{
"stig": {
"date": "2018-11-27",
"description": "Infrastructure Router Security Technical Implementation Guide \u2013 Cisco",
"findings": {
"V-14667": {
"checkid": "C-12696r5_chk",
"checktext": "Review device configuration for key expirations of 180 days or less.\n\nIf rotating keys are not configured to expire at 180 days or less, this is a finding.",
"description": "If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being guessed. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates, both with 180-day or less expirations.",
"fixid": "F-14125r4_fix",
"fixtext": "Configure the device so rotating keys expire at 180 days or less.",
"iacontrols": null,
"id": "V-14667",
"ruleID": "SV-15301r4_rule",
"severity": "low",
"title": "Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration of 180 days or less.",
"version": "NET0422"
},
"V-14669": {
"checkid": "C-12780r2_chk",
"checktext": "Verify that the following BSDr global commands are not defined in the configuration:\n\n ip rcmd rcp-enable\n ip rcmd rsh-enable\n\nThese commands have been disabled by default in IOS since version 12.0. \n",
"description": "Berkeley Software Distribution (BSD) \u201cr\u201d commands allow users to execute commands on remote systems using a variety of protocols. The BSD \"r\" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access without passwords to services such as remote command execution (rsh), remote login (rlogin), and remote file copy (rcp and rdist). The difficulty with these commands is that they use address-based authentication. An attacker who convinces a server that he is coming from a \"trusted\" machine can essentially get complete and unrestricted access to a system. The attacker can convince the server by impersonating a trusted machine and using IP address, by confusing DNS so that DNS thinks that the attacker's IP address maps to a trusted machine's name, or by any of a number of other methods",
"fixid": "F-14130r4_fix",
"fixtext": "Configure the device to disable BSDr command services.",
"iacontrols": null,
"id": "V-14669",
"ruleID": "SV-15314r2_rule",
"severity": "medium",
"title": "The administrator must ensure BSD r command services are disabled. ",
"version": "NET0744"
},
"V-14671": {
"checkid": "C-13749r4_chk",
"checktext": "Review the network element configuration and verify that it is authenticating NTP messages received from the NTP server or peer using a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256.\n\nDowngrade:\nIf the network device is not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, then MD5 can be utilized for NTP message authentication and the finding can be downgraded to a CAT III.\n\nIf the network element is not configured to authenticate received NTP messages using a FIPS-approved message authentication code algorithm, this is a finding. A downgrade can be determined based on the criteria above.",
"description": "Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. \n\nTwo NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka \"symmetric mode\"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers.\n\nA hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers. \n\nThe NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.",
"fixid": "F-14132r4_fix",
"fixtext": "Configure the device to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm.",
"iacontrols": null,
"id": "V-14671",
"ruleID": "SV-16089r4_rule",
"severity": "medium",
"title": "The network element must authenticate all NTP messages received from NTP servers and peers.",
"version": "NET0813"
},
"V-14672": {
"checkid": "C-13848r5_chk",
"checktext": "Review the configuration and verify the loopback interface address is used as the source address when originating TACACS+ or RADIUS traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. Verify that a loopback address has been configured as shown in the following example:\n\ninterface loopback 0\n ip address 10.10.2.1 255.255.255.255 \n\u2026\nip tacacs source-interface Loopback0\nip radius source-interface Loopback0\n\nNote: IOS allows multiple loopback interfaces to be defined. \n",
"description": "Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router\u2019s loopback address instead of the numerous physical interface addresses. TACACS+, RADIUS messages sent to management servers should use the loopback address as the source address. ",
"fixid": "F-14134r5_fix",
"fixtext": "Configure the device to use its loopback or OOB management interface address as the source address when originating authentication services traffic.",
"iacontrols": null,
"id": "V-14672",
"ruleID": "SV-16091r2_rule",
"severity": "low",
"title": "The router must use its loopback or OOB management interface address as the source address when originating TACACS+ or RADIUS traffic.",
"version": "NET0897"
},
"V-14673": {
"checkid": "C-12806r2_chk",
"checktext": "Review the configuration and verify the loopback interface address is used as the source address when originating syslog traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. The configuration should look similar as shown in the following example:\ninterface loopback 0\n ip address 10.10.2.1 255.255.255.255 \n\u2026\nlogging on\nlogging host 192.168.1.100\nlogging source-interface Loopback0\n\nNote: IOS allows multiple loopback interfaces to be defined. \n",
"description": "Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router\u2019s loopback address instead of the numerous physical interface addresses. Syslog messages sent to management servers should use the loopback address as the source address.",
"fixid": "F-14135r4_fix",
"fixtext": "Configure the device to use its loopback or OOB management interface address as the source address when originating syslog traffic.",
"iacontrols": null,
"id": "V-14673",
"ruleID": "SV-15340r2_rule",
"severity": "low",
"title": "The router must use its loopback or OOB management interface address as the source address when originating syslog traffic.",
"version": "NET0898"
},
"V-14674": {
"checkid": "C-12809r3_chk",
"checktext": "Review the configuration and verify the loopback interface address is used as the source address when originating NTP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. The configuration should look similar as shown in the following example:\n\ninterface loopback 0\n ip address 10.10.2.1 255.255.255.255 \n\u2026\nntp server 129.237.32.2\nntp server 142.181.31.6\nntp source Loopback0\n\nNote: IOS allows multiple loopback interfaces to be defined. \n",
"description": "Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router\u2019s loopback address instead of the numerous physical interface addresses. NTP messages sent to management servers should use the loopback address as the source address. ",
"fixid": "F-14136r4_fix",
"fixtext": "Configure the device to use its loopback or OOB management interface address as the source address when originating NTP traffic.",
"iacontrols": null,
"id": "V-14674",
"ruleID": "SV-15343r2_rule",
"severity": "low",
"title": "The router must use its loopback or OOB management interface address as the source address when originating NTP traffic.",
"version": "NET0899"
},
"V-14675": {
"checkid": "C-12812r2_chk",
"checktext": "Review the configuration and verify the loopback interface address is used as the source address when originating SNMP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. The configuration should look similar as shown in the following example:\ninterface loopback 0\n ip address 10.10.2.1 255.255.255.255 \n\u2026\n\u2026\nsnmp-server trap-source Loopback0\n\nNote: IOS allows multiple loopback interfaces to be defined. \n",
"description": "Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router\u2019s loopback address instead of the numerous physical interface addresses. SNMP messages sent to management servers should use the loopback address as the source address. ",
"fixid": "F-14137r4_fix",
"fixtext": "Configure the device to use its loopback or OOB management interface address as the source address when originating SNMP traffic.",
"iacontrols": null,
"id": "V-14675",
"ruleID": "SV-15346r2_rule",
"severity": "low",
"title": "The router must use its loopback or OOB management interface address as the source address when originating SNMP traffic.",
"version": "NET0900"
},
"V-14676": {
"checkid": "C-12815r2_chk",
"checktext": "Review the configuration and verify the loopback interface address is used as the source address when originating NetFlow traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. The configuration should look similar as shown in the following example:\ninterface loopback 0\n ip address 10.10.2.1 255.255.255.255 \n\u2026\n\u2026\nip flow-sampling-mode packet-interval 100\nip flow-export destination 192.168.3.33 9991\nip flow-export source Loopback0\n\nNote: IOS allows multiple loopback interfaces to be defined. \n",
"description": "Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router\u2019s loopback address instead of the numerous physical interface addresses. Netflow messages sent to management servers should use the loopback address as the source address. ",
"fixid": "F-14138r2_fix",
"fixtext": "Configure the router to use its loopback or OOB management interface address as the source address when originating NetFlow traffic.",
"iacontrols": null,
"id": "V-14676",
"ruleID": "SV-15349r2_rule",
"severity": "low",
"title": "The router must use its loopback or OOB management interface address as the source address when originating NetFlow traffic.",
"version": "NET0901"
},
"V-14677": {
"checkid": "C-12819r6_chk",
"checktext": "Review the configuration and verify a loopback interface address is used as the source address when originating TFTP or FTP traffic. \n\nRouter# show run\nBuilding configuration...\n!\n!\ninterface Loopback0\n description Loopback interface\n ip address x.x.x.x 255.255.255.255\n no ip directed-broadcast\n!\n...\nip telnet source-interface Loopback0\nip tftp source-interface Loopback0\nip ftp source-interface Loopback0\n\nIf the device is managed from an OOB management network, the OOB interface must be used instead.\n\nRouter# show run\nBuilding configuration...\n!\n...\nip tftp source-interface fe0/0\nip ftp source-interface fe0/0",
"description": "Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress filters for management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router\u2019s loopback address instead of the numerous physical interface addresses. TFTP and FTP messages sent to management servers should use the loopback address as the source address.",
"fixid": "F-40461r1_fix",
"fixtext": "Configure the network device to use a loopback interface address as the source address when originating TFTP or FTP traffic.\n\nExample:\nRouter(config)# interface loopback 0\nRouter(config-if)# ip address x.x.x.x 255.255.255.255 \nRouter(config)# ip ftp source-interface loopback0\nRouter(config)# ip tftp source-interface loopback0\n\nIf an OOB management interface is being used, configure the interface for TFTP or FTP traffic origination.\n\nExample:\nRouter(config)# ip ftp source-interface fe0/0\nRouter(config)# ip tftp source-interface fe0/0",
"iacontrols": [
"ECSC-1"
],
"id": "V-14677",
"ruleID": "SV-15352r3_rule",
"severity": "low",
"title": "The network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.",
"version": "NET0902"
},
"V-14681": {
"checkid": "C-12826r2_chk",
"checktext": "Verify that the peering session with iBGP neighbors use the loopback address as the source address as shown in the example below:\n\ninterface loopback 0\nip address 10.10.2.1 255.255.255.255 \n\u2026\nrouter bgp 100\nneighbor 200.200.200.2 remote-as 200\nneighbor 188.20.120.2 remote-as 144\nneighbor 10.10.2.2 remote-as 100\nneighbor 10.10.2.2 update-source Loopback0\nneighbor 10.10.2.3 remote-as 100\nneighbor 10.10.2.3 update-source Loopback0\n",
"description": "Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane traffic. Log information recorded by authentication and syslog servers will record the router\u2019s loopback address instead of the numerous physical interface addresses.",
"fixid": "F-14148r3_fix",
"fixtext": "Configure the network device's loopback address as the source address for iBGP peering.",
"iacontrols": null,
"id": "V-14681",
"ruleID": "SV-15359r2_rule",
"severity": "low",
"title": "The router must use its loopback interface address as the source address for all iBGP peering sessions.",
"version": "NET0903"
},
"V-14693": {
"checkid": "C-12864r2_chk",
"checktext": "Review the device configuration to ensure FEC0::/10 IP addresses are not defined.\n\nIf FEC0::/10 IP addresses are defined, this is a finding.",
"description": "As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect network security through leaks, ambiguity and potential misrouting, as documented in section 2 of RFC3879. RFC3879 formally deprecates the IPv6 site-local unicast prefix defined in RFC3513, i.e., 1111111011 binary or FEC0::/10.",
"fixid": "F-14158r1_fix",
"fixtext": "Configure the device using authorized IP addresses.",
"iacontrols": [
"ECSC-1"
],
"id": "V-14693",
"ruleID": "SV-15397r2_rule",
"severity": "medium",
"title": "The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF.",
"version": "NET-IPV6-025"
},
"V-14705": {
"checkid": "C-12892r1_chk",
"checktext": "IOS Procedure: Review all Cisco routers to ensure that CEF has been enabled. The configuration should look similar to the following: ipv6 cef ",
"description": "The Cisco Express Forwarding (CEF) switching mode replaces the traditional Cisco routing cache with a data structure that mirrors the entire system routing table. Because there is no need to build cache entries when traffic starts arriving for new destinations, CEF behaves more predictably when presented with large volumes of traffic addressed to many destinations\u2014such as a SYN flood attacks that. Because many SYN flood attacks use randomized source addresses to which the hosts under attack will reply to, there can be a substantial amount of traffic for a large number of destinations that the router will have to handle. Consequently, routers configured for CEF will perform better under SYN floods directed at hosts inside the network than routers using the traditional cache. \n\nNote: Juniper\u2019s FPC (Flexible PIC Concentrator) architecture with the integrated Packet Forwarding Engine provides similar functionality and capabilities and is far superior than the traditional routing cache that is vulnerable to a DoS attack described above. The forwarding plane on all Juniper M and T Series platforms are built around this architecture and therefore is not configurable. The forwarding plane on all Juniper M and T Series platforms are built around the FPC (Flexible PIC Concentrator) architecture that has similar capabilities as CEF. FPC is not configurable and is totally integrated with the Packet Forwarding Engine; hence, this will always be not a finding.\n",
"fixid": "F-14170r1_fix",
"fixtext": "The IAO will ensure that the ipv6 cef command has been configured on Cisco routers. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-14705",
"ruleID": "SV-15425r1_rule",
"severity": "medium",
"title": "The administrator will enable CEF to improve router stability during a SYN flood attack in an IPv6 enclave. ",
"version": "NET-IPV6-033"
},
"V-14707": {
"checkid": "C-12894r1_chk",
