The Cisco IOS XE router must be configured so inactive interfaces are disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-74105	CISR-RT-000005	SV-88779r2_rule		Medium

Description
An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use. If an interface is no longer used, the configuration must be deleted and the interface disabled. For sub-interfaces, delete sub-interfaces that are on inactive interfaces and delete sub-interfaces that are themselves inactive. If the sub-interface is no longer necessary for authorized communications, then it must be deleted.

Description

An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use. If an interface is no longer used, the configuration must be deleted and the interface disabled. For sub-interfaces, delete sub-interfaces that are on inactive interfaces and delete sub-interfaces that are themselves inactive. If the sub-interface is no longer necessary for authorized communications, then it must be deleted.

STIG	Date
Cisco IOS XE Release 3 RTR Security Technical Implementation Guide	2018-12-20

Details

Check Text ( C-74191r2_chk )
View the configuration of the Cisco IOS XE router. The configuration should look similar to the example below: interface GigabitEthernet0/0/0 no ip address shutdown If an interface is not being used, but is configured or enabled, this is a finding.

Fix Text (F-80647r2_fix)
Configure the Cisco IOS XE router so that all inactive sub-interfaces are deleted, and disable and delete the configuration of any inactive ports on the router. To shut down an interface see the following commands: ISR4000(config) #Interface GigabitEthernet 0/0/1 ISR4000(config-if) #shutdown To clear the configuration of an inactive interface, use the following command: ISR4000 (config) #default interface GigabitEthernet 0/0/1

Fix Text (F-80647r2_fix)

Configure the Cisco IOS XE router so that all inactive sub-interfaces are deleted, and disable and delete the configuration of any inactive ports on the router. To shut down an interface see the following commands:

ISR4000(config) #Interface GigabitEthernet 0/0/1
ISR4000(config-if) #shutdown

To clear the configuration of an inactive interface, use the following command:

ISR4000 (config) #default interface GigabitEthernet 0/0/1