CIS Cisco IOS XE 16.x v2.1.0 L2

This audit file has been deprecated and will be removed in a future update.

Name: CIS Cisco IOS XE 16.x v2.1.0 L2

Updated: 12/30/2025

Authority: CIS

Plugin: Cisco

Revision: 1.3

Estimated Item Count: 31

Filename: CIS_Cisco_IOS_XE_16.x_v2.1.0_L2.audit

Size: 62.9 kB

MD5: cc861d793e71a5b2e814d6964340a639

SHA256: 43154ef476dc9081bf9e3be4bb417ff5f3e5b5034148cb950657be0a30a33667

Description	Categories
1.1.6 Set 'aaa accounting' to log all privileged use commands using 'commands 15'
1.1.7 Set 'aaa accounting connection'
1.1.8 Set 'aaa accounting exec'
1.1.9 Set 'aaa accounting network'
1.1.10 Set 'aaa accounting system'
1.5.9 Set 'priv' for each 'snmp-server group' using SNMPv3
1.5.10 Require 'aes 128' as minimum for 'snmp-server user' when using SNMPv3
2.2.8 Set 'login success/failure logging'
2.3.1.1 Set 'ntp authenticate'
2.3.1.2 Set 'ntp authentication-key'
2.3.1.3 Set the 'ntp trusted-key'
2.3.1.4 Set 'key' for each 'ntp server'
2.4.1 Create a single 'interface loopback'
2.4.2 Set AAA 'source-interface'
2.4.3 Set 'ntp source' to Loopback Interface
2.4.4 Set 'ip tftp source-interface' to the Loopback Interface
3.1.2 Set 'no ip proxy-arp'
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks
3.2.2 Set inbound 'ip access-group' on the External Interface
3.3.1.1 Set 'key chain'
3.3.1.2 Set 'key'
3.3.1.3 Set 'key-string'
3.3.1.4 Set 'address-family ipv4 autonomous-system'
3.3.1.5 Set 'af-interface default'
3.3.1.6 Set 'authentication key-chain'
3.3.1.8 Set 'ip authentication key-chain eigrp'
3.3.1.9 Set 'ip authentication mode eigrp'
3.3.2.1 Set 'authentication message-digest' for OSPF area
3.3.2.2 Set 'ip ospf message-digest-key md5'
3.3.3.1 Set 'neighbor password'
CIS_Cisco_IOS_XE_16.x_v2.1.0_L2.audit from CIS Cisco IOS XE 16.x Benchmark v2.1.0