"checktext": "Unicast Strict mode: Review the router configuration to ensure uRPF has been configured on all internal interfaces.",
"description": "Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interface appear in the routing table and match the interface on which the packet was received. If the packet was received from one of the best reverse path routes, the packet is forwarded as normal. If there is no reverse path route on the same interface from which the packet was received, it might mean that the source address was modified. If Unicast RPF does not find a reverse path for the packet, the packet is dropped.\n\nIf internal nodes automatically configure an address based on a prefix from a bogus Router Advertisement a dangerous situation may exist. An internal host may contact an internal server which responds with a packet that could be routed outside of the network via default routing (because the routers do not recognize the destination address as an internal address). \n\nTo prevent this, filtering should be applied to network interfaces between internal host LANs and internal server LANs to insure that source addresses have valid prefixes. \n",
"fixid": "F-14172r1_fix",
"fixtext": "The network element must be configured to ensure that an ACL is configured to restrict the router from accepting any outbound IP packet that contains an external IP address in the source field. ",
"iacontrols": null,
"id": "V-14707",
"ruleID": "SV-15429r1_rule",
"severity": "medium",
"title": "The network element must be configured from accepting any outbound IP packet that contains an illegitimate address in the source address field via egress ACL or by enabling Unicast Reverse Path Forwarding in an IPv6 enclave.",
"version": "NET-IPV6-034"
},
"V-14717": {
"checkid": "C-12925r2_chk",
"checktext": "If SSH is used for administrative access, then Version 2 must be configured as shown in the following example:\n\nip ssh version 2\n",
"description": "SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. ",
"fixid": "F-14184r5_fix",
"fixtext": "Configure the network device to use SSH version 2.",
"iacontrols": null,
"id": "V-14717",
"ruleID": "SV-15460r2_rule",
"severity": "medium",
"title": "The network element must not use SSH Version 1 for administrative access.",
"version": "NET1647"
},
"V-15288": {
"checkid": "C-13687r4_chk",
"checktext": "Verify ISATAP tunnels are terminated on the infrastructure routers or L3 switches within the enclave.\n\nExample configuration of an ISATAP tunnel endpoint: \ninterface tunnel 1\nno ip address\nno ip redirects \ntunnel source ethernet 1\n tunnel mode ipv6ip isatap\n ipv6 address 2001:0DB8::/64 eui-64\n no ipv6 nd suppress-ra",
"description": "ISATAP is an automatic tunnel mechanism that does not provide authentication such as IPSec. As a result of this limitation, ISATAP is thought of as a tool that is used inside the enclave among trusted hosts, which would limit it to internal attacks. ISATAP is a service versus a product, and is readily available to most users. If a user knows the ISATAP router IP address, they can essentially get onto the IPv6 intranet. To control the vulnerability of this tunnel mechanism, it is critical to control the use of protocol 41 and use IPv4 filters to control what IPv4 nodes can send protocol 41 packets to an ISATAP router interface. Although the ISATAP tunneling mechanism is similar to other automatic tunneling mechanisms, such as IPv6 6to4 tunneling, ISATAP is designed for transporting IPv6 packets between sites within an enclave, not between enclaves.",
"fixid": "F-14730r6_fix",
"fixtext": "Terminate ISATAP tunnels at the infrastructure router to prohibit tunneled traffic from exiting the enclave perimeter prior to inspection by the IDS, IPS, or firewall.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15288",
"ruleID": "SV-16068r2_rule",
"severity": "medium",
"title": "ISATAP tunnels must terminate at an interior router.",
"version": "NET-TUNL-017"
},
"V-15432": {
"checkid": "C-14439r6_chk",
"checktext": "Verify an authentication server is required to access the device and that there are two or more authentication servers defined.\n\nIf the device is not configured for two separate authentication servers, this is a finding.",
"description": "The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity.\n\nThe use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.",
"fixid": "F-15096r3_fix",
"fixtext": "Configure the device to use two separate authentication servers.",
"iacontrols": null,
"id": "V-15432",
"ruleID": "SV-16259r4_rule",
"severity": "medium",
"title": "Network devices must use two or more authentication servers for the purpose of granting administrative access.",
"version": "NET0433"
},
"V-15434": {
"checkid": "C-14441r6_chk",
"checktext": "Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online.\n\nIf the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.",
"description": "The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.",
"fixid": "F-15098r7_fix",
"fixtext": "Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.",
"iacontrols": null,
"id": "V-15434",
"ruleID": "SV-16261r5_rule",
"severity": "high",
"title": "The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.",
"version": "NET0441"
},
"V-17754": {
"checkid": "C-19015r3_chk",
"checktext": "Review the device configuration to determine if IPSec tunnels used in transiting management traffic are filtered to only accept authorized traffic based on source and destination IP addresses of the management network.\n\nIf filters are not restricting only authorized management traffic into the IPSec tunnel, this is a finding.",
"description": "The Out-of-Band Management (OOBM) network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device enabling network management traffic to flow between the managed NEs and the NOC. This allows the use of paths separate from those used by the network being managed. Traffic from the managed network to the management network and vice-versa must be secured via IPSec encapsulation.",
"fixid": "F-17652r2_fix",
"fixtext": "Configure filters based on source and destination IP address to restrict only authorized management traffic into IPSec tunnels used for transiting management data.",
"iacontrols": null,
"id": "V-17754",
"ruleID": "SV-18945r2_rule",
"severity": "medium",
"title": "IPSec tunnels used to transit management traffic must be restricted to only the authorized management packets based on destination and source IP address.",
"version": "NET1807"
},
"V-17814": {
"checkid": "C-19020r1_chk",
"checktext": "Verify the configuration at the remote VPN end-point is a mirror configuration as that reviewed for the local end-point.",
"description": "The IPSec tunnel end points may be configured on the OOBM gateway routers connecting the managed network and the NOC. They may also be configured on a firewall or VPN concentrator located behind the gateway router. In either case, the crypto access-list used to identify the traffic to be protected must be a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.",
"fixid": "F-17724r1_fix",
"fixtext": "Configure he crypto access-list used to identify the traffic to be protected so that it is a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.",
"iacontrols": null,
"id": "V-17814",
"ruleID": "SV-19063r1_rule",
"severity": "medium",
"title": "Gateway configuration at the remote VPN end-point is a not a mirror of the local gateway ",
"version": "NET1808"
},
"V-17815": {
"checkid": "C-20142r1_chk",
"checktext": "Verify that the OOBM interface is an adjacency only in the IGP routing domain for the management network. The following would be an example where EIGRP is run on the management network 10.0.0.0 and OSPF in the managed network 172.20.0.0. The network 10.1.20.0/24 is the OOBM backbone and 10.1.1.0 is the local management LAN connecting to the OOBM interfaces of the managed network (i.e., the private and service network) elements.\n\ninterface Serial0/0\n description to_OOBM_Backbone\n ip address 10.1.20.3 255.255.255.0\ninterface Fastethernet 0/0\n description Enclave_Management_LAN\n ip address 10.1.1.1 255.255.255.0 \ninterface Fastethernet 0/1\n description to_our_PrivateNet\n ip address 172.20.4.2 255.255.255.0 \ninterface Fastethernet 0/2\n description to_our_ServiceNet\n ip address 172.20.5.2 255.255.255.0 \n!\nrouter ospf 1\n network 172.20.0.0\n!\nrouter eigrp 12\n network 10.0.0.0\n passive-interface Fastethernet 0/1\n\nNote: the passive-interface command is configured to avoid building an EIGRP adjacency with a managed router, while at the same time, enabling EIGRP to advertise the enclave\u2019s management subnet to the EIGRP neighbors of the management network backbone.\n\nIf the non-dedicated OOBM gateway and the NOC gateway are not connected by an OOB backbone\u2014that is, connectivity is provided over an IP backbone (i.e. NIPRNet)\u2014and an IGP is used to advertise routes within the management network, the IGP traffic must be encapsulated via GRE so that it can traverse the IPsec tunnel. The configuration below is an example of GRE over IPSec. The IPSec policy is applied to the GRE traffic that will encapsulate IGP packets (notice the EIGRP network statement includes the GRE tunnel; hence, EIGRP will form adjacencies with neighbors on the other side of this tunnel.\n \nPremise Router Configuration\ncrypto isakmp policy 10\n authentication pre-share\ncrypto isakmp key ourkey address 166.4.24.3\n!\ncrypto ipsec transform-set VPN-trans esp-3des esp-md5-hmac\n!\ncrypto map vpnmap 10 ipsec-isakmp\n set peer 166.4.24.3\n set transform-set VPN-trans\n match address 102\n!\ninterface Ethernet1\n ip address 10.1.1.1 255.255.255.0\n!\ninterface Serial1/0\n ip address 141.22.4.3 255.255.255.252\n!\ninterface Tunnel0\n ip address 10.10.255.1 255.255.255.252\n ip mtu 1400\n tunnel source Serial0/0\n tunnel destination 166.4.24.3\n crypto map vpnmap\n!\nrouter eigrp 100\n network 10.0.0.0 0.0.0.255\n no auto-summary\n!\nip route 0.0.0.0 0.0.0.0 141.22.4.1\n!\naccess-list 102 permit gre host 141.22.4.3 host 166.4.24.3\n\n\n\nOOBM VPN Gateway Configuration\n\ncrypto isakmp policy 10\n authentication pre-share\ncrypto isakmp key ourkey address 141.22.4.3\n!\ncrypto ipsectransform-set VPN-trans esp-3des esp-md5-hmac\n!\ncrypto map vpnmap 10 ipsec-isakmp\n set peer 141.22.4.3\n set transform-set VPN-trans\n match address 102\n!\ninterface Ethernet1\n ip address 10.1.2.1 255.255.255.0\n!\ninterface Serial1/0\nip address 166.4.24.3 255.255.255.252\n!\ninterface Tunnel0\n ip address 10.10.255.2 255.255.255.252\n ip mtu 1400\n tunnel source Serial0/0\n tunnel destination 141.22.4.3\n crypto map vpnmap\n!\nrouter eigrp 100\n network 10.0.0.0 0.0.0.255\n no auto-summary\n!\nip route 0.0.0.0 0.0.0.0 166.4.24.1\n!\naccess-list 102 permit gre host 166.4.24.3 host 141.22.4.3\n\n",
"description": "If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router\u2014one for the managed network and one for the OOBM network. ",
"fixid": "F-17730r1_fix",
"fixtext": "Ensure that multiple IGP instances configured on the OOBM gateway router peer only with their appropriate routing domain. Verify that the all interfaces are configured for the appropriate IGP instance.",
"iacontrols": null,
"id": "V-17815",
"ruleID": "SV-19297r1_rule",
"severity": "medium",
"title": "IGP instances configured on the OOBM gateway router do not peer only with their appropriate routing domain",
"version": "NET0985"
},
"V-17816": {
"checkid": "C-20200r1_chk",
"checktext": "Verify that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.\n\n\nRoute advertisements between two the two routing domains such as OSPF and EIGRP can only be shared via redistribution. Verify that there are no redistribute commands configured under IGP domain for the management network that would enable distributing routes from the IGP domain of the managed network, or vice-versa. The following would be an example of redistributing routes from EIGRP into OSPF.\n\nrouter ospf 1\n network 172.20.0.0\n redistribute eigrp 12\n\n\nIOS supports multiple instances of OSPF and EIGRP that are configured using a different process ID. Each EIGRP or OSPF process will run only on the interfaces of the networks specified. Each EIGRP process maintains a separate topology database; likewise, each OSPF process maintains a separate link-state database. Route advertisements between two processes can only be shared via redistribution. Verify that there are no redistribution commands that would distribute routes from the IGP routing domain for the management network into the IGP routing domain of the managed network, or vice-versa. The following would be an example of redistributing routes from one EIGRP into another EIGRP.\n!\nrouter eigrp 15\n network 172.20.0.0\n!\nrouter eigrp 10\n network 10.0.0.0\n redistribute eigrp 15\n\nAs an alternative, static routes can be used to forward management traffic to the OOBM interface; however, this method may not scale well. \n\nIf static routes are used to forward management traffic to the OOB backbone network, verify that the OOBM interface is not an IGP adjacency and that the correct destination prefix has been configured to forward the management traffic to the correct next-hop and interface for the static route. In the following configuration examples, 10.1.1.0/24 is the management network and 10.1.20.4 is the interface address of the OOB backbone router that the OOB gateway router connects to. The network 10.1.20.0/24 is the OOBM backbone.\n\ninterface Serial0/0\n description to_OOBM_Backbone\n ip address 10.1.20.3 255.255.255.0\ninterface Fastethernet 0/0\n description to_our_PrivateNet\n ip address 172.20.4.2 255.255.255.0 \ninterface Fastethernet 0/1\n description to_our_ServiceNet\n ip address 172.20.5.2 255.255.255.0 \n!\nrouter ospf 1\n network 172.20.0.0\n!\nip route 10.1.1.0 255.255.255.0 10.1.20.4 Serial0/0\n\n\n",
"description": "If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router\u2014one for the managed network and one for the OOBM network. In addition, the routes from the two domains must not be redistributed to each other.",
"fixid": "F-17731r1_fix",
"fixtext": "Ensure that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.",
"iacontrols": null,
"id": "V-17816",
"ruleID": "SV-19299r1_rule",
"severity": "medium",
"title": "The routes from the two IGP domains are redistributed to each other.",
"version": "NET0986"
},
"V-17817": {
"checkid": "C-20202r1_chk",
