| aaa authentication local login | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | |
| access-group in | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | |
| bgp neighbor | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | |
| Check for BGP | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | |
| Check for public keys | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | |
| Check if Cisco IOS is installed | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | |
| Check if Cisco IOS is installed | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | |
| Check if LLDP is disabled | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | |
| Check if MPLS TE is enabled globally. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | |
| CISC-L2-000090 - The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches. | DISA STIG Cisco IOS XE Switch L2S v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources. | DISA STIG Cisco IOS XE Switch L2S v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-L2-000230 - The Cisco switch must have the default VLAN pruned from all trunk ports that do not require it. | DISA STIG Cisco IOS XE Switch L2S v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-ND-000090 - The Cisco switch must be configured to automatically audit account creation. | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | ACCESS CONTROL |
| CISC-ND-000460 - The Cisco switch must be configured to limit privileges to change the software resident within software libraries. | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | CONFIGURATION MANAGEMENT |
| CISC-ND-000880 - The Cisco switch must be configured to automatically audit account enabling actions. | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | ACCESS CONTROL |
| CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions. | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | IDENTIFICATION AND AUTHENTICATION, MAINTENANCE |
| CISC-ND-001440 - The Cisco switch must be configured to obtain its public key certificates from an appropriate certificate policy through an approved service provider. | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-ND-001450 - The Cisco switch must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | AUDIT AND ACCOUNTABILITY |
| CISC-RT-000190 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000450 - The Cisco switch must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000470 - The Cisco BGP switch must be configured to enable the Generalized TTL Security Mechanism (GTSM). | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000520 - The Cisco BGP switch must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS). | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | ACCESS CONTROL |
| CISC-RT-000540 - The Cisco BGP switch must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | ACCESS CONTROL |
| CISC-RT-000720 - The Cisco PE switch must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000740 - The Cisco PE switch must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000770 - The Cisco P switch must be configured to enforce a Quality-of-Service (QoS) policy to provide preferred treatment for mission-critical applications. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000830 - The Cisco multicast Rendezvous Point (RP) switch must be configured to filter Protocol Independent Multicast (PIM) Register messages received from the Designated switch (DR) for any undesirable multicast groups and sources. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | ACCESS CONTROL |
| CISC-RT-000840 - The Cisco multicast Rendezvous Point (RP) switch must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Cisco switch (DR) for any undesirable multicast groups. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | ACCESS CONTROL |
| CISC-RT-000880 - The Cisco multicast Designated switch (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports. | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| crypto pki trustpoint | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | |
| deny 0.0.0.0 | DISA STIG Cisco IOS XE Switch RTR v3r1 | Cisco | |
| deny 10.0.0.0 | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| deny 127.0.0.0 | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| deny 192.0.2.0 | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| deny 192.18.0.0 | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| deny 224.0.0.0 | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| deny 240.0.0.0 | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| deny ip any | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| enable secret | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | |
| ip access-list extended EXTERNAL_ACL_OUTBOUND | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| ip pim register policy | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| ip pim register-policy | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| l2vpn vfi | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| line vty access-class | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | |
| mpls ldp configurations | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| ntp trusted-key | DISA STIG Cisco IOS XE Switch NDM v3r2 | Cisco | |
| port-profile | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| prefix list | DISA STIG Cisco NX-OS Switch RTR v3r2 | Cisco | |
| spanning-tree mode | DISA STIG Cisco IOS XE Switch L2S v3r1 | Cisco | |
| vtp status off | DISA STIG Cisco IOS XE Switch L2S v3r1 | Cisco | |
