UCF STIG Viewer Logo

Cisco NX-OS Switch RTR Security Technical Implementation Guide


Overview

Date Finding Count (80)
2021-03-29 CAT I (High): 8 CAT II (Med): 45 CAT III (Low): 27
STIG Description
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Available Profiles



Findings (MAC I - Mission Critical Classified)

Finding ID Severity Title
V-221091 High The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).
V-221121 High The Cisco PE switch providing MPLS Virtual Private Wire Service (VPWS) must be configured to have the appropriate virtual circuit identification (VC ID) for each attachment circuit.
V-221126 High The Cisco PE switch must be configured to block any traffic that is destined to the IP core infrastructure.
V-221122 High The Cisco PE switch providing Virtual Private LAN Services (VPLS) must be configured to have all attachment circuits defined to the virtual forwarding instance (VFI) with the globally unique VPN ID assigned for each customer VLAN.
V-221087 High The Cisco perimeter switch must be configured to deny network traffic by default and allow network traffic by exception.
V-221080 High The Cisco switch must be configured to restrict traffic destined to itself.
V-221117 High The Cisco PE switch must be configured to have each Virtual Routing and Forwarding (VRF) instance bound to the appropriate physical or logical interfaces to maintain traffic separation between all MPLS L3VPNs.
V-221118 High The Cisco PE switch must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Target (RT).
V-221095 Medium The Cisco perimeter switch must be configured to block all packets with any IP options.
V-221094 Medium The Cisco perimeter switch must be configured to filter egress traffic at the internal interface on an inbound direction.
V-221093 Medium The Cisco perimeter switch must be configured to filter ingress traffic at the external interface on an inbound direction.
V-221092 Medium The Cisco perimeter switch must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.
V-221090 Medium The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes.
V-221073 Medium The Cisco switch must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.
V-221099 Medium The Cisco perimeter switch must be configured to block all outbound management traffic.
V-221098 Medium The Cisco perimeter switch must be configured to have Proxy ARP disabled on all external interfaces.
V-221081 Medium The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.
V-221105 Medium The Cisco BGP switch must be configured to reject inbound route advertisements from a customer edge (CE) switch for prefixes that are not allocated to that customer.
V-221104 Medium The Cisco BGP switch must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).
V-221107 Medium The Cisco BGP switch must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.
V-221106 Medium The Cisco BGP switch must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS).
V-221100 Medium The Cisco switch must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.
V-221103 Medium The Cisco BGP switch must be configured to reject inbound route advertisements for any Bogon prefixes.
V-221102 Medium The Cisco BGP switch must be configured to use a unique key for each autonomous system (AS) that it peers with.
V-221141 Medium The Cisco multicast Designated switch (DR) must be configured to set the shortest-path tree (SPT) threshold to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.
V-221143 Medium The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to authenticate all received MSDP packets.
V-221123 Medium The Cisco PE switch providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.
V-221120 Medium The Cisco PE switch providing MPLS Layer 2 Virtual Private Network (L2VPN) services must be configured to authenticate targeted Label Distribution Protocol (LDP) sessions used to exchange virtual circuit (VC) information using a FIPS-approved message authentication code algorithm.
V-221128 Medium The Cisco PE switch must be configured to ignore or drop all packets with any IP options.
V-221071 Medium The Cisco switch must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.
V-237760 Medium The Cisco perimeter switch must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.
V-221079 Medium The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
V-221084 Medium The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.
V-221085 Medium The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.
V-221142 Medium The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to only accept MSDP packets from known MSDP peers.
V-221082 Medium The Cisco switch must be configured to have Gratuitous ARP disabled on all external interfaces.
V-221074 Medium The Cisco switch must be configured to use encryption for routing protocol authentication.
V-221088 Medium The Cisco perimeter switch must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.
V-221089 Medium The Cisco perimeter switch must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.
V-221078 Medium The Cisco switch must not be configured to have any feature enabled that calls home to the vendor.
V-221116 Medium The Cisco MPLS switch must be configured to have TTL Propagation disabled.
V-221139 Medium The Cisco multicast Designated switch (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.
V-221110 Medium The Cisco BGP switch must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
V-221075 Medium The Cisco switch must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.
V-221131 Medium The Cisco switch must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.
V-221132 Medium The Cisco multicast switch must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
V-221133 Medium The Cisco multicast switch must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.
V-221127 Medium The Cisco PE switch must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces.
V-221140 Medium The Cisco multicast Designated switch (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.
V-221072 Medium The Cisco switch must be configured to implement message authentication for all control plane protocols.
V-237757 Medium The Cisco switch must not be configured to use IPv6 Site Local Unicast addresses.
V-221119 Medium The Cisco PE switch must be configured to have each VRF with the appropriate Route Distinguisher (RD).
V-221125 Medium The Cisco PE switch must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.
V-221097 Low The Cisco perimeter switch must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.
V-221096 Low The Cisco perimeter switch must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.
V-221109 Low The Cisco BGP switch must be configured to reject route advertisements from CE switches with an originating AS in the AS_PATH attribute that does not belong to that customer.
V-237754 Low The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments.
V-221146 Low The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to limit the amount of source-active messages it accepts on a per-peer basis.
V-221101 Low The Cisco BGP switch must be configured to check whether a single-hop eBGP peer is directly connected.
V-221124 Low The Cisco PE switch must be configured to implement Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping for each Virtual Private LAN Services (VPLS) bridge domain.
V-221108 Low The Cisco BGP switch must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.
V-221147 Low The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to use a loopback address as the source address when originating MSDP traffic.
V-221077 Low The Cisco switch must be configured to have all non-essential capabilities disabled.
V-221086 Low The Cisco switch must be configured to log all packets that have been dropped at interfaces via an ACL.
V-221083 Low The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.
V-221111 Low The Cisco BGP switch must be configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer.
V-221076 Low The Cisco switch must be configured to have all inactive layer 3 interfaces disabled.
V-221144 Low The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to filter received source-active multicast advertisements for any undesirable multicast groups and sources.
V-221112 Low The Cisco BGP switch must be configured to use its loopback address as the source address for iBGP peering sessions.
V-221113 Low The Cisco MPLS switch must be configured to use its loopback address as the source address for LDP peering sessions.
V-221145 Low The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.
V-221138 Low The Cisco multicast Designated switch (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.
V-221129 Low The Cisco PE switch must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS GIG Technical Profile.
V-221114 Low The Cisco MPLS switch must be configured to synchronize Interior Gateway Protocol (IGP) and LDP to minimize packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.
V-221115 Low The MPLS switch with RSVP-TE enabled must be configured with message pacing to adjust maximum burst and maximum number of RSVP messages to an output queue based on the link speed and input queue size of adjacent core switches.
V-221134 Low The Cisco multicast edge switch must be configured to establish boundaries for administratively scoped multicast traffic.
V-221135 Low The Cisco multicast Rendezvous Point (RP) switch must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.
V-221136 Low The Cisco multicast Rendezvous Point (RP) switch must be configured to filter Protocol Independent Multicast (PIM) Register messages received from the Designated switch (DR) for any undesirable multicast groups and sources.
V-221137 Low The Cisco multicast Rendezvous Point (RP) switch must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Cisco switch (DR) for any undesirable multicast groups.
V-221130 Low The Cisco P switch must be configured to implement a Quality-of-Service (QoS) policy in accordance with the QoS GIG Technical Profile.