"checktext": "Review the ACL or filters for the router\u2019s receive path and verify that only traffic sourced from the management network is allowed to access the router. This would include both management and control plane traffic.\n\nStep 1: Verify that the global ip receive acl statement has been configured as shown in the following example:\n\nip receive acl 199\n\nNote: The IOS IP Receive ACL feature provides filtering capability for traffic that is destined for the router. The IP Receive ACL filtering occurs after any input ACL bound to the ingress interface. On distributed platforms (i.e., 12000 series), the IP receive ACL filters traffic on the distributed line cards before packets are received by the route processor; thereby preventing the flood from degrading the performance of the route processor.\n\nStep 2: Determine the address block of the management network at the NOC. In the example configuration below, the 10.2.2.0/24 is the management network at the NOC.\n\nStep 3: Verify that the ACL referenced by the ip receive acl statement restricts all management plane traffic to the validated network management address block at the NOC. Management traffic can include telnet, SSH, SNMP, TACACS, RADIUS, TFTP, FTP, and ICMP. Control plane traffic from OOBM backbone neighbors should also be allowed to access the router. The ACL configuration should look similar to the following: \n\naccess-list 199 deny ip any any fragments\naccess-list 199 permit ospf 10.1.20.0 0.0.0.255 any\naccess-list 199 permit tcp 10.2.2.0 0.0.0.255 any eq ssh\naccess-list 199 permit udp host 10.2.2.24 any eq snmp\naccess-list 199 permit udp host 10.2.2.25 any eq snmp\naccess-list 199 permit udp host 10.2.2.26 any eq ntp\naccess-list 199 permit udp host 10.2.2.27 any eq ntp\naccess-list 199 permit tcp host 10.2.2.30 eq tacacs any gt 1023 established\naccess-list 199 permit tcp host 10.2.2.77 eq ftp any gt 1023 established\naccess-list 199 permit tcp host 10.2.2.77 gt 1024 any eq ftp-data\naccess-list 199 permit icmp 10.2.2.0 0.0.0.255 any \naccess-list 199 deny ip any any log\n\nIn the example above, the OSPF neighbors would be adjacencies with the OOBM backbone network 10.1.20.0/24. \n\nIf the platform does not support the receive path filter, then verify that all non-OOBM interfaces have an ingress ACL to restrict access to that interface address or any of the router\u2019s loopback addresses to only traffic sourced from the management network. Exception would be to allow packets destined to these interfaces used for troubleshooting such as ping and traceroute.\n\n",
"description": "If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway router.",
"fixid": "F-17732r1_fix",
"fixtext": "Ensure that traffic from the managed network is not able to access the OOBM gateway router using either receive path or interface ingress ACLs.",
"iacontrols": null,
"id": "V-17817",
"ruleID": "SV-19301r2_rule",
"severity": "medium",
"title": "Traffic from the managed network is able to access the OOBM gateway router",
"version": "NET0987"
},
"V-17818": {
"checkid": "C-20204r1_chk",
"checktext": "Examine the egress filter on the OOBM interface of the gateway router to verify that only traffic sourced from the management address space is allowed to transit the OOBM backbone. In the example configurations below, the 10.1.1.0/24 is the management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC.\n\nIOS\n\ninterface Serial0/0\n description to_OOBM_Backbone\n ip address 10.1.20.3 255.255.255.0\n ip access-group 101 out \ninterface Fastethernet 0/0\n description Enclave_Management_LAN\n ip address 10.1.1.1 255.255.255.0 \ninterface Fastethernet 0/1\n description to_our_ServiceNet\n ip address 172.20.5.2 255.255.255.0 \n!\naccess-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255\naccess-list 101 deny ip any any log\n",
"description": "If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries such as using interface ACLs or filters at the boundaries between the two networks. ",
"fixid": "F-17733r1_fix",
"fixtext": "Configure the OOBM gateway router interface ACLs to ensure traffic from the managed network does not leak into the management network.",
"iacontrols": null,
"id": "V-17818",
"ruleID": "SV-19303r1_rule",
"severity": "medium",
"title": "Traffic from the managed network will leak into the management network via the gateway router interface connected to the OOBM backbone.",
"version": "NET0988"
},
"V-17819": {
"checkid": "C-20206r1_chk",
"checktext": "Examine the ingress filter on the OOBM interface of the gateway router to verify that traffic is only destined to the local management address space. In the example configurations below, the 10.1.1.0/24 is the local management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC.\n\nIOS\n\ninterface Serial0/0\n description to_OOBM_Backbone\n ip address 10.1.20.3 255.255.255.0\n ip access-group 100 in \n ip access-group 101 out \ninterface Fastethernet 0/0\n description Enclave_Management_LAN\n ip address 10.1.1.2 255.255.255.0 \ninterface Fastethernet 0/1\n description to_our_ServiceNet\n ip address 172.20.5.2 255.255.255.0 \ninterface Fastethernet 0/2\n description to_our_PrivateNet\n ip address 172.20.4.2 255.255.255.0 \n!\naccess-list 100 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255\naccess-list 100 deny ip any any log\n\n\n",
"description": "If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. To provide separation, access control lists or filters must be configured to block any traffic from the management network destined for the managed network\u2019s production address spaces.",
"fixid": "F-17734r2_fix",
"fixtext": "Configure access control lists or filters to block any traffic from the management network destined for the managed network's production address spaces.",
"iacontrols": null,
"id": "V-17819",
"ruleID": "SV-19305r1_rule",
"severity": "medium",
"title": "Management network traffic is leaking into the managed network.",
"version": "NET0989"
},
"V-17821": {
"checkid": "C-22335r2_chk",
"checktext": "After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify that the interface has been assigned an address from the local management address block. In this example, that is 10.1.1.0/24.\n\nCisco router\n\ninterface Fastethernet 0/0\n description Enclave_Management_LAN\n ip address 10.1.1.22 255.255.255.0 \n\nCisco Catalyst MLS Switch\n\ninterface VLAN 101\ndescription Management_VLAN\nip address 10.1.1.22 255.255.255.0 \n\u2026\n\u2026\ninterface FastEthernet1/6\n switchport access vlan 101\n switchport mode access\n\nor\n\ninterface FastEthernet1/6\n no switchport\n ip address 10.1.1.22 255.255.255.0 \n\nCaveat: If the interface is configured as a routed interface as shown in the above configuration, the requirements specified in NOC180 must be implemented.\n",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.",
"fixid": "F-17736r2_fix",
"fixtext": "Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.",
"iacontrols": null,
"id": "V-17821",
"ruleID": "SV-20205r2_rule",
"severity": "medium",
"title": "The network element\u2019s OOBM interface must be configured with an OOBM network address.",
"version": "NET0991"
},
"V-17822": {
"checkid": "C-22338r1_chk",
"checktext": "Step 1: Verify that the managed interface has an inbound and outbound ACL configured as shown in the following example:\n\ninterface FastEthernet1/1\n description Enclave_Management_LAN\n ip address 10.1.1.22 255.255.255.0 \n ip access-group 100 in \n ip access-group 101 out \n\nStep 2: Verify that the ingress ACL blocks all transit traffic\u2014that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. In the example the management network at the NOC is 10.2.2.0/24.\n\naccess-list 100 permit ip 10.2.2.0 0.0.0.255 host 10.1.1.22\naccess-list 100 deny ip any any log\n\nNote that the destination used by any host within the management network to access the managed elements must be via the management interface. The loopback should not be a valid address since these prefixes would not be advertised into the management network IGP domain. This could only be possible if the managed network Elements: had an IGP adjacency with the managed network, which should not be the case.\n\nStep 3: Verify that the egress ACL blocks any traffic not originated by the managed element \n\naccess-list 101 deny ip any any log\n\nCisco router-generated packets are not inspected by outgoing access-lists. Hence, the above configuration would simply drop any packets not generated by the router itself and allow all local traffic. To filter local traffic, IOS provides a feature called local policy routing, which enables the administrator to apply a route-map to any local router-generated traffic. To prohibit outgoing traffic from the local router to any destination other than the NOC, the a configuration such as the following could be used:\n\n! Do not drop traffic destined to 10.2.2.0/24. Hence, do not include it in \n! the local policy route map, but include all other destinations.\n!\nip access-list extended BLOCK_INVALID_DEST\n deny ip any 10.2.2.0 0.0.0.255\n permit ip any any\n!\nroute-map LOCAL_POLICY 10\n match ip address BLOCK_INVALID_DEST\n set interface Null 0\n!\nip local policy route-map LOCAL_POLICY\n\n\nAlternative Solution: The IOS Management Plane Protection Feature\n\nCisco introduced the Management Plane Protection (MPP) feature with IOS 12.4(6)T which allows any physical in-band interface to be dedicated for OOB management. The MPP feature allows a network operator to designate one or more router interfaces as management interfaces. Management traffic is permitted to enter a device only through these management interfaces. All of the other in-band interfaces not enabled for MPP will automatically drop all ingress packets associated with any of the supported MPP protocols (FTP, HTTP, HTTPS, SCP, SSH, SNMP, Telnet, and TFTP). Hence, after MPP is enabled, no interfaces except management interfaces will accept network management traffic destined to the device. This feature also provides the capability to restrict which management protocols are allowed. This feature does not change the behavior of the console, auxiliary, and management Ethernet interfaces. The following configuration example depicts FastEthernet1/1 as being the designated management interface that will only allow ssh and snmp traffic.\n\n\ncontrol-plane host\n management-interface FastEthernet1/1 allow ssh snmp\n!\ninterface FastEthernet1/1\n description Enclave_Management_LAN\n ip address 10.1.1.22 255.255.255.0 \n",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.\n\nAn OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network\n",
"fixid": "F-17737r2_fix",
"fixtext": "If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.",
"iacontrols": null,
"id": "V-17822",
"ruleID": "SV-20208r1_rule",
"severity": "medium",
"title": "The management interface is not configured with both an ingress and egress ACL. ",
"version": "NET0992"
},
"V-17823": {
"checkid": "C-20313r4_chk",
"checktext": "If the managed network element is a layer 3 device, review the configuration to verify the management interface is configured as passive for the IGP instance for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration. The following configuration would be an example where OSPF is only enabled on all interfaces except the management interface:\n\ninterface Fastethernet 0/0\n description Enclave_Management_LAN\n ip address 10.1.1.22 255.255.255.0 \n ip access-group 100 in \n ip access-group 101 out \ninterface Fastethernet 0/1\n description to_our_PrivateNet\n ip address 172.20.4.2 255.255.255.0 \ninterface Fastethernet 0/2\n description to_our_ServiceNet\n ip address 172.20.5.2 255.255.255.0 \ninterface Fastethernet 1/1\n description to_our_DMZ\n ip address 172.20.3.1 255.255.255.0 \n!\nrouter ospf 1\n network 172.20.0.0 255.255.255.0 area 1\n\nNote: The MPP feature has no effect on control plane traffic. Hence, the routing protocol must still be configured so that it is not enabled on the management interface.\n\n",
"description": "The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.\n\nAn OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so management traffic, both data plane and control plane, does not leak into the managed network and production traffic does not leak into the management network.\n",
"fixid": "F-17738r2_fix",
"fixtext": "Configure the management interface as passive for the IGP instance configured for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration.",
"iacontrols": null,
"id": "V-17823",
"ruleID": "SV-19334r2_rule",
"severity": "low",
"title": "The network element\u2019s management interface is not configured as passive for the IGP instance deployed in the managed network.",
"version": "NET0993"
},
"V-17834": {
"checkid": "C-20257r1_chk",
"checktext": "Review the router configuration and verify that an inbound ACL has been configured for the management network sub-interface as illustrated in the following example configuration:\n\nIOS\n\n interface GigabitEthernet3\n no ip redirects\n no ip directed-broadcast\n interface GigabitEthernet3.10 \n encapsulation dot1q 10\n description Management VLAN\n ip address 10.1.1.1 255.255.255.0\n ip access-group 108 in\n !\n access-list 108 permit \u2026\n\n",
"description": "If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the same time it is defined as a unique VLAN. Inter-VLAN routing or the routing of traffic between nodes residing in different subnets requires a router or multi-layer switch (MLS). Access control lists must be used to enforce the boundaries between the management network and the network being managed. All physical and virtual (i.e. MLS SVI) routed interfaces must be configured with ACLs to prevent the leaking of unauthorized traffic from one network to the other. ",
"fixid": "F-17751r1_fix",
"fixtext": " If a router is used to provide inter-VLAN routing, configure an inbound ACL for the management network sub-interface for the trunk link to block non-management traffic.\n",
"iacontrols": null,
"id": "V-17834",
"ruleID": "SV-19308r1_rule",
"severity": "medium",
"title": "An inbound ACL is not configured for the management network sub-interface of the trunk link to block non-management traffic.\n\n",
"version": "NET1005"
},
"V-17835": {
"checkid": "C-20259r1_chk",
"checktext": "Verify that all traffic from the managed network to the management network and vice-versa is secured via IPSec encapsulation. In the configuration examples, 10.2.2.0/24 is the management network at the NOC and 192.168.1.0/24 is address space used at the network being managed (i.e., the enclave). For Cisco router, the access-list referenced by the crypto map must have the source and destination addresses belonging to the management network address space at the enclave and NOC respectively.\n\nhostname Premrouter\n!\ninterface Serial1/0\n ip address 19.16.1.1 255.255.255.0\n description NIPRNet_Link\n crypto map myvpn\ninterface Fastethernet 0/0\n description Enclave_Management_LAN\n ip address 192.168.1.1 255.255.255.0 \n!\ncrypto isakmp policy 1\n authentication pre-share\n lifetime 84600\n crypto isakmp key ******* address 19.16.2.1\n!\ncrypto ipsec transform-set toNOC esp-des esp-md5-hmac \n!\ncrypto map myvpn 10 ipsec-isakmp \n set peer 19.16.2.1\n set transform-set toNOC\n match address 101\n!\naccess-list 101 permit ip any 10.2.2.0 0.0.0.255\n\n",
"description": "Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity between the NOC and the managed networks\u2019 premise routers would be enabled using either provisioned circuits or VPN technologies such as IPSec tunnels or MPLS VPN services. ",
"fixid": "F-17752r1_fix",
"fixtext": "Where IPSec technology is deployed to connect the managed network to the NOC, it is imperative that the traffic entering the tunnels is restricted to only the authorized management packets based on destination address. ",
"iacontrols": null,
"id": "V-17835",
"ruleID": "SV-19310r1_rule",
"severity": "medium",
"title": "Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address. ",
"version": "NET1006"
},
"V-17836": {
"checkid": "C-20262r1_chk",
