CISC-RT-000010 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-216641r1007826_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-105993

STIG-Legacy|V-96855

Vuln-ID|V-216641

CISC-RT-000050 - The Cisco router must be configured to enable routing protocol authentication using FIPS 198-1 algorithms with keys not exceeding 180 days of lifetime.

CCI|CCI-000803

CCI|CCI-002205

Rule-ID|SV-216645r1007829_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-106001

STIG-Legacy|V-96863

Vuln-ID|V-216645

CISC-RT-000060 - The Cisco router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-216646r531086_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-106003

STIG-Legacy|V-96865

Vuln-ID|V-216646

CISC-RT-000090 - The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

CCI|CCI-002385

Rule-ID|SV-216649r855812_rule

STIG-ID|CISC-RT-000090

STIG-Legacy|SV-106009

STIG-Legacy|V-96871

Vuln-ID|V-216649

CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection.

CAT|I

CCI|CCI-001097

CCI|CCI-004866

Rule-ID|SV-216650r991890_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-106011

STIG-Legacy|V-96873

Vuln-ID|V-216650

CISC-RT-000150 - The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-216653r855814_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-106017

STIG-Legacy|V-96879

Vuln-ID|V-216653

CISC-RT-000160 - The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-216654r855815_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-106019

STIG-Legacy|V-96881

Vuln-ID|V-216654

CISC-RT-000170 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Rule-ID|SV-216655r855816_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-106021

STIG-Legacy|V-96883

Vuln-ID|V-216655

CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-216656r855817_rule

STIG-ID|CISC-RT-000180

STIG-Legacy|SV-106023

STIG-Legacy|V-96885

Vuln-ID|V-216656

CISC-RT-000190 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-216657r855818_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-106025

STIG-Legacy|V-96887

Vuln-ID|V-216657

CISC-RT-000200 - The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.

CCI|CCI-000134

Rule-ID|SV-216658r531086_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-106027

STIG-Legacy|V-96889

Vuln-ID|V-216658

CISC-RT-000210 - The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216659r531086_rule

STIG-ID|CISC-RT-000210

STIG-Legacy|SV-106029

STIG-Legacy|V-96891

Vuln-ID|V-216659

CISC-RT-000220 - The Cisco router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-216660r531086_rule

STIG-ID|CISC-RT-000220

STIG-Legacy|SV-106031

STIG-Legacy|V-96893

Vuln-ID|V-216660

CISC-RT-000230 - The Cisco router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-216661r531086_rule

STIG-ID|CISC-RT-000230

STIG-Legacy|SV-106033

STIG-Legacy|V-96895

Vuln-ID|V-216661

CISC-RT-000235 - The Cisco router must be configured to have Cisco Express Forwarding enabled.

CCI|CCI-000366

Rule-ID|SV-229031r878127_rule

STIG-ID|CISC-RT-000235

Vuln-ID|V-229031

CISC-RT-000236 - The Cisco router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-230039r647454_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-230039

CISC-RT-000237 - The Cisco router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-230042r647455_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-230042

CISC-RT-000240 - The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

CCI|CCI-001109

Rule-ID|SV-216662r531086_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-106035

STIG-Legacy|V-96897

Vuln-ID|V-216662

CISC-RT-000250 - The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-216663r531086_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-106037

STIG-Legacy|V-96899

Vuln-ID|V-216663

CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Rule-ID|SV-216664r855819_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-106039

STIG-Legacy|V-96901

Vuln-ID|V-216664

CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.

Rule-ID|SV-216665r863260_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-106041

STIG-Legacy|V-96903

Vuln-ID|V-216665

CISC-RT-000280 - The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

Rule-ID|SV-216666r531086_rule

STIG-ID|CISC-RT-000280

STIG-Legacy|SV-106043

STIG-Legacy|V-96905

Vuln-ID|V-216666

CISC-RT-000290 - The Cisco perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

Rule-ID|SV-216667r531086_rule

STIG-ID|CISC-RT-000290

STIG-Legacy|SV-106045

STIG-Legacy|V-96907

Vuln-ID|V-216667

CISC-RT-000300 - The Cisco perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an Interior Gateway Protocol (IGP) peering with the NIPRNet or to other autonomous systems.

Rule-ID|SV-216668r531086_rule

STIG-ID|CISC-RT-000300

STIG-Legacy|SV-106047

STIG-Legacy|V-96909

Vuln-ID|V-216668

CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-216997r945858_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-106049

STIG-Legacy|V-96911

Vuln-ID|V-216997

CISC-RT-000320 - The Cisco perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-216670r1007827_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-106051

STIG-Legacy|V-96913

Vuln-ID|V-216670

CISC-RT-000330 - The Cisco perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-216671r531086_rule

STIG-ID|CISC-RT-000330

STIG-Legacy|SV-106053

STIG-Legacy|V-96915

Vuln-ID|V-216671

CISC-RT-000340 - The Cisco perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-216672r531086_rule

STIG-ID|CISC-RT-000340

STIG-Legacy|SV-106055

STIG-Legacy|V-96917

Vuln-ID|V-216672

CISC-RT-000350 - The Cisco perimeter router must be configured to block all packets with any IP options.

Rule-ID|SV-216998r945859_rule

STIG-ID|CISC-RT-000350

STIG-Legacy|SV-106057

STIG-Legacy|V-96919

Vuln-ID|V-216998

CISC-RT-000360 - The Cisco perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

Rule-ID|SV-216674r855821_rule

STIG-ID|CISC-RT-000360

STIG-Legacy|SV-106059

STIG-Legacy|V-96921

Vuln-ID|V-216674

CISC-RT-000370 - The Cisco perimeter router must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.

Rule-ID|SV-216675r855822_rule

STIG-ID|CISC-RT-000370

STIG-Legacy|SV-106061

STIG-Legacy|V-96923

Vuln-ID|V-216675

CISC-RT-000380 - The Cisco perimeter router must be configured to have Proxy ARP disabled on all external interfaces.

Rule-ID|SV-216676r855823_rule

STIG-ID|CISC-RT-000380

STIG-Legacy|SV-106063

Detections

Analytics

DISA STIG Cisco IOS XE Router RTR v3r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Functional Update

Miscellaneous


Revision 1.2 Aug 12, 2025 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Dec 10, 2024 Functional Update CISC-RT-000450 - The Cisco router must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface. Miscellaneous Variables updated.