The Cisco IOS XE router must generate audit log events for a locally developed list of auditable events.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-74077	CISR-ND-000132	SV-88751r2_rule		Medium

Description
Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack; to recognize resource utilization or capacity thresholds; or to identify an improperly configured network device. If auditing is not comprehensive, it will not be useful for intrusion monitoring, security investigations, and forensic analysis.

STIG	Date
Cisco IOS XE Release 3 NDM Security Technical Implementation Guide	2018-03-08

Details

Check Text ( C-74169r5_chk )
Verify that the Cisco IOS XE router is configured to send logs to a syslog server. The configuration should look similar to the example below: logging host 1.1.1.1 logging facility local7 If it is not configured to send logs to a syslog server, this is a finding.

Fix Text (F-80617r3_fix)
Configure the Cisco IOS XE router for auditing. The configuration should look similar to the example below: logging userinfo login on-failure log login on-success log archive log config logging enable logging size 1000 notify syslog contenttype plaintext hidekeys