"checktext": "class-map match-all MANAGEMENT-TRAFFIC\n match access-group name CLASSIFY-MANAGEMENT-TRAFFIC\n!\npolicy-map DIST-LAYER-POLICY\n class MANAGEMENT-TRAFFIC\n set ip dscp 48\n!\ninterface FastEthernet0/0\n description link to LAN1\n ip address 192.168.1.1 255.255.255.0\n service-policy input DIST-LAYER-POLICY\ninterface FastEthernet0/1\n description link to LAN2\n ip address 192.168.2.1 255.255.255.0\n service-policy input DIST-LAYER-POLICY\ninterface FastEthernet0/2\n description link to core\n ip address 192.168.13.1 255.255.255.0\n!\nip access-list extended CLASSIFY-MANAGEMENT-TRAFFIC\n permit ip any 10.2.2.0 0.0.0.255\n\nNote: Traffic is marked using the set command in a policy map. For DSCP rewrite, if a packet encounters both input and output classification policy, the output policy has precedence. If there is no output policy, then the input policy has precedence.\n\n",
"description": "When network congestion occurs, all traffic has an equal chance of being dropped. \nPrioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed. \n\nWhen management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic.\n",
"fixid": "F-17756r1_fix",
"fixtext": "When management traffic must traverse several nodes to reach the management network, classify and mark management traffic at the nearest upstream MLS or router.",
"iacontrols": null,
"id": "V-17836",
"ruleID": "SV-19313r1_rule",
"severity": "low",
"title": "Management traffic is not classified and marked at the nearest upstream MLS or router when management traffic must traverse several nodes to reach the management network.",
"version": "NET1007"
},
"V-17837": {
"checkid": "C-20264r1_chk",
"checktext": "When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic. This will ensure that management traffic receives guaranteed bandwidth at each forwarding device along the path to the management network. \n\nStep 1: Verify that a service policy is bound to all core or internal router interfaces as shown in the configuration below:\n\ninterface FastEthernet0/1\n ip address 192.168.2.1 255.255.255.0 \n service-policy output QoS-Policy\ninterface FastEthernet0/2 \n ip address 192.168.1.1 255.255.255.0\n service-policy output QoS-Policy\n\nStep 2: Verify that the class-maps place management traffic in the appropriate forwarding class as shown in the example below:\n\nclass-map match-all best-effort\n match ip dscp 0\nclass-map match-any data-AF13-AF23\n match ip dscp 14\n match ip dscp 22\nclass-map match-any video-AF33-AF43\n match ip dscp 30\n match ip dscp 38\nclass-map match-all voice-EF\n match ip dscp 46\nclass-map match-all network-control\n match ip dscp 48\n\n \nStep 3: Verify that the classes are receiving the required service. \n\npolicy-map QoS-Policy\n class best-effort\n bandwidth percent 10\n random-detect dscp-based \n class data-AF13-AF23\n bandwidth percent 30\n random-detect dscp-based \n class video-AF33\n bandwidth percent 15\n random-detect dscp-based \nclass video-AF43\n bandwidth percent 20\n random-detect dscp-based \n class voice-EF\n priority percent 20\n class network-control\n bandwidth percent 5\n random-detect dscp-based\n\nNote 1: The dscp-based argument enables WRED to use the DSCP value of a packet when it calculates the drop probability for the packet; whereas if the prec-based argument is specified, WRED will use the IP Precedence value to calculate drop probability. If neither is specified, the default is prec-based.\n\nNote 2: LLQ is enabled with the priority command using either a kbps value or a bandwidth percentage using the percent keyword followed by a percentage value.\n\nNote 3: Traffic that does not meet the match criteria specified in the forwarding classes is treated as belonging to the default forwarding class. If a default class is not configured, the default class has no QoS functionality. These packets are then placed into a FIFO queue and forwarded at a rate determined by the available underlying bandwidth. This FIFO queue is managed by tail drop\u2014a means of avoiding congestion that treats all traffic equally and does not differentiate between classes of service. When the output queue is full and tail drop is in effect, packets are dropped until the congestion is eliminated and the queue is no longer full. The following example configures a default class called policy1. \n\npolicy-map policy1\n class class-default\n fair-queue 10\n queue-limit 20\n\nThe default class shown above has these characteristics: 10 queues for traffic that does not meet the match criteria of other classes whose policy is defined by policy1, and a maximum of 20 packets per queue before tail drop is enacted to handle additional queued packets.\n\n \n",
"description": "When network congestion occurs, all traffic has an equal chance of being dropped. \nPrioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed. \n\nWhen management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic.\n",
"fixid": "F-17757r1_fix",
"fixtext": "When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic. ",
"iacontrols": null,
"id": "V-17837",
"ruleID": "SV-19315r1_rule",
"severity": "low",
"title": "The core router within the managed network has not been configured to provide preferred treatment for management traffic that must traverse several nodes to reach the management network.",
"version": "NET1008"
},
"V-18522": {
"checkid": "C-21297r6_chk",
"checktext": "Review the firewall protecting the server farm to validate an ACL with a deny-by-default security posture has been implemented that secures the servers located on the VLAN. If the filter is not defined on the firewall and the architecture contains a layer 3 switch between the firewall and the server, then review the ACL configured for the VLAN on the L3 switch. ",
"description": "Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.",
"fixid": "F-19125r4_fix",
"fixtext": "Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.",
"iacontrols": null,
"id": "V-18522",
"ruleID": "SV-20061r3_rule",
"severity": "medium",
"title": "Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.",
"version": "NET-SRVFRM-003"
},
"V-18790": {
"checkid": "C-22501r1_chk",
"checktext": "Identify the tunnel endpoints, then review all routing devices to ensure the tunnel entry point is not used as a default route.\n\nTraffic destined to the tunnel should be directed to the tunnel endpoint by static routes, policy based routing, or by the mechanics of the interior routing protocol, but not by default route statements.",
"description": "Routing in the network containing the tunnel entry point must be configured to direct the intended traffic into the tunnel. Depending on the router products used this may be done by creating routes to a tunnel by name, by address, or by interface. \n\nIf multiple tunnels are defined or IPv6 interfaces, you must be selective with static routes, policy based routing, or even let the interior gateway protocol (IGP) make the decision since a ipv4 or ipv6 address has been configured on the tunnel. The key is the administrator should carefully plan and configure or let the IGP determine what goes into each tunnel.",
"fixid": "F-19446r1_fix",
"fixtext": "The SA must carefully plan and configure or let IGP determine what goes into each tunnel.\n",
"iacontrols": [
"ECSC-1"
],
"id": "V-18790",
"ruleID": "SV-20504r2_rule",
"severity": "medium",
"title": "Default routes must not be directed to the tunnel entry point.",
"version": "NET-TUNL-012"
},
"V-19188": {
"checkid": "C-23285r3_chk",
"checktext": "Control Plane Policing (CoPP)\n\nIf supported by the router, CoPP should be used to increase security on Cisco routers by protecting the RP from unnecessary and malicious traffic. CoPP allows network operators to classify traffic based on importance that then enables the router to filter and rate limit the traffic according to the defined policy for each class.\n\nStep 1: Verify traffic types have been classified based on importance levels. The following is an example configuration:\n\nclass-map match-all CoPP_CRITICAL\n match access-group name CoPP_CRITICAL\nclass-map match-any CoPP_IMPORTANT\n match access-group name CoPP_IMPORTANT\n match protocol arp\nclass-map match-all CoPP_NORMAL\n match access-group name CoPP_NORMAL\nclass-map match-any CoPP_UNDESIRABLE\n match access-group name CoPP_UNDESIRABLE\nclass-map match-all CoPP_DEFAULT\n match access-group name CoPP_DEFAULT\n\nStep 2: Review the ACLs referenced by the match access-group commands to determine if the traffic is being classified appropriately. The following is an example configuration:\n\nip access-list extended CoPP_CRITICAL\n remark our control plane adjacencies are critical\n permit ospf host [OSPF neighbor A] any\n permit ospf host [OSPF neighbor B] any\n permit pim host [PIM neighbor A] any\n permit pim host [PIM neighbor B] any\n permit pim host [RP addr] any\n permit igmp any 224.0.0.0 15.255.255.255\n permit tcp host [BGP neighbor] eq bgp host [local BGP addr]\n permit tcp host [BGP neighbor] host [local BGP addr] eq bgp\n deny ip any any\n\nip access-list extended CoPP_IMPORTANT\n permit tcp host [TACACS server] eq tacacs any\n permit tcp [management subnet] 0.0.0.255 any eq 22\n permit udp host [SNMP manager] any eq snmp\n permit udp host [NTP server] eq ntp any\n deny ip any any\n\nip access-list extended CoPP_NORMAL\n remark we will want to rate limit ICMP traffic\n permit icmp any any echo\n permit icmp any any echo-reply\n permit icmp any any time-exceeded\n permit icmp any any unreachable\n deny ip any any\n\nip access-list extended CoPP_UNDESIRABLE\n remark other management plane traffic that should not be received\n permit udp any any eq ntp\n permit udp any any eq snmptrap\n permit tcp any any eq 22\n permit tcp any any eq 23\n remark other control plane traffic not configured on router\n permit eigrp any any\n permit udp any any eq rip\n deny ip any any\n\nip access-list extended CoPP_DEFAULT\n permit ip any any\n\n\nNote: Explicitly defining undesirable traffic with ACL entries enables the network operator to collect statistics. Excessive ARP packets can potentially monopolize Route Processor resources, starving other important processes. Currently, ARP is the only Layer 2 protocol that can be specifically classified using the match protocol command. \n\nStep 3: Review the policy-map to determine if the traffic is being policed appropriately for each classification. The following is an example configuration:\n\n\npolicy-map CONTROL_PLANE_POLICY\n class CoPP_CRITICAL\npolice 512000 8000 conform-action transmit exceed-action transmit\nclass CoPP_IMPORTANT\n police 256000 4000 conform-action transmit exceed-action drop\nclass CoPP_NORMAL\n police 128000 2000 conform-action transmit exceed-action drop\nclass CoPP_UNDESIRABLE\n police 8000 1000 conform-action drop exceed-action drop\nclass cp-default-in\n police 64000 1000 conform-action transmit exceed-action drop\n\n\nStep 4: Verify that the CoPP policy is enabled. The following is an example configuration:\n\ncontrol-plane\n service-policy input CONTROL_PLANE_POLICY\n\n\nNote: Starting with IOS release 12.4(4)T, Control Plane Protection (CPPr) can be used to filter as well as police control plane traffic destined to the RP. CPPr is very similar to CoPP and has the ability to filter and police traffic using finer granularity by dividing the aggregate control plane into three separate categories: (1) host, (2) transit, and (3) CEF-exception. Hence, a separate policy-map could be configured for each traffic category.\n\n\nIf CoPP is not supported, then the alternative would be the implementation of a receive path filter.\n\nStep 1: A receive path ACL or an inbound ACL on each interface must be configured to restrict traffic destined to the router. The IOS IP Receive ACL feature provides filtering capability explicitly for traffic that is destined for the router. Verify that the global ip receive acl statement has been configured as shown in the following example:\n\nip receive acl 199\n\nNote: If the platform does not support the ip receive path acl feature, an inbound ACL on each interface must be configured.\n\nStep 2: Verify that the ACL referenced by the ip receive acl statement restricts all control plane and management plane traffic. The ACL configuration should look similar to the following: \n\naccess-list 199 deny ip any any fragments\naccess-list 199 remark allow specific management plane traffic\naccess-list 199 permit tcp [management subnet] 0.0.0.255 any eq 22\naccess-list 199 permit udp host [SNMP manager] any eq snmp\naccess-list 199 permit tcp host [TACACS server] eq tacacs any\naccess-list 199 permit udp host [NTP server] eq ntp any\naccess-list 199 permit icmp [management subnet] 0.0.0.255 any \naccess-list 199 remark allow specific control plane traffic\naccess-list 199 permit ospf host [OSPF neighbor A] any\naccess-list 199 permit ospf host [OSPF neighbor B] any\naccess-list 199 permit pim host [PIM neighbor A] any\naccess-list 199 permit pim host [PIM neighbor B] any\naccess-list 199 permit pim host [RP addr] any\naccess-list 199 permit igmp any 224.0.0.0 15.255.255.255\naccess-list 199 permit tcp host [BGP neighbor] eq bgp host [local BGP addr]\naccess-list 199 permit tcp host [BGP neighbor] host [local BGP addr] eq bgp\naccess-list 199 remark all other traffic destined to the device is dropped\naccess-list 199 deny ip any any\n\n\nNote: If the Management Plane Protection (MPP) feature is enabled for an OOBM interface, there would be no purpose in filtering this traffic on the receive path. With MPP enabled, no interfaces except the management interface will accept network management traffic destined to the device. This feature also provides the capability to restrict which management protocols are allowed. See NET0992 for additional configuration information.\n",
"description": "The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Hence, any disruption to the RP or the control and management planes can result in mission critical network outages. \n\nIn addition to control plane and management plane traffic that is in the router\u2019s receive path, the RP must also handle other traffic that must be punted to the RP\u2014that is, the traffic must be fast or process switched. This is the result of packets that must be fragmented, require an ICMP response (TTL expiration, unreachable, etc.) have IP options, etc. A DoS attack targeting the RP can be perpetrated either inadvertently or maliciously involving high rates of punted traffic resulting in excessive RP CPU and memory utilization. To maintain network stability, the router must be able to securely handle specific control plane and management plane traffic that is destined to it, as well as other punted traffic. \n\nUsing the ingress filter on forwarding interfaces is a method that has been used in the past to filter both forwarding path and receiving path traffic. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grow. Control plane policing can be used to increase security of routers and multilayer switches by protecting the RP from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch.\n\n",
"fixid": "F-19812r1_fix",
"fixtext": "Implement control plane protection by classifying traffic types based on importance levels and configure filters to restrict and rate limit the traffic punted to the route processor as according to each class.",
"iacontrols": null,
"id": "V-19188",
"ruleID": "SV-21167r2_rule",
"severity": "medium",
"title": "The router must have control plane protection enabled. ",
"version": "NET0966"
},
"V-19189": {
"checkid": "C-23287r1_chk",
