UCF STIG Viewer Logo

The Cisco switch must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.


Finding ID Version Rule ID IA Controls Severity
V-220994 CISC-RT-000090 SV-220994r856401_rule Medium
Network devices that are configured via a zero-touch deployment or auto-loading feature can have their startup configuration or image pushed to the device for installation via TFTP or Remote Copy (rcp). Loading an image or configuration file from the network is taking a security risk because the file could be intercepted by an attacker who could corrupt the file, resulting in a denial of service.
Cisco IOS XE Switch RTR Security Technical Implementation Guide 2023-09-13


Check Text ( C-22709r408776_chk )
Review the device configuration to determine if auto-configuration or zero-touch deployment via Cisco Networking Services (CNS) is enabled.

Auto-Configuration Example:

version 15.0
service config

boot network tftp://x.x.x.x/R5-config

CNS Zero-Touch Example:

cns trusted-server config x.x.x.x
cns trusted-server image x.x.x.x
cns config initial x.x.x.x 80
cns exec 80
cns image

If a configuration auto-loading feature or zero-touch deployment feature is enabled, this is a finding.

Note: Auto-configuration or zero-touch deployment features can be enabled when the switch is offline for the purpose of image loading or building out the configuration. In addition, this would not be applicable to the provisioning of virtual switches via a software-defined network (SDN) orchestration system.
Fix Text (F-22698r408777_fix)
Disable configuration auto-loading if enabled using the following commands:

SW1(config)#no boot network
SW1(config)#no service config

Disable CNS zero-touch deployment if enabled as shown in the example below:

SW2(config)#no cns config initial
SW2(config)#no cns exec
SW2(config)#no cns image
SW2(config)#no cns trusted-server config x.x.x.x
SW2(config)#no cns trusted-server image x.x.x.x