CISC-RT-000010 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-221071r999679_rule

STIG-ID|CISC-RT-000010

STIG-Legacy|SV-110961

STIG-Legacy|V-101857

Vuln-ID|V-221071

CISC-RT-000020 - The Cisco switch must be configured to implement message authentication for all control plane protocols.

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-221072r999681_rule

STIG-ID|CISC-RT-000020

STIG-Legacy|SV-110963

STIG-Legacy|V-101859

Vuln-ID|V-221072

CISC-RT-000030 - The Cisco switch must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-221073r999682_rule

STIG-ID|CISC-RT-000030

STIG-Legacy|SV-110965

STIG-Legacy|V-101861

Vuln-ID|V-221073

CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication.

CCI|CCI-000803

Rule-ID|SV-221074r999683_rule

STIG-ID|CISC-RT-000040

STIG-Legacy|SV-110967

STIG-Legacy|V-101863

Vuln-ID|V-221074

CISC-RT-000050 - The Cisco switch must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-221075r999684_rule

STIG-ID|CISC-RT-000050

STIG-Legacy|SV-110969

STIG-Legacy|V-101865

Vuln-ID|V-221075

CISC-RT-000060 - The Cisco switch must be configured to have all inactive layer 3 interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-221076r999685_rule

STIG-ID|CISC-RT-000060

STIG-Legacy|SV-110971

STIG-Legacy|V-101867

Vuln-ID|V-221076

CISC-RT-000080 - The Cisco switch must not be configured to have any feature enabled that calls home to the vendor.

CCI|CCI-002403

Rule-ID|SV-221078r999687_rule

STIG-ID|CISC-RT-000080

STIG-Legacy|SV-110975

STIG-Legacy|V-101871

Vuln-ID|V-221078

CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

CCI|CCI-001097

CCI|CCI-002385

CCI|CCI-004866

Rule-ID|SV-221079r1055901_rule

STIG-ID|CISC-RT-000120

STIG-Legacy|SV-110977

STIG-Legacy|V-101873

Vuln-ID|V-221079

CISC-RT-000140 - The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-221081r999690_rule

STIG-ID|CISC-RT-000140

STIG-Legacy|SV-110981

STIG-Legacy|V-101877

Vuln-ID|V-221081

CISC-RT-000150 - The Cisco switch must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-221082r999691_rule

STIG-ID|CISC-RT-000150

STIG-Legacy|SV-110983

STIG-Legacy|V-101879

Vuln-ID|V-221082

CISC-RT-000160 - The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-221083r999692_rule

STIG-ID|CISC-RT-000160

STIG-Legacy|SV-110985

STIG-Legacy|V-101881

Vuln-ID|V-221083

CISC-RT-000170 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Rule-ID|SV-221084r999693_rule

STIG-ID|CISC-RT-000170

STIG-Legacy|SV-110987

STIG-Legacy|V-101883

Vuln-ID|V-221084

CISC-RT-000190 - The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-221085r999694_rule

STIG-ID|CISC-RT-000190

STIG-Legacy|SV-110989

STIG-Legacy|V-101885

Vuln-ID|V-221085

CISC-RT-000200 - The Cisco switch must be configured to log all packets that have been dropped at interfaces via an ACL.

CCI|CCI-000134

Rule-ID|SV-221086r999695_rule

STIG-ID|CISC-RT-000200

STIG-Legacy|SV-110991

STIG-Legacy|V-101887

Vuln-ID|V-221086

CISC-RT-000236 - The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-237754r999759_rule

STIG-ID|CISC-RT-000236

Vuln-ID|V-237754

CISC-RT-000237 - The Cisco switch must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-237757r999761_rule

STIG-ID|CISC-RT-000237

Vuln-ID|V-237757

CISC-RT-000240 - The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception.

CAT|I

CCI|CCI-001109

Rule-ID|SV-221087r999696_rule

STIG-ID|CISC-RT-000240

STIG-Legacy|SV-110993

STIG-Legacy|V-101889

Vuln-ID|V-221087

CISC-RT-000250 - The Cisco perimeter switch must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-221088r999697_rule

STIG-ID|CISC-RT-000250

STIG-Legacy|SV-110995

STIG-Legacy|V-101891

Vuln-ID|V-221088

CISC-RT-000260 - The Cisco perimeter switch must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

Rule-ID|SV-221089r999698_rule

STIG-ID|CISC-RT-000260

STIG-Legacy|SV-110997

STIG-Legacy|V-101893

Vuln-ID|V-221089

CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes.