"checktext": "An administratively scoped IP multicast region is defined to be a topological region in which there are one or more boundary routers with common boundary definitions. Such a router is said to be a boundary for multicast scoped addresses in the range defined in its configuration. In order to support administratively scoped multicast, a multicast boundary router will drop multicast traffic matching an interface's boundary definition in either direction. \n\nThe IPv4 administrative scoped multicast address space is 239/8 which is divided into two scope levels: the Local Scope and Organization Local Scope. The Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The IPv4 Organization Local Scope is 239.192.0.0/14 is the space from which an organization should allocate sub-ranges when defining scopes for private use. This scope can be expanded to 239.128.0.0/10, 239.64.0.0/10, and 239.0.0.0/10 if necessary. The scope of IPv6 multicast packets are determined by the scope value where 4 (ffx4::/16) is Admin-local, 5 (ffx5::/16) is Site-local, and 8 (ffx8::/16) is Organization-local. \n\nReview the multicast topology to determine any documented Admin-local (scope = 4) or Site-local (scope = 5) multicast boundaries for IPv6 traffic or any Local-scope (address block 239.255.0.0/16) boundary for IPv4 traffic. Verify that appropriate boundaries are configured on the applicable multicast-enabled interfaces.\n\nIPv4:\nThe following example will establish a multicast boundary on the interface to ensure that Local-scope traffic is not allowed into or out of the administratively scoped IPv4 multicast region:\n\nip multicast-routing \n!\ninterface FastEthernet0/1\ndescription Boundary for multicast region A \n ip address 198.18.0.1 255.255.255.0\nip pim sparse-mode\nip multicast boundary MCAST_ADMIN_SCOPED_BOUNDARY\n!\nip access-list standard MCAST_ADMIN_SCOPED_BOUNDARY\ndeny 239.255.0.0 0.255.255.255\npermit 224.0.0.0 15.255.255.255\n!\n\nNote: The filter used by multicast boundary command will effect multicast traffic outside of the administratively scoped IPv4 multicast space. If Organization Local Scope traffic must cross this site boundary, include the necessary permit statement from this address range (239.192.0.0 255.252.0.0). To allow global multicast traffic to pass by this boundary, ensure that the filter will permit the global address space (224.0.1.0-238.255.255.255) if the enclave has deployed inter-domain multicast routing. \n\n\nIPv6:\nThe following example will establish a multicast boundary on the interface to ensure that Site-local scope traffic is not allowed into or out of the administratively scoped IPv6 multicast region:\n\nipv6 multicast-routing\n!\ninterface FastEthernet0/1\ndescription link to Site A \n ipv6 address 2001:1:0:146::/64 eui-64\n ipv6 multicast boundary scope 5\n\nNote: Filtering the scope value of 5 will ensure that any multicast traffic received by the interface in either direction with a scope equal to or less than 5 (Site-local) will be dropped. Hence, all Site-local and Admin-local traffic will be dropped while allowing Organization-local (scope = 8) and global multicast traffic (scope =14) to be forwarded for an inter-site as well as inter-domain multicast routing deployment.\n",
"description": "A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be \"convex from a routing perspective\"-that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, \"One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces.\"\n\nAdministrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Hence, administrative scoped multicast traffic must not cross the perimeter of the enclave in either direction. Admin-local scope could be used to contain multicast traffic to a portion of an enclave or within a site. This can make it more difficult for a malicious user to access sensitive traffic if the traffic is restricted to links that the user does not have access to. Admin-local scope is encouraged for any multicast traffic within a network that is intended for network management as well as control plane traffic that must reach beyond link-local destinations.",
"fixid": "F-19813r1_fix",
"fixtext": "Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The scope of IPv6 multicast packets are determined by the scope value where 4 is Admin-local and 5 is Site-local. Configure the necessary boundary to ensure packets addressed to these administratively scoped multicast addresses do not cross the applicable administrative boundaries.",
"iacontrols": null,
"id": "V-19189",
"ruleID": "SV-21169r1_rule",
"severity": "low",
"title": "The administrator must ensure that multicast routers are configured to establish\nboundaries for Admin-local or Site-local scope multicast traffic.",
"version": "NET-MCAST-010"
},
"V-23747": {
"checkid": "C-12791r2_chk",
"checktext": "Review the router or switch configuration and verify that two NTP servers have been defined to synchronize time similar to the following example:\n\nntp update-calendar\nntp server 129.237.32.6 \nntp server 129.237.32.7\n\nSome platforms have a battery-powered hardware clock, referred to in the command-line interface (CLI) as the \"calendar,\" in addition to the software based system clock. The hardware clock runs continuously, even if the router is powered off or rebooted. If the software clock is synchronized to an outside time source via NTP, it is a good practice to periodically update the hardware clock with the time learned from NTP. Otherwise, the hardware clock will tend to gradually lose or gain time (drift) and the software clock and hardware clock may become out of synchronization with each other. The ntp update-calendar command will enable the hardware clock to be periodically updated with the time specified by the NTP source. The hardware clock will be updated only if NTP has synchronized to an authoritative time server. To force a single update of the hardware clock from the software clock, use the clock update-calendar command in user EXEC mode. \n\nNote: Lower end router models (i.e., 2500 series) and access switches (i.e. 2950, 2970, etc) do not have hardware clocks, so this command is not available on those platforms.\nAny NTP-enabled device that receives and accepts time from a stratum-n server can become a stratum-n+1 server. However, an NTP-enabled device will not accept time updates from an NTP server at a higher stratum; thereby enforcing a tree-level hierarchy of client-server relationships and preventing time synchronization loops. To increase availability, NTP peering can be used between NTP servers. Hence the following example configuration could be used to provide the necessary redundancy:\n\nntp update-calendar\nntp server 129.237.32.6 \nntp peer 129.237.32.7\n\nAlternative to querying an NTP server for time is to receive NTP updates via server that is broadcasting or multicasting the time update messages. The following interface command would be configured to receive an NTP broadcast message:\n\nntp broadcast client \n\nThe above command must be configured on two interfaces or there must be two NTP servers on the same LAN segment broadcasting NTP messages. \n\nThe following interface command would be configured to receive an NTP multicast message:\n\nntp multicast client 239.x.x.x \n\nFor multicast, two different administratively scoped multicast groups can be used\u2014one for each NTP server. In addition, the router or MLS must also have ip pim dense-mode configured on the interface as well as global ip multicast-routing.\n",
"description": "Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If you cannot successfully compare logs between each of your routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.",
"fixid": "F-3044r2_fix",
"fixtext": "Configure the device to use two separate NTP servers.",
"iacontrols": null,
"id": "V-23747",
"ruleID": "SV-41497r1_rule",
"severity": "low",
"title": "The network element must use two or more NTP servers to synchronize time.",
"version": "NET0812"
},
"V-28784": {
"checkid": "C-37332r2_chk",
"checktext": "Review the device configuration to determine if the call home service or feature is disabled on the device. On a Cisco product, you will not see the call-home service in the running config unless it's enabled. If the call home service is enabled on the device, this is a finding.\n\nNote: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.\n",
"description": "Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.",
"fixid": "F-32568r2_fix",
"fixtext": "Configure the network device to disable the call home service or feature. \n\nThe command below will disable the call-home service on a Cisco device. \nExample:\nhostname(config)# no service call-home\n\nNote: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.\n",
"iacontrols": null,
"id": "V-28784",
"ruleID": "SV-38003r3_rule",
"severity": "medium",
"title": "A service or feature that calls home to the vendor must be disabled. \n",
"version": "NET0405"
},
"V-3000": {
"checkid": "C-12940r3_chk",
"checktext": "Review the network device interface ACLs to verify all deny statements are logged.\n\nCisco IOS example:\ninterface FastEthernet 0/0 \ndescription external interface peering with ISP or non-DoD network\nip address 199.36.92.1 255.255.255.252\nip access-group 100 in\n\u2026\naccess-list 100 deny icmp any any fragments log\naccess-list 100 deny ip 169.254.0.0 0.0.255.255 any log\naccess-list 100 deny ip 10.0.0.0 0.255.255.255 any log\naccess-list 100 deny ip 172.16.0.0 0.15.255.255 any log\naccess-list 100 deny ip 192.168.0.0 0.0.255.255 any log\naccess-list 100 permit icmp any host 199.36.92.1 echo-reply\naccess-list 100 permit icmp any host 199.36.90.10 echo-reply\naccess-list 100 deny icmp any any log\naccess-list 100 deny ip any any log",
"description": "Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack, or identify a configuration mistake on the device.",
"fixid": "F-3025r4_fix",
"fixtext": "Configure interface ACLs to log all deny statements.",
"iacontrols": [
"ECAT-1",
"ECAT-2",
"ECSC-1"
],
"id": "V-3000",
"ruleID": "SV-15474r3_rule",
"severity": "low",
"title": "The network device must log all access control lists (ACL) deny statements.",
"version": "NET1020"
},
"V-3008": {
"checkid": "C-3837r1_chk",
"checktext": "Have the SA display the configuration settings that enable this feature.\n\nReview the network topology diagram, and review VPN concentrators. Determine if tunnel mode is being used by reviewing the configuration. Examples:\n\nIn CISCO \nRouter(config)# crypto ipsec transform-set transform-set-name transform1 \nRouter(cfg-crypto-tran)# mode tunnel \n\nOR in Junos \nedit security ipsec security-association sa-name] mode tunnel",
"description": "Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the premise of the managed networks and at the NOC. Dedicated links can be deployed using provisioned circuits (ATM, Frame Relay, SONET, T-carrier, and others or VPN technologies such as subscribing to MPLS Layer 2 and Layer 3 VPN services) or implementing a secured path with gateway-to-gateway IPsec tunnel. The tunnel mode ensures that the management traffic will be logically separated from any other traffic traversing the same path.",
"fixid": "F-3033r1_fix",
"fixtext": "Establish the VPN as a tunneled VPN.\n\nTerminate the tunneled VPN outside of the firewall.\n\nEnsure all host-to-host VPN are established between trusted known hosts.\n\n",
"iacontrols": null,
"id": "V-3008",
"ruleID": "SV-3008r1_rule",
"severity": "medium",
"title": "The IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network.",
"version": "NET1800"
},
"V-3012": {
"checkid": "C-3456r6_chk",
"checktext": "Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required.\n\nIf passwords aren't used to administrative access to the device, this is a finding.",
"description": "Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.",
"fixid": "F-3037r6_fix",
"fixtext": "Configure the network devices so it will require a password to gain administrative access to the device.",
"iacontrols": null,
"id": "V-3012",
"ruleID": "SV-3012r4_rule",
"severity": "high",
"title": "Network devices must be password protected.",
"version": "NET0230"
},
"V-3013": {
"checkid": "C-3474r11_chk",
"checktext": "Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim:\n\nOption A\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\n\nOption B\n\nIf the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: \"I've read & consent to terms in IS user agreem't.\"\n\nIf the device configuration does not have a logon banner as stated above, this is a finding.",
"description": "All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed.\n\nDoD CIO has issued new, mandatory policy standardizing the wording of \"notice and consent\" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, \"Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement\", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.",
"fixid": "F-3038r9_fix",
"fixtext": "Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows:\n\nOption A\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\n\nOption B\n\nIf the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: \"I've read & consent to terms in IS user agreem't.\"",
"iacontrols": null,
"id": "V-3013",
"ruleID": "SV-3013r5_rule",
"severity": "medium",
"title": "Network devices must display the DoD-approved logon banner warning.",
"version": "NET0340"
},
"V-3014": {
"checkid": "C-12918r4_chk",
"checktext": "Review the management connection for administrative access and verify the network element is configured to time-out the connection after 10 minutes or less of inactivity. The default for the VTY line is 10 minutes and may not appear in the display of the configuration. The VTY line should contain the following command:\n\nexec-timeout 10\n",
"description": "Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
"fixid": "F-3039r5_fix",
"fixtext": "Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.",
"iacontrols": null,
"id": "V-3014",
"ruleID": "SV-15453r2_rule",
"severity": "medium",
"title": "The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.",
"version": "NET1639"
},
"V-3020": {
"checkid": "C-12796r2_chk",
"checktext": "Review the device configuration to ensure that DNS servers have been defined if it has been configured as a client resolver (name lookup). The configuration should look similar to one of the following examples: \nip domain-lookup\nip name-server 192.168.1.253\n\nor\n\nno ip domain-lookup\t\t\n\nThe first configuration example has DNS lookup enabled and hence has defined its DNS server. The second example has DNS lookup disabled.\n\nNote: ip domain-lookup is enabled by default. Hence it may not be shown\u2014depending on the IOS release. If it is enabled, it will be shown near the beginning of the configuration.\n",
"description": "The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of the destination host name. If the response to this query is the IP address of a host operated by an attacker, the source host will establish a connection with the attackers host, rather than the intended target. The user on the source host might then provide logon, authentication, and other sensitive data.",
"fixid": "F-3045r2_fix",
"fixtext": "Configure the device to include DNS servers or disable domain lookup.",
"iacontrols": null,
"id": "V-3020",
"ruleID": "SV-15330r2_rule",
"severity": "low",
"title": "The network element must have DNS servers defined if it is configured as a client resolver.",
