CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-group

CAT|II

CCI|CCI-001368

Rule-ID|SV-216641r531086_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-105993

STIG-Legacy|V-96855

Vuln-ID|V-216641

CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-list extended

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - BGP

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-216994r538970_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-105995

STIG-Legacy|V-96857

Vuln-ID|V-216994

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - EIGRP

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - IS-IS

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - OSPF

CISC-RT-000030 - The Cisco router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-216995r531086_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-105997

STIG-Legacy|V-96859

Vuln-ID|V-216995

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - BGP

CCI|CCI-000803

Rule-ID|SV-216644r531086_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-105999

STIG-Legacy|V-96861

Vuln-ID|V-216644

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - EIGRP

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - IS-IS

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - OSPF

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - RIP

CISC-RT-000050 - The Cisco router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-216645r819134_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-106001

STIG-Legacy|V-96863

Vuln-ID|V-216645

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-216646r531086_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-106003

STIG-Legacy|V-96865

Vuln-ID|V-216646

CISC-RT-000070 - The Cisco router must be configured to have all non-essential capabilities disabled.

CCI|CCI-000381

Rule-ID|SV-216647r531086_rule

STIG-ID|CISC-RT-000070

STIG-Legacy|SV-106005

STIG-Legacy|V-96867

Vuln-ID|V-216647

CISC-RT-000080 - The Cisco router must not be configured to have any feature enabled that calls home to the vendor.

CCI|CCI-002403

Rule-ID|SV-216996r663924_rule

STIG-ID|CISC-RT-000080

STIG-Legacy|SV-106007

STIG-Legacy|V-96869

Vuln-ID|V-216996

CISC-RT-000090 - The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-216649r531086_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-106009

STIG-Legacy|V-96871

Vuln-ID|V-216649

CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection - DoS attacks by employing control plane protection.

Rule-ID|SV-216650r531086_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-106011

STIG-Legacy|V-96873

Vuln-ID|V-216650

CISC-RT-000130 - The Cisco router must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-216651r531086_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-106013

STIG-Legacy|V-96875

Vuln-ID|V-216651

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - external

Rule-ID|SV-216652r531086_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-106015

STIG-Legacy|V-96877

Vuln-ID|V-216652

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - internal

CISC-RT-000150 - The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-216653r531086_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-106017

STIG-Legacy|V-96879

Vuln-ID|V-216653

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-216654r531086_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-106019

STIG-Legacy|V-96881

Vuln-ID|V-216654

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

Rule-ID|SV-216655r531086_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-106021

STIG-Legacy|V-96883

Vuln-ID|V-216655

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-216656r531086_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-106023

STIG-Legacy|V-96885

Vuln-ID|V-216656

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-216657r531086_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-106025

STIG-Legacy|V-96887

Vuln-ID|V-216657

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.

CCI|CCI-000134

Rule-ID|SV-216658r531086_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-106027

STIG-Legacy|V-96889

Vuln-ID|V-216658

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216659r531086_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-106029

STIG-Legacy|V-96891

Vuln-ID|V-216659

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-216660r531086_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-106031

STIG-Legacy|V-96893

Vuln-ID|V-216660

CISC-RT-000230 - The Cisco router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-216661r531086_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-106033

STIG-Legacy|V-96895

Vuln-ID|V-216661

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled - ip

Rule-ID|SV-229031r802615_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-229031

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled - ipv6

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-230039r647454_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-230039

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-230042r647455_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-230042

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - access-group in

CCI|CCI-001109

Rule-ID|SV-216662r531086_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-106035

STIG-Legacy|V-96897

Vuln-ID|V-216662

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - deny rule

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-216663r531086_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-106037

STIG-Legacy|V-96899

Vuln-ID|V-216663

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

Rule-ID|SV-216664r531086_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-106039

STIG-Legacy|V-96901

Vuln-ID|V-216664

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - access-group in

Rule-ID|SV-216665r531086_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-106041

STIG-Legacy|V-96903

Vuln-ID|V-216665

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 0.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 10.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 100.64.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 127.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 169.254.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 172.16.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.2.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.18.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.168.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 198.51.100.0

Detections

Analytics

DISA STIG Cisco IOS XE Router RTR v2r4

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous


Revision 1.5 Jun 2, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.4 Mar 7, 2023 Miscellaneous Metadata updated. References updated.
Revision 1.3 Dec 7, 2022 Miscellaneous Variables updated.
Revision 1.2 Aug 17, 2022 Miscellaneous Metadata updated. See also link updated.
Revision 1.1 Jul 12, 2022 Miscellaneous Platform check updated. Variables updated.
Revision 1.0 Jun 10, 2022 Miscellaneous Metadata updated.