CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes - line console

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.


Step 1: Configure the router to use an authentication server as shown in the following example:

RP/0/0/CPU0:R3(config)#radius-server host key xxxxxxxx

Step 2: Configure the authentication order to use the authentication server as primary source for authentication as shown in the following example:

RP/0/0/CPU0:R3(config)#aaa authentication login LOGIN_AUTHENTICATION group radius local

Step 3: Configure all network connections associated with a device management to use an authentication server for the purpose of login authentication as shown in the following example:

RP/0/0/CPU0:R3(config)#line default
RP/0/0/CPU0:R3(config-line)#login authentication LOGIN_AUTHENTICATION
RP/0/0/CPU0:R3(config)#line console
RP/0/0/CPU0:R3(config-line)#login authentication LOGIN_AUTHENTICATION

See Also

Item Details

References: CAT|II, CCI|CCI-000044, Rule-ID|SV-216524r879546_rule, STIG-ID|CISC-ND-000150, STIG-Legacy|SV-105519, STIG-Legacy|V-96381, Vuln-ID|V-216524

Plugin: Cisco

Control ID: 783348985061fee0a4501fffd27044f8fcd3354597919ac38cd5eed436bfd8b1