"version": "NET0820"
},
"V-3021": {
"checkid": "C-12798r3_chk",
"checktext": "Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network. The following examples for SNMP v1, 2, and 3 depict the use of an ACL to restrict SNMP access to the device.\n\nSNMP v1/v2c Configuration Example\n\nThe example ACL NMS_LIST is used to define what network management stations can access the device for write and read only (poll).\n\nip access-list standard NMS_LIST\n permit 10.1.1.24\n permit 10.1.1.22\n permit 10.1.1.23\n! \nsnmp-server community ourCommStr RO RW NMS_LIST\nsnmp-server community write_pw RW NMS_LIST\nsnmp-server enable traps snmp linkdown linkup\nsnmp-server host 10.1.1.1 trap_comm_string \n\nNote: If you enter the snmp-server host command with no keywords, the default is version 1 and to send all enabled traps to the host. No informs will be sent to this host. If no traps or informs keyword is present, traps are sent.\n\nSNMP v3 Configuration Example\n\nThe example ACL NMS_LIST and ADMIN_LIST are used to define what network management stations and administrator (users) desktops can access the device.\n\nip access-list standard ADMIN_LIST\n permit 10.1.1.35\n permit 10.1.1.36\nip access-list standard NMS_LIST\n permit 10.1.1.24\n permit 10.1.1.22\n permit 10.1.1.23\n!\nsnmp-server group NOC v3 priv read VIEW_ALL write VIEW_LIMIT access NMS_LIST\nsnmp-server group TRAP_GROUP v3 priv notify\n*tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F \nsnmp-server group ADMIN_GROUP v3 priv read VIEW_ALL write VIEW_ALL access ADMIN_LIST\nsnmp-server view VIEW_ALL internet included\nsnmp-server view VIEW_LIMIT internet included\nsnmp-server view VIEW_LIMIT internet.6.3.15 excluded\nsnmp-server view VIEW_LIMIT internet.6.3.16 excluded\nsnmp-server view VIEW_LIMIT internet.6.3.18 excluded\nsnmp-server enable traps snmp linkdown linkup\nsnmp-server host 10.1.1.24 version 3 priv TRAP_NMS1 \n\nNote: For the configured group TRAP_GROUP, the notify view is auto-generated by the snmp-server host command which bind the user (TRAP_NMS1) and the group it belongs to (TRAP_GROUP) to the list of notifications (traps or informs) which are sent to the host. Hence, the configuration snmp-server group TRAP_GROUP v3 results in the following:\nsnmp-server group TRAP_GROUP v3 priv notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F\n\n\nNote: Not required but for illustration purpose, the VIEW_LIMIT excludes MIB objects which could potentially reveal information about configured SNMP credentials. These objects are snmpUsmMIB, snmpVacmMIB, and snmpCommunityMIB which is configured as 1.3.6.1.6.3.15, 1.3.6.1.6.3.16, and 1.3.6.1.6.3.18 respectively\n\n\nNote that SNMPv3 users are not shown in a running configuration. You can view them with the show snmp user command. So for example, if the following users were configured as such.\n\nsnmp-server user HP_OV NOC v3 auth sha HPOVpswd priv aes 256 HPOVsecretkey\nsnmp-server user Admin1 ADMIN_GROUP v3 auth sha Admin1PW priv aes 256 Admin1key\nsnmp-server user Admin2 ADMIN_GROUP v3 auth md5 Admin2pass priv 3des Admin2key\nsnmp-server user TRAP_NMS1 TRAP_GROUP v3 auth sha trap_nms1_pw priv aes trap_nms1_key\n\nThe show snmp user command would depict the configured users as follows:\n\nR1#show snmp user\n\nUser name: HP_OV\nEngine ID: AB12CD34EF56\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: NOC\n\nUser name: Admin1\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: ADMIN_GROUP\n\nUser name: Admin2\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: MD5\nPrivacy Protocol: 3DES\nGroup-name: ADMIN_GROUP\n\nUser name: TRAP_NMS1\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: TRAP_GROUP\n\nR1#\n",
"description": "Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.",
"fixid": "F-3046r4_fix",
"fixtext": "Configure the network devices to only allow SNMP access from only addresses belonging to the management network.",
"iacontrols": null,
"id": "V-3021",
"ruleID": "SV-15332r2_rule",
"severity": "medium",
"title": "The network element must only allow SNMP access from addresses belonging to the management network.",
"version": "NET0890"
},
"V-3034": {
"checkid": "C-3489r4_chk",
"checktext": "Review the device configuration to determine if authentication is configured for all IGP peers.\n\nIf authentication is not configured for all IGP peers, this is a finding.",
"description": "A rogue router could send a fictitious routing update to convince a site\u2019s premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information of the site\u2019s network, or merely used to disrupt the network\u2019s ability to effectively communicate with other networks.",
"fixid": "F-3059r3_fix",
"fixtext": "Configure authentication for all IGP peers.",
"iacontrols": null,
"id": "V-3034",
"ruleID": "SV-15290r2_rule",
"severity": "medium",
"title": "The network element must authenticate all IGP peers.",
"version": "NET0400"
},
"V-3043": {
"checkid": "C-3825r7_chk",
"checktext": "Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access.\n\nIf unique community strings or accounts are not used for SNMP peers, this is a finding.",
"description": "Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.",
"fixid": "F-3068r4_fix",
"fixtext": "Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.",
"iacontrols": null,
"id": "V-3043",
"ruleID": "SV-3043r4_rule",
"severity": "medium",
"title": "The network device must use different SNMP community names or groups for various levels of read and write access.",
"version": "NET1675"
},
"V-3056": {
"checkid": "C-3503r11_chk",
"checktext": "Review the network device configuration and validate there are no group accounts configured for access.\n\nIf a group account is configured on the device, this is a finding.",
"description": "Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.",
"fixid": "F-3081r9_fix",
"fixtext": "Configure individual user accounts for each authorized person then remove any group accounts.",
"iacontrols": null,
"id": "V-3056",
"ruleID": "SV-3056r7_rule",
"severity": "high",
"title": "Group accounts must not be configured for use on the network device.",
"version": "NET0460"
},
"V-3057": {
"checkid": "C-12937r5_chk",
"checktext": "Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the least privilege level unless deemed necessary for assigned duties.\n\nIf it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.\n\nBelow is an example of assigning a privilege level to a local user account and changing the default privilege level of the configure terminal command.\n\nusername junior-engineer1 privilege 7 password xxxxxx\nprivilege exec level 7 configure terminal\n\nThe above example only covers local accounts. You will also need to check the accounts and their associated privilege levels configured in the authentication server. You can also use TACACS+ for even more granularity at the command level as shown in the following example:\n\nuser = junior-engineer1 {\n password = clear \"xxxxx\"\n service = shell {\n set priv-lvl = 7\n }\n}",
"description": "By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personell are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.",
"fixid": "F-3082r5_fix",
"fixtext": "Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.",
"iacontrols": null,
"id": "V-3057",
"ruleID": "SV-15471r4_rule",
"severity": "medium",
"title": "Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.",
"version": "NET0465"
},
"V-30577": {
"checkid": "C-39164r1_chk",
"checktext": "If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network\u2019s multicast topology diagram. Review the router or multi-layer switch configuration to determine if multicast routing is enabled and what interfaces are enabled for PIM.\n\nStep 1: Determine if multicast routing is enabled. By default, multicast is disabled globally. The following global configuration commands will enable IPv4 and IPv6 multicast routing:\n\nip multicast-routing\n\nipv6 multicast-routing\n\nStep 2: PIM is enabled on an interface with either of the following commands: ip pim sparse-mode, ip pim dense-mode, ip pim sparse-dense-mode. Review all interface configurations and verify that only the required interfaces are enabled for PIM as documented in the network topology diagram. \n\nWith IPv4, PIM is disabled by default on all interfaces. Following is an example of an interface with PIM enabled.\n\ninterface FastEthernet0/0\n ip address 192.168.1.1 255.255.255.0\n ip pim sparse-mode\n\nYou can also verify what IPv4 interfaces are enabled for PIM with the show ip pim interface command.\n\nWith IPv6, PIM is enabled by default on all IPv6-enabled interfaces if IPv6 multicast routing is enabled on the router via the global ipv6 multicast-routing command. An interface can be disabled for PIM using the no ipv6 pim interface command.\n\ninterface FastEthernet0/1\n ipv6 address 2001:1:0:146::/64 eui-64\n no ipv6 pim\n\nYou can also verify what ipv6 interfaces are enabled for PIM with the show ipv6 pim interface command.\n",
"description": "A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be \u201cconvex from a routing perspective\u201d\u2014that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, \u201cOne should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces.\u201d Hence, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once, this is done, the zones can be scoped as required.",
"fixid": "F-34295r1_fix",
"fixtext": "If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network\u2019s multicast topology diagram. Enable PIM only on the applicable interfaces according to the multicast topology diagram.",
"iacontrols": null,
"id": "V-30577",
"ruleID": "SV-40312r1_rule",
"severity": "medium",
"title": "The administrator must ensure that Protocol Independent Multicast (PIM) is disabled on all interfaces that are not required to support multicast routing.",
"version": "NET-MCAST-001"
},
"V-30578": {
"checkid": "C-39168r1_chk",
"checktext": "Review the router or multi-layer switch to determine if either IPv4 or IPv6 multicast routing is enabled. If either is enabled, verify that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.\n\nIPv4\n\nStep 1: Verify that an ACL is configured that will specify the allowable PIM neighbors similar to the\nfollowing example:\n\nip access-list standard PIM_NEIGHBORS\n permit 192.0.2.1\n permit 192.0.2.3\n deny any log\n\n\nStep 2: Verify that a pim neighbor-filter command is configured on all PIM-enabled interfaces that is\nreferencing the PIM neighbor ACL similar to the following example:\n\ninterface FastEthernet0/3\n ip address 192.0.2.2 255.255.255.0\n ip pim sparse-mode\n ip pim neighbor-filter PIM_NEIGHBORS\n\n\nIPv6\n\nStep 1: Verify that an ACL is configured that will specify the allowable PIM neighbors similar to the\nfollowing example:\n\nipv6 access-list PIM_NEIGHBORS\n permit host FE80::1 any\n permit host FE80::3 any\ndeny any any log\n\nNote: IPv6 PIM adjacenencies are created using the router unicast link-local addresses \n\nStep 2: Verify that a pim neighbor-filter global command is configured\n\nipv6 pim neighbor-filter list PIM_NEIGHBORS\n",
"description": "Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution tress for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled.",
"fixid": "F-34301r1_fix",
"fixtext": "If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.",
"iacontrols": null,
"id": "V-30578",
"ruleID": "SV-40315r1_rule",
"severity": "medium",
"title": "The administrator must ensure that a PIM neighbor filter is bound to all interfaces that have PIM enabled.",
"version": "NET-MCAST-002"
},
"V-3058": {
"checkid": "C-3505r5_chk",
"checktext": "Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device.\n\nIf an unauthorized account is configured for access to the device, this is a finding.",
"description": "A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.",
"fixid": "F-3083r5_fix",
"fixtext": "Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.",
"iacontrols": null,
"id": "V-3058",
"ruleID": "SV-3058r5_rule",
"severity": "medium",
"title": "Unauthorized accounts must not be configured for access to the network device.",
"version": "NET0470"
},
"V-30617": {
"checkid": "C-39253r1_chk",
"checktext": "The maximum number of hops used in router advertisements and all IPv6 packets that are originated by the router can be set using the ipv6 hop-limit command in global configuration mode. Review the router or multi-layer switch configuration to determine if the maximum hop limit has been configured. If it has been configured, then it must be set to at least 32. \n\nThe following global command sets the max hop limit to 128: ipv6 hop-limit 128 \n\nNote: The IOS default is 64. Hence, if the hop limit is not configured, the router will be in compliance with the requirement.\n",
"description": "The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to hop limit reaching zero before the packets sent by a host reached its destination.",
"fixid": "F-34363r2_fix",
"fixtext": "Configure maximum hop limit to at least 32.",
"iacontrols": null,
"id": "V-30617",
"ruleID": "SV-40389r1_rule",
"severity": "low",
"title": "The administrator must ensure that the maximum hop limit is at least 32.",
"version": "NET-IPV6-059"
},
"V-3062": {
"checkid": "C-39960r6_chk",
"checktext": "Review all Cisco IOS routers and switches to determine if the global command \"service password-encryption\" is present in the configurations.\n\nAlso, review all accounts created on the device to ensure they have been setup using the \"username name secret password\" command. The following command will be found in the device configurations\n\nDevice# show run\n!\nservice password-encryption\n!\nusername name secret 5 $1$geU5$vc/uDRS5dWiOrpQJTimBw/\nenable secret 5 $1%mer9396y30d$FDA/292/",
"description": "Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration. \n",
"fixid": "F-40534r1_fix",
"fixtext": "Configure the network element to ensure passwords are not viewable when displaying configuration information.\n\nDevice(config)# service password\nDevice(config)# username name secret S3cr3T!\nDevice(config)# enable secret $MyS3cr3TPW$\nDevice(config)# end",
"iacontrols": [
"ECSC-1"
],
"id": "V-3062",
"ruleID": "SV-41449r2_rule",
"severity": "high",
"title": "The network element must be configured to ensure passwords are not viewable when displaying configuration information. ",
"version": "NET0600"
},
"V-30660": {
"checkid": "C-39284r1_chk",
"checktext": "If the router is functioning as a 6to4 router, verify that there is an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets.\n\nStep 1: Determine if the router is functioning as a 6to4 router. You should find a tunnel configuration similar to the following example:\n\ninterface Tunnel0\n no ip address\n no ip redirects\n ipv6 address 2000:C0A8:6301::1/64\n tunnel source FastEthernet0/1\n tunnel mode ipv6ip 6to4\n!\n\u2026\nipv6 route 2002::/16 Tunnel0\n\nStep 2: Verify that there is an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets. You should find a configuration similar to the following example:\n\ninterface FastEthernet0/1\n description internal link\n ip address 192.168.1.1 255.255.255.0\n ipv6 address 6TO4PREFIX ::1:0:0:0:1/64\n ip access-group IPV4_EGRESS_FILTER in\n!\nip access-list extended IPV4_EGRESS_FILTER\nremark only this 6to4 router can tunnel IPv6 traffic\ndeny 41 any any log\n\u2026\n\u2026\n\nNote: normally you would want to configure the internal interface for a 6to4 router as dual stack. However IPv6 only is possible and if configured as such, having an IPv4 ACL is irrelevant since the interface will not accept any IPv4 packets.\n\n",
"description": "The 6to4 specific filters accomplish the role of endpoint verification and provide assurance that the tunnels are being used properly. This primary guidance assumes that only the designated 6to4 router is allowed to form tunnel packets. If they are being formed inside an enclave and passed to the 6to4 router, they are suspicious and must be dropped. In accordance with DoD IPv6 IA Guidance for MO3 (S5-C7-8), packets as such must be dropped and logged as a security event.",
"fixid": "F-34388r1_fix",
"fixtext": "If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets.",
"iacontrols": null,
"id": "V-30660",
"ruleID": "SV-40454r1_rule",
"severity": "medium",
"title": "The administrator must ensure the 6-to-4 router is configured to drop any IPv4 packets with protocol 41 received from the internal network. ",
"version": "NET-IPV6-065"
},
"V-3069": {
"checkid": "C-12916r6_chk",
"checktext": "Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols.\n\n-SSHv2\n-SCP\n-HTTPS\n-SSL\n-TLS\n\nThis is an example that enables SSHv2/SCP/HTTPS on an IOS Device:\n!\nip domain-name example.com\n!\ncrypto key generate rsa modulus 2048\n!\nip ssh time-out 60\nip ssh authentication-retries 3\nip ssh source-interface GigabitEthernet 0/1\nip ssh version 2\nip ssh server algorithm mac hmac-sha1 hmac-sha1-96\nip ssh server algorithm encryption aes128-cbc aes192-cbc aes256-cbc\n!\nline vty 0 15\ntransport input ssh\n!\nip scp server enable\n!\nip http secure-server\n\nIf management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.",
"description": "Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.\n",
"fixid": "F-3094r5_fix",
"fixtext": "Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.",
"iacontrols": null,
"id": "V-3069",
"ruleID": "SV-15451r4_rule",
"severity": "medium",
"title": "Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.",
"version": "NET1638"
},
"V-3070": {
"checkid": "C-12920r3_chk",
"checktext": "Review the router or switch configuration to ensure that all logon connection attempts are logged as shown in the following example:\n\nlogging on\nlogin on-failure log every 1\nlogin on-success log every 1\n\nIf all logon connection attempts are not logged, this is a finding.\n\n",
"description": "Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.",
"fixid": "F-3095r3_fix",
"fixtext": "Configure the device to log all access attempts to the device to establish a management connection for administrative access.",
"iacontrols": null,
"id": "V-3070",
"ruleID": "SV-15455r3_rule",
"severity": "low",
"title": "The network element must log all attempts to establish a management connection for administrative access.",
"version": "NET1640"
},
"V-3072": {
"checkid": "C-3636r6_chk",
"checktext": "Review the running and boot configurations to determine if they are synchronized.\n\nIOS Procedure: With online editing, the \"show running-config\" command will only show the current running configuration settings, which are different from the IOS defaults. The \"show startup-config\" command will show the NVRAM startup configuration. Compare the two configurations to ensure they are synchronized. \n\nJUNOS Procedure: This will never be a finding. The active configuration is stored on flash as juniper.conf. A candidate configuration allows configuration changes while in configuration mode without initiating operational changes. The router implements the candidate configuration when it is committed; thereby, making it the new active configuration--at which time it will be stored on flash as juniper.conf and the old juniper.conf will become juniper.conf.1.\n\nIf running configuration and boot configurations are not the same, this is a finding.",
"description": "If the running and startup router configurations are not synchronized properly and a router malfunctions, it will not restart with all of the recent changes incorporated. If the recent changes were security related, then the routers would be vulnerable to attack.",
"fixid": "F-3097r4_fix",
"fixtext": "Add procedures to the standard operating procedure to keep the running configuration synchronized with the startup configuration.",
"iacontrols": null,
"id": "V-3072",
"ruleID": "SV-3072r3_rule",
"severity": "low",
"title": "The running configuration must be synchronized with the startup configuration after changes have been made and implemented.",
"version": "NET1030"
},
"V-30736": {
"checkid": "C-39311r1_chk",
"checktext": "If the router is functioning as a 6to4 router, verify that an egress filter (inbound on the internal-facing interface) has been configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.\n\nThe examples below are using 2002:c612:1::/48 where c612:1 maps to 198.18.0.1 which is the imbedded V4ADDR. The subnet in this example is 2002:c612:1:1::/64. The IPV6 ACL will filter the source address of the IPv6 packets before they are forwarded to the 6to4 tunnel.\n\n\nipv6 general-prefix 6TO4_PREFIX 6to4 FastEthernet0/1\n!\ninterface Tunnel0\n ipv6 address 2000:c0a8:6301::1/64 \n tunnel source FastEthernet0/0\n tunnel mode ipv6ip 6to4\n!\ninterface FastEthernet0/0\n ip address 10.1.12.1 255.255.255.0\n ipv6 address 6TO4_PREFIX ::1:0:0:0:1/64\n ipv6 traffic-filter IPV6_EGRESS_FILTER in\n!\ninterface FastEthernet0/1\n description DISN CORE facing \n ip address 198.18.0.1 255.255.255.0\n!\n ipv6 route 2002::/16 Tunnel0\n!\nipv6 access-list IPV6_EGRESS_FILTER\npermit ipv6 2002:C612:1::/48 any\ndeny ipv6 any any log\n\nNote: normally you would want to configure the internal interface dual stack, allthough IPv6 only is possible.\n",
"description": "An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in pairs and thus do not require manual configuration because they treat the IPv4 infrastructure as a virtual non-broadcast link, using an IPv4 address embedded in the IPv6 address to find the remote end of the tunnel. In other words, the tunnel destination is determined by the IPv4 address of the external interface of the 6to4 router that is concatenated to the 2002::/16 prefix in the format 2002: V4ADDR::/48. Hence, the imbedded V4ADDR of the 6to4 prefix must belong to the same ipv4 prefix as configured on the external-facing interface of the 6to4 router. ",
"fixid": "F-34421r1_fix",
"fixtext": "If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.",
"iacontrols": null,
"id": "V-30736",
"ruleID": "SV-40539r1_rule",
"severity": "low",
"title": "The administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.",
"version": "NET-IPV6-066"
},
"V-30744": {
"checkid": "C-39321r1_chk",
"checktext": "Review the router or multi-layer switch configuration and determine if L2TPv3 has been configured to provide transport across an IP network. If it has been configured, verify that the L2TPv3 session requires authentication.\n\nStep 1: Determine if an L2TPv3 pseudowire is configured on an interface which will look similar to the following configuration:\n\npseudowire-class L2TPV3\nencapsulation l2tpv3\nip local interface Loopback0\n!\ninterface Loopback0\nip address 1.1.1.1 255.255.255.255\n!\ninterface FastEthernet0/0\nxconnect 5.5.5.5 1 encapsulation l2tpv3 pw-class L2TPV3\n\nIf you do not see a configuration similar to the one above, then this vulnerability is not applicable. Otherwise, proceed to step 2.\n\nStep2: Verify that the l2tp-class global command has been configured with authentication as shown in the following example.\n\nl2tp-class L2TP_CLASS\n authentication\n password 7 011E1F145A1815182E5E4A\n\nNote: If a password is not configured in the l2tp-class command the password associated with the remote peer router is taken from the value entered with the global username hostname password value.\n\nNote: Layer 2 Forwarding or L2F (RFC2341), which is the \"version 1\", and L2TPv2 (RFC 2661) are used for remote access services based on the Virtual Private Dial-up Network (VPDN) model\u2014not for tunneling IP packets across a backbone as with L2TPv3. With the VPDN model, a user obtains a layer-2 connection to a RAS using dialup PSTN or ISDN service and then establishes a PPP session over that connection. The L2 termination and PPP session endpoints reside on the RAS. L2TP extends the PPP model by allowing the L2 and PPP endpoints to reside on different devices that are interconnected by a backbone network. A remote access client has an L2 connection to an L2TP Access Concentrator (LAC) that tunnels PPP frames across the IP backbone to the L2TP Network Server (LNS) residing in the private network.\n\n",
"description": "L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.",
"fixid": "F-34428r1_fix",
"fixtext": "Configure L2TPv3 to use authentication for any peering sessions.",
"iacontrols": null,
"id": "V-30744",
"ruleID": "SV-40556r1_rule",
"severity": "medium",
"title": "The administrator must ensure the that all L2TPv3 sessions are authenticated prior to transporting traffic.",
"version": "NET-TUNL-034"
},
"V-3078": {
"checkid": "C-3551r5_chk",
"checktext": "Review all Cisco device configurations to verify service udp-small-servers and service tcp-small-servers are not found.\n\nIf TCP and UDP servers are not disabled, this is a finding.\n\nNote: The TCP and UDP small servers are enabled by default on Cisco IOS Software Version 11.2 and earlier. They are disabled by default on Cisco IOS Software Versions 11.3 and later.",
"description": "Cisco IOS provides the \"small services\" that include echo, chargen, and discard. These services, especially their User Datagram Protocol (UDP) versions, are infrequently used for legitimate purposes. However, they have been used to launch denial of service attacks that would otherwise be prevented by packet filtering. For example, an attacker might send a DNS packet, falsifying the source address to be a DNS server that would otherwise be unreachable, and falsifying the source port to be the DNS service port (port 53). If such a packet were sent to the Cisco's UDP echo port, the result would be Cisco sending a DNS packet to the server in question. No outgoing access list checks would be applied to this packet, since it would be considered locally generated by the router itself. The small services are disabled by default in Cisco IOS 12.0 and later software. In earlier software, they may be disabled using the commands no service tcp-small-servers and no service udp-small-servers.",
"fixid": "F-3103r4_fix",
"fixtext": "Change the device configuration to include the following IOS commands: no service tcp-small-servers and no service udp-small-servers for each device running an IOS version prior to 12.0. This is the default for IOS versions 12.0 and later (i.e., these commands will not appear in the running configuration.)",
"iacontrols": null,
"id": "V-3078",
"ruleID": "SV-3078r3_rule",
"severity": "low",
"title": "Network devices must have TCP and UDP small servers disabled.",
"version": "NET0720"
},
"V-3079": {
"checkid": "C-12701r2_chk",
"checktext": "Review the device configuration. Beginning with IOS 12.1(5), finger is disabled by default. For IOS version 12.0 through 12.1(4), verify that the no ip finger command is present. For any version prior to 12.0, verify that the no service finger command is present.",
"description": "The finger service supports the UNIX finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engineering practices to try to elicit classified DoD information.\n\n",
"fixid": "F-3104r4_fix",
"fixtext": "Configure the device to disable the Finger service.",
"iacontrols": null,
"id": "V-3079",
"ruleID": "SV-15305r2_rule",
"severity": "low",
"title": "The network element must have the Finger service disabled.",
"version": "NET0730"
},
"V-3080": {
"checkid": "C-3574r8_chk",
"checktext": "Review the device configuration to determine if the configuration auto-loading feature is disabled.\n\nIf the configuration auto-loading feature is enabled when the device is connected to an operational network, this is a finding.\n",
"description": "Devices can find their startup configuration either in their own NVRAM or access it over the network via TFTP or Remote Copy (rcp). Loading the image from the network is taking a security risk since the image could be intercepted by an attacker who could corrupt the image resulting in a denial of service. Configuration auto-loading can be enabled when the device is connected to a non-operational network. Once the device is connected to an operational (i.e. production) network, configuration auto-loading must be disabled.",
"fixid": "F-3105r6_fix",
"fixtext": "Disable the configuration auto-loading feature, when connected to an operational network.",
"iacontrols": null,
"id": "V-3080",
"ruleID": "SV-3080r4_rule",
"severity": "medium",
"title": "The Configuration auto-loading feature must be disabled when connected to an operational network.",
"version": "NET0760"
},
"V-3081": {
"checkid": "C-12782r2_chk",
"checktext": "Review the configuration to determine if source routing is enabled. The IOS command no ip source-route must be included in the configuration.",
"description": "Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.",
"fixid": "F-3106r2_fix",
"fixtext": "Configure the router to disable IP source routing.",
"iacontrols": null,
"id": "V-3081",
"ruleID": "SV-15316r2_rule",
"severity": "medium",
"title": "The router must have IP source routing disabled.",
"version": "NET0770"
},
"V-3083": {
"checkid": "C-3578r4_chk",
"checktext": "IP directed broadcast is disabled by default in IOS version 12.0 and higher so the command \"no ip directed-broadcast\" will not be displayed in the running configuration--verify that the running configuration does not contain the command \"ip directed-broadcast\". For versions prior to 12.0 ensure the command \"no ip directed-broadcast\" is displayed in the running configuration. \n\nIf IP directed broadcasts are enabled on layer 3 interfaces, this is a finding.",
"description": "An IP directed broadcast is a datagram sent to the broadcast address of a subnet that is not directly attached to the sending machine. The directed broadcast is routed through the network as a unicast packet until it arrives at the target subnet, where it is converted into a link-layer broadcast. Because of the nature of the IP addressing architecture, only the last router in the chain, which is connected directly to the target subnet, can conclusively identify a directed broadcast.\n\nIP directed broadcasts are used in the extremely common and popular smurf, or Denial of Service (DoS), attacks. In a smurf attack, the attacker sends ICMP echo requests from a falsified source address to a directed broadcast address, causing all the hosts on the target subnet to send replies to the falsified source. By sending a continuous stream of such requests, the attacker can create a much larger stream of replies, which can completely inundate the host whose address is being falsified. This service should be disabled on all interfaces when not needed to prevent smurf and DoS attacks. Directed broadcast can be enabled on internal facing interfaces to support services such as Wake-On-LAN. Case scenario may also include support for legacy applications where the content server and the clients do not support multicast. The content servers send streaming data using UDP broadcast. Used in conjunction with the ip multicast helper-map feature, broadcast data can be sent across a multicast topology. The broadcast streams are converted to multicast and vice versa at the first-hop routers and last-hop routers before entering leaving the multicast transit area respectively. The last-hop router must convert the multicast to broadcast. Hence, this interface must be configured to forward a broadcast packet (i.e. a directed broadcast address is converted to the all nodes broadcast address).",