Rule-ID|SV-221090r999699_rule

STIG-ID|CISC-RT-000270

STIG-Legacy|SV-110999

STIG-Legacy|V-101895

Vuln-ID|V-221090

CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-221091r999700_rule

STIG-ID|CISC-RT-000310

STIG-Legacy|SV-111001

STIG-Legacy|V-101897

Vuln-ID|V-221091

CISC-RT-000320 - The Cisco perimeter switch must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-221092r999701_rule

STIG-ID|CISC-RT-000320

STIG-Legacy|SV-111003

STIG-Legacy|V-101899

Vuln-ID|V-221092

CISC-RT-000330 - The Cisco perimeter switch must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-221093r999702_rule

STIG-ID|CISC-RT-000330

STIG-Legacy|SV-111005

STIG-Legacy|V-101901

Vuln-ID|V-221093

CISC-RT-000340 - The Cisco perimeter switch must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-221094r999703_rule

STIG-ID|CISC-RT-000340

STIG-Legacy|SV-111007

STIG-Legacy|V-101903

Vuln-ID|V-221094

CISC-RT-000350 - The Cisco perimeter switch must be configured to block all packets with any IP options.

Rule-ID|SV-221095r999704_rule

STIG-ID|CISC-RT-000350

STIG-Legacy|SV-111009

STIG-Legacy|V-101905

Vuln-ID|V-221095

CISC-RT-000360 - The Cisco perimeter switch must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

Rule-ID|SV-221096r999705_rule

STIG-ID|CISC-RT-000360

STIG-Legacy|SV-111011

STIG-Legacy|V-101907

Vuln-ID|V-221096

CISC-RT-000370 - The Cisco perimeter switch must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.

Rule-ID|SV-221097r999706_rule

STIG-ID|CISC-RT-000370

STIG-Legacy|SV-111013

STIG-Legacy|V-101909

Vuln-ID|V-221097

CISC-RT-000380 - The Cisco perimeter switch must be configured to have Proxy ARP disabled on all external interfaces.

Rule-ID|SV-221098r999707_rule

STIG-ID|CISC-RT-000380

STIG-Legacy|SV-111015

STIG-Legacy|V-101911

Vuln-ID|V-221098

CISC-RT-000390 - The Cisco perimeter switch must be configured to block all outbound management traffic.

Rule-ID|SV-221099r999708_rule

STIG-ID|CISC-RT-000390

STIG-Legacy|SV-111017

STIG-Legacy|V-101913

Vuln-ID|V-221099

CISC-RT-000391 - The Cisco perimeter switch must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.

Rule-ID|SV-237760r999764_rule

STIG-ID|CISC-RT-000391

Vuln-ID|V-237760

CISC-RT-000450 - The Cisco switch must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.

Rule-ID|SV-221100r999709_rule

STIG-ID|CISC-RT-000450

STIG-Legacy|SV-111019

STIG-Legacy|V-101915

Vuln-ID|V-221100

CISC-RT-000470 - The Cisco BGP switch must be configured to check whether a single-hop eBGP peer is directly connected.

Detections

Analytics

DISA Cisco NX OS Switch RTR STIG v3r3

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Functional Update

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.5 May 15, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.4 Mar 30, 2026 Miscellaneous Metadata updated. See also link updated.
Revision 1.3 Mar 13, 2026 Functional Update CISC-RT-000080 - The Cisco switch must not be configured to have any feature enabled that calls home to the vendor. Miscellaneous Metadata updated. See also link updated.
Revision 1.2 Feb 10, 2026 Miscellaneous Metadata updated. See also link updated.
Revision 1.1 Nov 19, 2025 Miscellaneous Metadata updated. See also link updated.

Detections

Analytics

DISA Cisco NX OS Switch RTR STIG v3r3 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Functional Update

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA Cisco NX OS Switch RTR STIG v3r3