CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-group

CAT|II

CCI|CCI-001368

Rule-ID|SV-216641r531086_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-105993

STIG-Legacy|V-96855

Vuln-ID|V-216641

CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies - ip access-list extended

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - BGP

CCI|CCI-002205

Rule-ID|SV-216994r877983_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-105995

STIG-Legacy|V-96857

Vuln-ID|V-216994

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - EIGRP

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - IS-IS

CISC-RT-000020 - The Cisco router must be configured to implement message authentication for all control plane protocols - OSPF

CISC-RT-000030 - The Cisco router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-216995r877984_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-105997

STIG-Legacy|V-96859

Vuln-ID|V-216995

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - BGP

CCI|CCI-000803

Rule-ID|SV-216644r531086_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-105999

STIG-Legacy|V-96861

Vuln-ID|V-216644

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - EIGRP

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - IS-IS

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - OSPF

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - RIP

CISC-RT-000050 - The Cisco router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-216645r819134_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-106001

STIG-Legacy|V-96863

Vuln-ID|V-216645

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-216646r531086_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-106003

STIG-Legacy|V-96865

Vuln-ID|V-216646

CISC-RT-000070 - The Cisco router must be configured to have all non-essential capabilities disabled.

CCI|CCI-000381

Rule-ID|SV-216647r531086_rule

STIG-ID|CISC-RT-000070

STIG-Legacy|SV-106005

STIG-Legacy|V-96867

Vuln-ID|V-216647

CISC-RT-000080 - The Cisco router must not be configured to have any feature enabled that calls home to the vendor.

CCI|CCI-002403

Rule-ID|SV-216996r855840_rule

STIG-ID|CISC-RT-000080

STIG-Legacy|SV-106007

STIG-Legacy|V-96869

Vuln-ID|V-216996

CISC-RT-000090 - The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-216649r855812_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-106009

STIG-Legacy|V-96871

Vuln-ID|V-216649

CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection - DoS attacks by employing control plane protection.

Rule-ID|SV-216650r855813_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-106011

STIG-Legacy|V-96873

Vuln-ID|V-216650

CISC-RT-000130 - The Cisco router must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-216651r531086_rule

STIG-ID|CISC-RT-000130

STIG-Legacy|SV-106013

STIG-Legacy|V-96875

Vuln-ID|V-216651

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - external

Rule-ID|SV-216652r531086_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-106015

STIG-Legacy|V-96877

Vuln-ID|V-216652

CISC-RT-000140 - The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself - internal

CISC-RT-000150 - The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-216653r855814_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-106017

STIG-Legacy|V-96879

Vuln-ID|V-216653

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-216654r855815_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-106019

STIG-Legacy|V-96881

Vuln-ID|V-216654

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces - DODIN Backbone

Rule-ID|SV-216655r855816_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-106021

STIG-Legacy|V-96883

Vuln-ID|V-216655

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-216656r855817_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-106023

STIG-Legacy|V-96885

Vuln-ID|V-216656

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-216657r855818_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-106025

STIG-Legacy|V-96887

Vuln-ID|V-216657

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.

CCI|CCI-000134

Rule-ID|SV-216658r531086_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-106027

STIG-Legacy|V-96889

Vuln-ID|V-216658

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216659r531086_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-106029

STIG-Legacy|V-96891

Vuln-ID|V-216659

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-216660r531086_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-106031

STIG-Legacy|V-96893

Vuln-ID|V-216660

CISC-RT-000230 - The Cisco router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-216661r531086_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-106033

STIG-Legacy|V-96895

Vuln-ID|V-216661

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled - ip

CCI|CCI-000366

Rule-ID|SV-229031r802615_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-229031

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled - ipv6

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-230039r647454_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-230039

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-230042r647455_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-230042

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - access-group in

CCI|CCI-001109

Rule-ID|SV-216662r531086_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-106035

STIG-Legacy|V-96897

Vuln-ID|V-216662

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception - deny rule

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-216663r531086_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-106037

STIG-Legacy|V-96899

Vuln-ID|V-216663

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

Rule-ID|SV-216664r855819_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-106039

STIG-Legacy|V-96901

Vuln-ID|V-216664

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - access-group in

Rule-ID|SV-216665r863260_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-106041

STIG-Legacy|V-96903

Vuln-ID|V-216665

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 0.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 10.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 100.64.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 127.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 169.254.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 172.16.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.0.2.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.18.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 192.168.0.0

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - deny 198.51.100.0

Detections

Analytics

DISA STIG Cisco IOS XE Router RTR v2r6

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous