CISC-RT-000010 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-220419r622190_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-110685

STIG-Legacy|V-101581

Vuln-ID|V-220419

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols.

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-220468r856248_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-110687

STIG-Legacy|V-101583

Vuln-ID|V-220468

CISC-RT-000030 - The Cisco switch must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-220469r856249_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-110689

STIG-Legacy|V-101585

Vuln-ID|V-220469

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication.

CCI|CCI-000803

Rule-ID|SV-220422r892498_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-110691

STIG-Legacy|V-101587

Vuln-ID|V-220422

CISC-RT-000050 - The Cisco switch must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-220423r622190_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-110693

STIG-Legacy|V-101589

Vuln-ID|V-220423

CISC-RT-000060 - The Cisco switch must be configured to have all inactive Layer 3 interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-220424r622190_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-110695

STIG-Legacy|V-101591

Vuln-ID|V-220424

CISC-RT-000090 - The Cisco switch must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-220427r856231_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-110701

STIG-Legacy|V-101597

Vuln-ID|V-220427

CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

Rule-ID|SV-220428r856232_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-110703

STIG-Legacy|V-101599

Vuln-ID|V-220428

CISC-RT-000130 - The Cisco switch must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-220429r622190_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-110705

STIG-Legacy|V-101601

Vuln-ID|V-220429

CISC-RT-000140 - The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-220430r622190_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-110707

STIG-Legacy|V-101603

Vuln-ID|V-220430

CISC-RT-000150 - The Cisco switch must be configured to have gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-220431r856233_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-110709

STIG-Legacy|V-101605

Vuln-ID|V-220431

CISC-RT-000160 - The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-220432r856234_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-110711

STIG-Legacy|V-101607

Vuln-ID|V-220432

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces

Rule-ID|SV-220433r856235_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-110713

STIG-Legacy|V-101609

Vuln-ID|V-220433

CISC-RT-000180 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-220434r856236_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-110715

STIG-Legacy|V-101611

Vuln-ID|V-220434

CISC-RT-000190 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-220435r856237_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-110717

STIG-Legacy|V-101613

Vuln-ID|V-220435

CISC-RT-000200 - The Cisco switch must be configured to log all packets that have been dropped at interfaces via an access control list (ACL).

CCI|CCI-000134

Rule-ID|SV-220436r622190_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-110719

STIG-Legacy|V-101615

Vuln-ID|V-220436

CISC-RT-000210 - The Cisco switch must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-220437r622190_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-110721

STIG-Legacy|V-101617

Vuln-ID|V-220437

CISC-RT-000220 - The Cisco switch must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-220438r622190_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-110723

STIG-Legacy|V-101619

Vuln-ID|V-220438

CISC-RT-000230 - The Cisco switch must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-220439r622190_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-110725

STIG-Legacy|V-101621

Vuln-ID|V-220439

CISC-RT-000235 - The Cisco switch must be configured to have Cisco Express Forwarding enabled

Rule-ID|SV-237749r648775_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-237749

CISC-RT-000236 - The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-237751r648779_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-237751

CISC-RT-000237 - The Cisco switch must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-237755r648786_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-237755

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception

CCI|CCI-001109

Rule-ID|SV-220440r622190_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-110727

STIG-Legacy|V-101623

Vuln-ID|V-220440

CISC-RT-000250 - The Cisco perimeter switch must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-220441r622190_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-110729

STIG-Legacy|V-101625

Vuln-ID|V-220441

CISC-RT-000260 - The Cisco perimeter switch must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Rule-ID|SV-220442r856238_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-110731

STIG-Legacy|V-101627

Vuln-ID|V-220442

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes

Rule-ID|SV-220443r863240_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-110733

STIG-Legacy|V-101629

Vuln-ID|V-220443

CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-220471r622190_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-110735

STIG-Legacy|V-101631

Vuln-ID|V-220471

CISC-RT-000320 - The Cisco perimeter switch must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-220445r622190_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-110737

STIG-Legacy|V-101633

Vuln-ID|V-220445

CISC-RT-000330 - The Cisco perimeter switch must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-220446r622190_rule

STIG-ID|CISC-RT-000330

STIG-Legacy|SV-110739

STIG-Legacy|V-101635

Vuln-ID|V-220446

CISC-RT-000340 - The Cisco perimeter switch must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-220447r622190_rule

STIG-ID|CISC-RT-000340

STIG-Legacy|SV-110741

STIG-Legacy|V-101637

Vuln-ID|V-220447

CISC-RT-000350 - The Cisco perimeter switch must be configured to block all packets with any IP options.

Rule-ID|SV-220472r856251_rule

STIG-ID|CISC-RT-000350

STIG-Legacy|SV-110743

STIG-Legacy|V-101639

Vuln-ID|V-220472

CISC-RT-000360 - The Cisco perimeter switch must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

Rule-ID|SV-220449r856240_rule

STIG-ID|CISC-RT-000360

STIG-Legacy|SV-110759

STIG-Legacy|V-101655

Detections

Analytics

DISA STIG Cisco IOS Switch RTR v2r4

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous