CISC-RT-000010 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-220419r1117236_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-110685

STIG-Legacy|V-101581

Vuln-ID|V-220419

CISC-RT-000050 - The Cisco switch must be configured to enable routing protocol authentication using FIPS 198-1 algorithms with keys not exceeding 180 days of lifetime.

CCI|CCI-000803

CCI|CCI-002205

Rule-ID|SV-220423r929046_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-110693

STIG-Legacy|V-101589

Vuln-ID|V-220423

CISC-RT-000060 - The Cisco switch must be configured to have all inactive Layer 3 interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-220424r1117237_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-110695

STIG-Legacy|V-101591

Vuln-ID|V-220424

CISC-RT-000090 - The Cisco switch must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-220427r856231_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-110701

STIG-Legacy|V-101597

Vuln-ID|V-220427

CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

CAT|I

CCI|CCI-001097

CCI|CCI-004866

Rule-ID|SV-220428r991872_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-110703

STIG-Legacy|V-101599

Vuln-ID|V-220428

CISC-RT-000150 - The Cisco switch must be configured to have gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-220431r856233_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-110709

STIG-Legacy|V-101605

Vuln-ID|V-220431

CISC-RT-000160 - The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-220432r856234_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-110711

STIG-Legacy|V-101607

Vuln-ID|V-220432

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Rule-ID|SV-220433r856235_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-110713

STIG-Legacy|V-101609

Vuln-ID|V-220433

CISC-RT-000180 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-220434r856236_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-110715

STIG-Legacy|V-101611

Vuln-ID|V-220434

CISC-RT-000190 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-220435r856237_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-110717

STIG-Legacy|V-101613

Vuln-ID|V-220435

CISC-RT-000200 - The Cisco switch must be configured to log all packets that have been dropped at interfaces via an access control list (ACL).

CCI|CCI-000134

Rule-ID|SV-220436r622190_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-110719

STIG-Legacy|V-101615

Vuln-ID|V-220436

CISC-RT-000210 - The Cisco switch must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-220437r622190_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-110721

STIG-Legacy|V-101617

Vuln-ID|V-220437

CISC-RT-000220 - The Cisco switch must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-220438r622190_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-110723

STIG-Legacy|V-101619

Vuln-ID|V-220438

CISC-RT-000230 - The Cisco switch must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-220439r1117237_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-110725

STIG-Legacy|V-101621

Vuln-ID|V-220439

CISC-RT-000235 - The Cisco switch must be configured to have Cisco Express Forwarding enabled.

CCI|CCI-000366

Rule-ID|SV-237749r648775_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-237749

CISC-RT-000236 - The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-237751r648779_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-237751

CISC-RT-000237 - The Cisco switch must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-237755r999760_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-237755

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception.

CCI|CCI-001109

Rule-ID|SV-220440r1117241_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-110727

STIG-Legacy|V-101623

Vuln-ID|V-220440

CISC-RT-000250 - The Cisco perimeter switch must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-220441r1117237_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-110729

STIG-Legacy|V-101625

Vuln-ID|V-220441

CISC-RT-000260 - The Cisco perimeter switch must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Rule-ID|SV-220442r856238_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-110731

STIG-Legacy|V-101627

Vuln-ID|V-220442

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes.

Rule-ID|SV-220443r863240_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-110733

STIG-Legacy|V-101629

Vuln-ID|V-220443

CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-220471r945858_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-110735

STIG-Legacy|V-101631

Vuln-ID|V-220471

CISC-RT-000320 - The Cisco perimeter switch must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-220445r622190_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-110737

STIG-Legacy|V-101633

Vuln-ID|V-220445

CISC-RT-000330 - The Cisco perimeter switch must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-220446r622190_rule

STIG-ID|CISC-RT-000330

STIG-Legacy|SV-110739

STIG-Legacy|V-101635

Vuln-ID|V-220446

CISC-RT-000340 - The Cisco perimeter switch must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-220447r622190_rule

STIG-ID|CISC-RT-000340

STIG-Legacy|SV-110741

STIG-Legacy|V-101637

Vuln-ID|V-220447

CISC-RT-000350 - The Cisco perimeter switch must be configured to block all packets with any IP options.

Rule-ID|SV-220472r945859_rule

STIG-ID|CISC-RT-000350

STIG-Legacy|SV-110743

STIG-Legacy|V-101639

Vuln-ID|V-220472

CISC-RT-000360 - The Cisco perimeter switch must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

Rule-ID|SV-220449r856240_rule

STIG-ID|CISC-RT-000360

STIG-Legacy|SV-110759

STIG-Legacy|V-101655

Vuln-ID|V-220449

CISC-RT-000370 - The Cisco perimeter switch must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.

Rule-ID|SV-220450r856241_rule

STIG-ID|CISC-RT-000370

STIG-Legacy|SV-110747

STIG-Legacy|V-101643

Vuln-ID|V-220450

CISC-RT-000380 - The Cisco perimeter switch must be configured to have Proxy ARP disabled on all external interfaces.

Rule-ID|SV-220451r856242_rule

STIG-ID|CISC-RT-000380

STIG-Legacy|SV-110749

STIG-Legacy|V-101645

Vuln-ID|V-220451

CISC-RT-000390 - The Cisco perimeter switch must be configured to block all outbound management traffic.

Rule-ID|SV-220452r945857_rule

STIG-ID|CISC-RT-000390

STIG-Legacy|SV-110751

STIG-Legacy|V-101647

Vuln-ID|V-220452

CISC-RT-000391 - The Cisco perimeter switch must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.

Rule-ID|SV-237758r648791_rule

STIG-ID|CISC-RT-000391

Vuln-ID|V-237758

CISC-RT-000392 - The Cisco perimeter switch must be configured to drop IPv6 undetermined transport packets.

Rule-ID|SV-237761r950991_rule

STIG-ID|CISC-RT-000392

Vuln-ID|V-237761

CISC-RT-000393 - The Cisco perimeter switch must be configured drop IPv6 packets with a Routing Header type 0, 1, or 3-255.

Rule-ID|SV-237763r856665_rule

Detections

Analytics

DISA Cisco IOS Switch RTR STIG v3r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous