Cisco Express Forwarding (CEF) must be enabled on all supported Cisco Layer 3 IP devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-5645	NET0949	SV-5645r3_rule	ECSC-1	Medium

Description
The Cisco Express Forwarding (CEF) switching mode replaces the traditional Cisco routing cache with a data structure that mirrors the entire system routing table. Because there is no need to build cache entries when traffic starts arriving for new destinations, CEF behaves more predictably when presented with large volumes of traffic addressed to many destinations such as a SYN flood attacks. Because many SYN flood attacks use randomized source addresses to which the hosts under attack will reply to, there can be a substantial amount of traffic for a large number of destinations that the router will have to handle. Consequently, routers configured for CEF will perform better under SYN floods directed at hosts inside the network than routers using the traditional cache.

Description

The Cisco Express Forwarding (CEF) switching mode replaces the traditional Cisco routing cache with a data structure that mirrors the entire system routing table. Because there is no need to build cache entries when traffic starts arriving for new destinations, CEF behaves more predictably when presented with large volumes of traffic addressed to many destinations such as a SYN flood attacks. Because many SYN flood attacks use randomized source addresses to which the hosts under attack will reply to, there can be a substantial amount of traffic for a large number of destinations that the router will have to handle. Consequently, routers configured for CEF will perform better under SYN floods directed at hosts inside the network than routers using the traditional cache.

STIG	Date
Infrastructure Router Security Technical Implementation Guide Cisco	2013-10-08

Details

Check Text ( C-3605r8_chk )
Determine if the Cisco Layer 3 device supports the use of CEF switching mode. If the current IOS version available for the device does not support CEF in any capacity, this is requirement will be NA. Most Cisco Layer 3 devices will support CEF in either Distributed or Central Mode. 1. If the device supports Distributed CEF Mode (dCEF), verify that it has been globally enabled. 2. If the device only supports Central CEF Mode (CEF), verify the function has been globally enabled. Many of the devices have CEF enabled by default and many of the configurations will not show if CEF functionality is enabled. To verify CEF is running on a Cisco Layer 3 device with IOS run the following command: router#show ip cef %CEF not running If CEF is shown to be not running, this is a finding.

Check Text ( C-3605r8_chk )

Determine if the Cisco Layer 3 device supports the use of CEF switching mode. If the current IOS version available for the device does not support CEF in any capacity, this is requirement will be NA.

Most Cisco Layer 3 devices will support CEF in either Distributed or Central Mode.

1. If the device supports Distributed CEF Mode (dCEF), verify that it has been globally enabled.
2. If the device only supports Central CEF Mode (CEF), verify the function has been globally enabled.

Many of the devices have CEF enabled by default and many of the configurations will not show if CEF functionality is enabled. To verify CEF is running on a Cisco Layer 3 device with IOS run the following command:

router#show ip cef
%CEF not running

If CEF is shown to be not running, this is a finding.

Fix Text (F-5556r6_fix)
1. If the Cisco Layer 3 IP device not enabled by default, enable Distributed CEF Mode globally. Router(config)# ip cef distributed 2. If Distributed CEF Mode is not supported, enable Centralized CEF Mode globally. Router(config)# ip cef 3. If CEF is not supported in any capacity on the device, this finding is NA.