CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

800-53|AC-4

CAT|II

CCI|CCI-001368

Rule-ID|SV-216551r1117236_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-105641

STIG-Legacy|V-96503

Vuln-ID|V-216551

CISC-RT-000050 - The Cisco router must be configured to enable routing protocol authentication using FIPS 198-1 algorithms with keys not exceeding 180 days of lifetime.

800-53|AC-4(17)

800-53|IA-7

CCI|CCI-000803

CCI|CCI-002205

Rule-ID|SV-216555r1007824_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-105649

STIG-Legacy|V-96511

Vuln-ID|V-216555

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-216556r1117237_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-105651

STIG-Legacy|V-96513

Vuln-ID|V-216556

CISC-RT-000090 - The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

800-53|SC-5

CCI|CCI-002385

Rule-ID|SV-216559r856180_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-105657

STIG-Legacy|V-96519

Vuln-ID|V-216559

CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

800-53|SC-7a.

CAT|I

CCI|CCI-001097

CCI|CCI-004866

Rule-ID|SV-216560r991835_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-105659

STIG-Legacy|V-96521

Vuln-ID|V-216560

CISC-RT-000150 - The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-216563r856182_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-105665

STIG-Legacy|V-96527

Vuln-ID|V-216563

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-216564r856183_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-105667

STIG-Legacy|V-96529

Vuln-ID|V-216564

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Rule-ID|SV-216565r856184_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-105669

STIG-Legacy|V-96531

Vuln-ID|V-216565

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-216566r856185_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-105671

STIG-Legacy|V-96533

Vuln-ID|V-216566

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-216567r856186_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-105673

STIG-Legacy|V-96535

Vuln-ID|V-216567

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via an ACL.

800-53|AU-3

CCI|CCI-000134

Rule-ID|SV-216568r531085_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-105675

STIG-Legacy|V-96537

Vuln-ID|V-216568

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216569r531085_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-105677

STIG-Legacy|V-96539

Vuln-ID|V-216569

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-216570r531085_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-105679

STIG-Legacy|V-96541

Vuln-ID|V-216570

CISC-RT-000230 - The Cisco router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-216571r1117237_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-105681

STIG-Legacy|V-96543

Vuln-ID|V-216571

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-229030r878127_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-229030

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-230038r531386_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-230038

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-230041r532998_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-230041

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

800-53|SC-7(5)

CCI|CCI-001109

Rule-ID|SV-216572r1117241_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-105683

STIG-Legacy|V-96545

Vuln-ID|V-216572

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-216573r1117237_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-105685

STIG-Legacy|V-96547

Vuln-ID|V-216573

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-216574r856187_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-105687

STIG-Legacy|V-96549

Vuln-ID|V-216574

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.

Rule-ID|SV-216575r863237_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-105689

STIG-Legacy|V-96551

Vuln-ID|V-216575

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an approved gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

Rule-ID|SV-216576r1117237_rule

STIG-ID|CISC-RT-000280

STIG-Legacy|SV-105691

STIG-Legacy|V-96553

Vuln-ID|V-216576

CISC-RT-000290 - The Cisco perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an approved gateway service provider.

Rule-ID|SV-216577r1117237_rule

STIG-ID|CISC-RT-000290

STIG-Legacy|SV-105693

STIG-Legacy|V-96555

Vuln-ID|V-216577

CISC-RT-000300 - The Cisco perimeter router must be configured to not redistribute static routes to an approved gateway service provider into BGP, an IGP peering with the NIPRNet, or other autonomous systems.

Rule-ID|SV-216578r1117237_rule

STIG-ID|CISC-RT-000300

STIG-Legacy|SV-105695

STIG-Legacy|V-96557

Vuln-ID|V-216578

CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

800-53|SC-5(1)

CCI|CCI-001094

Rule-ID|SV-216989r945858_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-105697

STIG-Legacy|V-96559

Vuln-ID|V-216989

CISC-RT-000320 - The Cisco perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-216580r1007822_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-105699

STIG-Legacy|V-96561

Vuln-ID|V-216580

CISC-RT-000330 - The Cisco perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-216581r531085_rule

STIG-ID|CISC-RT-000330

STIG-Legacy|SV-105701

STIG-Legacy|V-96563

Vuln-ID|V-216581

CISC-RT-000340 - The Cisco perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-216582r531085_rule

STIG-ID|CISC-RT-000340

STIG-Legacy|SV-105703

STIG-Legacy|V-96565

Vuln-ID|V-216582

CISC-RT-000350 - The Cisco perimeter router must be configured to block all packets with any IP options.

Rule-ID|SV-216990r945859_rule

STIG-ID|CISC-RT-000350

STIG-Legacy|SV-105705

STIG-Legacy|V-96567

Vuln-ID|V-216990

CISC-RT-000360 - The Cisco perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

Detections

Analytics

DISA Cisco IOS Router RTR STIG v3r4

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Aug 19, 2026 Miscellaneous Metadata updated. See also link updated.
Revision 1.1 May 15, 2026 Miscellaneous Metadata updated. See also link updated.

Detections

Analytics

DISA Cisco IOS Router RTR STIG v3r4 Download File

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA Cisco IOS Router RTR STIG v3r4