ID|CISC-RT-000150

Vuln-ID|V-101879

CISC-RT-000160 - The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-110985r1_rule

STIG-ID|CISC-RT-000160

Vuln-ID|V-101881

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

Rule-ID|SV-110987r1_rule

STIG-ID|CISC-RT-000170

Vuln-ID|V-101883

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - ip unreachables

800-53|SC-7(16)

CISC-RT-000190 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-110989r1_rule

STIG-ID|CISC-RT-000190

Vuln-ID|V-101885

CISC-RT-000200 - The Cisco switch must be configured to log all packets that have been dropped at interfaces via an ACL.

CCI|CCI-000134

Rule-ID|SV-110991r1_rule

STIG-ID|CISC-RT-000200

Vuln-ID|V-101887

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception - access-group in

CCI|CCI-001109

Rule-ID|SV-110993r1_rule

STIG-ID|CISC-RT-000240

Vuln-ID|V-101889

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception - deny rule

CISC-RT-000250 - The Cisco perimeter switch must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-110995r1_rule

STIG-ID|CISC-RT-000250

Vuln-ID|V-101891

CISC-RT-000260 - The Cisco perimeter switch must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

Rule-ID|SV-110997r1_rule

STIG-ID|CISC-RT-000260

Vuln-ID|V-101893

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - access-group in

Rule-ID|SV-110999r1_rule

STIG-ID|CISC-RT-000270

Vuln-ID|V-101895

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 0.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 10.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 100.64.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 127.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 169.254.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 172.16.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.2.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.18.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.168.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 198.51.100.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 203.0.113.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 224.0.0.0

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes - deny 240.0.0.0

CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-111001r1_rule

STIG-ID|CISC-RT-000310

Vuln-ID|V-101897

CISC-RT-000320 - The Cisco perimeter switch must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-111003r1_rule

STIG-ID|CISC-RT-000320

Vuln-ID|V-101899

CISC-RT-000330 - The Cisco perimeter switch must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-111005r1_rule

STIG-ID|CISC-RT-000330

Vuln-ID|V-101901

CISC-RT-000340 - The Cisco perimeter switch must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-111007r1_rule

STIG-ID|CISC-RT-000340

Vuln-ID|V-101903

CISC-RT-000350 - The Cisco perimeter switch must be configured to block all packets with any IP options.

800-53|SC-7

Rule-ID|SV-111009r1_rule

STIG-ID|CISC-RT-000350

Vuln-ID|V-101905

CISC-RT-000360 - The Cisco perimeter switch must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

Rule-ID|SV-111011r1_rule

STIG-ID|CISC-RT-000360

Vuln-ID|V-101907

CISC-RT-000370 - The Cisco perimeter switch must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.

CSCv6|9.1

Rule-ID|SV-111013r1_rule

STIG-ID|CISC-RT-000370

Vuln-ID|V-101909

CISC-RT-000380 - The Cisco perimeter switch must be configured to have Proxy ARP disabled on all external interfaces.

Rule-ID|SV-111015r1_rule

STIG-ID|CISC-RT-000380

Vuln-ID|V-101911

CISC-RT-000390 - The Cisco perimeter switch must be configured to block all outbound management traffic - ip access-group EXTERNAL_ACL_OUTBOUND out

Rule-ID|SV-111017r1_rule

STIG-ID|CISC-RT-000390

Vuln-ID|V-101913

CISC-RT-000390 - The Cisco perimeter switch must be configured to block all outbound management traffic - ip access-list extended EXTERNAL_ACL_OUTBOUND

CISC-RT-000450 - The Cisco switch must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.

Rule-ID|SV-111019r1_rule

STIG-ID|CISC-RT-000450

Vuln-ID|V-101915

CISC-RT-000470 - The Cisco BGP switch must be configured to check whether a single-hop eBGP peer is directly connected.

Rule-ID|SV-111021r1_rule

STIG-ID|CISC-RT-000470

Vuln-ID|V-101917

CISC-RT-000480 - The Cisco BGP switch must be configured to use a unique key for each autonomous system (AS) that it peers with.

Rule-ID|SV-111023r1_rule

STIG-ID|CISC-RT-000480

Vuln-ID|V-101919

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 0.0.0.0

Rule-ID|SV-111025r1_rule

STIG-ID|CISC-RT-000490

Vuln-ID|V-101921

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 10.0.0.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 100.64.0.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 127.0.0.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 169.254.0.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 172.16.0.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 192.0.2.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 192.88.99.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 192.168.0.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 198.18.0.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 198.51.100.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 203.0.113.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 224.0.0.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - 240.0.0.0

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - permit 0.0.0.0/0 ge 8

CISC-RT-000490 - The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes. - router bgp prefix list

CISC-RT-000500 - The Cisco BGP switch must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS). - prefix list

Detections

Analytics

DISA STIG Cisco NX-OS Switch RTR v1r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous