The Cisco ISR 4000 Series router must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-73973	CISR-ND-000015	SV-91017r1_rule		Medium

Description
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.

STIG	Date
Cisco IOS XE Release 3 NDM Security Technical Implementation Guide	2017-10-02

Details

Check Text ( C-74055r3_chk )
Verify that the Cisco ISR 4000 Series router limits the number of consecutive invalid login attempts to "3" within "15" minutes. The configuration should look similar to the example below: ip ssh authentication-retries 3 login block-for 600 attempts 3 within 900 If the number of consecutive login attempts is not set to "3" within "15" minutes, this is a finding.

Fix Text (F-80513r3_fix)
Configure SSH using: ip ssh authentication-retries 3 login block-for 600 attempts 3 within 900