"fixid": "F-3108r4_fix",
"fixtext": "Disable IP directed broadcasts on all layer 3 interfaces.",
"iacontrols": [
"ECSC-1"
],
"id": "V-3083",
"ruleID": "SV-3083r3_rule",
"severity": "low",
"title": "IP directed broadcast must be disabled on all layer 3 interfaces.",
"version": "NET0790"
},
"V-3085": {
"checkid": "C-39966r3_chk",
"checktext": "Verify the command \"ip http-server\" is not enabled in the configuration (the HTTPS server may be enabled for administrative access). As of 12.4, the http server is disabled by default. However, since many defaults are not shown by IOS, you may not see the command \"no ip http-server\" in the configuration depending on the release.\n\nIf the HTTP server is enabled, this is a finding.",
"description": "The additional services the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software versions support remote configuration and monitoring using the World Wide Web's HTTP protocol. In general, HTTP access is equivalent to interactive access to the router. The authentication protocol used for HTTP is equivalent to sending a clear-text password across the network, and, unfortunately, there is no effective provision in HTTP for challenge-based or one-time passwords. This makes HTTP a relatively risky choice for use across the public Internet. Any additional services that are enabled increase the risk for an attack since the router will listen for these services. The HTTPS server may be enabled for administrative access.",
"fixid": "F-3110r4_fix",
"fixtext": "Configure the device to disable using HTTP (port 80) for administrative access.",
"iacontrols": null,
"id": "V-3085",
"ruleID": "SV-41467r2_rule",
"severity": "medium",
"title": "The network element must have HTTP service for administrative access disabled.",
"version": "NET0740"
},
"V-3086": {
"checkid": "C-3573r7_chk",
"checktext": "Review the device configuration to determine if BOOTP services are enabled. \n\nIf BOOTP is enabled, this is a finding.",
"description": "BOOTP is a user datagram protocol (UDP) that can be used by Cisco routers to access copies of Cisco IOS Software on another Cisco router running the BOOTP service. In this scenario, one Cisco router acts as a Cisco IOS Software server that can download the software to other Cisco routers acting as BOOTP clients. In reality, this service is rarely used and can allow an attacker to download a copy of a router's Cisco IOS Software.",
"fixid": "F-3111r6_fix",
"fixtext": "Configure the device to disable all BOOTP services.",
"iacontrols": null,
"id": "V-3086",
"ruleID": "SV-3086r3_rule",
"severity": "low",
"title": "BOOTP services must be disabled.",
"version": "NET0750"
},
"V-31285": {
"checkid": "C-40049r1_chk",
"checktext": "Review the router configuration to determine if authentication is being used for all peers. A password should be defined for each BGP neighbor regardless of the autonomous system the peer belongs as shown in the following example:\n\nouter bgp 100\nneighbor external-peers peer-group\nneighbor 171.69.232.90 remote-as 200\nneighbor 171.69.232.90 peer-group external-peers\nneighbor 171.69.232.100 remote-as 300\nneighbor 171.69.232.100 peer-group external-peers\nneighbor 171.69.232.90 password xxxxxxxxxx\nneighbor 171.69.232.100 password xxxxxxxxxx",
"description": "As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately, without waiting for out of sequence packets to arrive. RFC 793 also requires that sequence numbers are checked against the window size before accepting data or control flags as valid. A router receiving an RST segment will close the TCP session with the BGP peer that is being spoofed; thereby, purging all routes learned from that BGP neighbor. A RST segment is valid as long as the sequence number is within the window. The TCP reset attack is made possible due to the requirements that Reset flags should be processed immediately and that a TCP endpoint must accept out of order packets that are within the range of a window size. This reduces the number of sequence number guesses the attack must make by a factor equivalent to the active window size. Each sequence number guess made by the attacker can be simply incremented by the receiving connections window size. The BGP peering session can protect itself against such an attack by authenticating each TCP segment. The TCP header options include an MD5 signature in every packet and are checked prior to the acceptance and processing of any TCP packet\u2014including RST flags.\n\nOne way to create havoc in a network is to advertise bogus routes to a network. A rogue router could send a fictitious routing update to convince a BGP router to send traffic to an incorrect or rogue destination. This diverted traffic could be analyzed to learn confidential information of the site\u2019s network, or merely used to disrupt the network\u2019s ability to effectively communicate with other networks. An autonomous system can advertise incorrect information by sending BGP updates messages to routers in a neighboring AS. A malicious AS can advertise a prefix originated from another AS and claim that it is the originator (prefix hijacking). Neighboring autonomous systems receiving this announcement will believe that the malicious AS is the prefix owner and route packets to it.",
"fixid": "F-14123r2_fix",
"fixtext": "Configure the device to authenticate all BGP peers.",
"iacontrols": [
"ECSC-1"
],
"id": "V-31285",
"ruleID": "SV-41555r2_rule",
"severity": "medium",
"title": "The network element must authenticate all BGP peers within the same or between autonomous systems (AS).",
"version": "NET0408"
},
"V-3143": {
"checkid": "C-40236r3_chk",
"checktext": "Review the network devices configuration to determine if the vendor default password is active.\n\nIf any vendor default passwords are used on the device, this is a finding.",
"description": "Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.",
"fixid": "F-35391r3_fix",
"fixtext": "Remove any vendor default passwords from the network devices configuration.",
"iacontrols": null,
"id": "V-3143",
"ruleID": "SV-3143r4_rule",
"severity": "high",
"title": "Network devices must not have any default manufacturer passwords.",
"version": "NET0240"
},
"V-3160": {
"checkid": "C-12697r2_chk",
"checktext": "Have the administrator enter the show version command to determine the installed IOS version. As of June 2010, the latest major release is 12.4 for routers and 12.2 for switches (both access and multi-layer). The release being used must have all IAVMs resolved and must not be in a Cisco deferred status or has been made obsolete. \n\nAsk the administrator login to the Cisco Software Center to download software. Select the specific router or switch model. Select the IOS Software link and then Verify that the release being used is listed under the release family (will need to expand the list) and not in the deferred list. If the release is not listed in either the release family or deferred, then the release is obsolete.\n\nVerify that all IAVMs have been addressed.\n\nNote: Cisco software in a differed state will still be at the Cisco Software Center and available for download under the deferred group, whereas software made obsolete is no longer available for download. Deferred status occurs when a software maintenance release is made obsolete and removed from order ability and service outside of Cisco's normal release schedule, or Cisco cancels a scheduled maintenance release from reaching the First-Customer-Ship (FCS) milestone. Deferrals are most often related to software quality issues. A deferral can be performed for an entire maintenance release, or just for certain sets of platforms or features within a release. A deferral prior to the FCS milestone may be performed by Cisco to protect customers from receiving software with known catastrophic defects. A deferral after FCS will expedite obsolescence for the release to limit the exposure of customers.\n",
"description": "Network devices that are not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.",
"fixid": "F-3185r4_fix",
"fixtext": "Update operating system to a supported version that addresses all related IAVMs.",
"iacontrols": null,
"id": "V-3160",
"ruleID": "SV-15302r2_rule",
"severity": "medium",
"title": "The network element must be running a current and supported operating system with all IAVMs addressed.",
"version": "NET0700"
},
"V-3175": {
"checkid": "C-12913r8_chk",
"checktext": "Review the network device configuration to verify all management connections for administrative access require authentication.\n\naaa authentication login AUTH_LIST group tacacs+ local\n!\nline vty 0 4\n login authentication AUTH_LIST\n exec-timeout 10 0\n transport input ssh\n\nOr using the default method list as shown in the example below.\n \naaa authentication login default group tacacs+ local\n!\nline vty 0 4\n exec-timeout 10 0\n transport input ssh\n",
"description": "Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
"fixid": "F-3200r3_fix",
"fixtext": "Configure authentication for all management connections.",
"iacontrols": null,
"id": "V-3175",
"ruleID": "SV-15448r4_rule",
"severity": "high",
"title": "The network devices must require authentication prior to establishing a management connection for administrative access.",
"version": "NET1636"
},
"V-3196": {
"checkid": "C-3820r6_chk",
"checktext": "Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption.\n\nDowngrades:\nIf the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II.\n\nIf the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III.\n\nIf the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model.\n\nIf the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.",
"description": "SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.",
"fixid": "F-3221r5_fix",
"fixtext": "If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).",
"iacontrols": null,
"id": "V-3196",
"ruleID": "SV-3196r4_rule",
"severity": "high",
"title": "The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.",
"version": "NET1660"
},
"V-3210": {
"checkid": "C-3822r7_chk",
"checktext": "Review the network devices configuration and verify if either of the SNMP community strings \"public\" or \"private\" is being used.\n\nIf default or well-known community strings are used for SNMP, this is a finding.",
"description": "Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string \"public\". In addition, an attacker can change a system configuration using the write community string \"private\".",
"fixid": "F-3235r4_fix",
"fixtext": "Configure unique SNMP community strings replacing the default community strings.",
"iacontrols": null,
"id": "V-3210",
"ruleID": "SV-3210r4_rule",
"severity": "high",
"title": "The network device must not use the default or well-known SNMP community strings public and private.",
"version": "NET1665"
},
"V-3966": {
"checkid": "C-12935r7_chk",
"checktext": "Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one local account of last resort configured locally for an emergency.\n\nVerify the username and password for the local account of last resort is contained within a sealed envelope kept in a safe.\n\nIf an authentication server is used and more than one local account exists, this is a finding.",
"description": "Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or local account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.",
"fixid": "F-3899r9_fix",
"fixtext": "Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.",
"iacontrols": null,
"id": "V-3966",
"ruleID": "SV-15469r6_rule",
"severity": "medium",
"title": "In the event the authentication server is unavailable, the network device must have a single local account of last resort defined.",
"version": "NET0440"
},
"V-3967": {
"checkid": "C-12909r2_chk",
"checktext": "Review the configuration and verify that a session using the console port will time out after 10 minutes or less of inactivity as shown in the following example:\n\nline con 0\nexec-timeout 10 0 \n",
"description": "Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.",
"fixid": "F-3900r4_fix",
"fixtext": "Configure the timeout for idle console connection to 10 minutes or less.",
"iacontrols": null,
"id": "V-3967",
"ruleID": "SV-15444r2_rule",
"severity": "medium",
"title": "The network element must time out access to the console port after 10 minutes or less of inactivity.",
"version": "NET1624"
},
"V-3969": {
"checkid": "C-12800r7_chk",
"checktext": "Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3. \n\nIf write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the IAO, this is a finding.\n\nSNMP v1/v2c Configuration Example\n\nDevice# show run\n!\nip access-list standard NMS_LIST\n permit 10.1.1.22\n permit 10.1.1.24\n! \nsnmp-server community c0macc3ss RO NMS_LIST\nsnmp-server community R34dWr1t3 RW NMS_LIST\nsnmp-server location Somewhere USA\nsnmp-server contact snmp.admin@snmp.mil\nsnmp-server enable traps\nsnmp host 10.1.1.22 traps SNMPv1\nsnmp host 10.1.1.24 traps SNMPv2c\n\n\nSNMP v3 Configuration Example\n\nThe example ACL NMS_LIST and ADMIN_LIST are used to define what network management stations and administrator (users) desktops can access the device. Examine all group statements to determine what groups are allowed write access. Have the administrator enter a \"show snmp user\" command and examine all users for these groups to verify that they must be authenticated.\n\nDevice# show run\n!\nip access-list standard ADMIN_LIST\n permit 10.1.1.35\n permit 10.1.1.36\nip access-list standard NMS_LIST\n permit 10.1.1.24\n permit 10.1.1.22\n permit 10.1.1.23\n!\nsnmp-server group NOC v3 priv read VIEW_ALL write VIEW_LIMIT access NMS_LIST\nsnmp-server group TRAP_GROUP v3 priv notify\n*tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F \nsnmp-server group ADMIN_GROUP v3 priv read VIEW_ALL write VIEW_ALL access ADMIN_LIST\nsnmp-server view VIEW_ALL internet included\nsnmp-server view VIEW_LIMIT internet included\nsnmp-server view VIEW_LIMIT internet.6.3.15 excluded\nsnmp-server view VIEW_LIMIT internet.6.3.16 excluded\nsnmp-server view VIEW_LIMIT internet.6.3.18 excluded\nsnmp-server enable traps snmp linkdown linkup\nsnmp-server host 10.1.1.24 version 3 priv TRAP_NMS1 \n\nNote: For the configured group TRAP_GROUP, the notify view is auto-generated by the snmp-server host command which bind the user (TRAP_NMS1) and the group it belongs to (TRAP_GROUP) to the list of notifications (traps or informs) which are sent to the host. Hence, the configuration snmp-server group TRAP_GROUP v3 results in the following:\nsnmp-server group TRAP_GROUP v3 priv notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F\n\nNote: Also, for illustration purpose only, the VIEW_LIMIT excludes MIB objects which could potentially reveal information about configured SNMP credentials. These objects are snmpUsmMIB, snmpVacmMIB, and snmpCommunityMIB which is configured as 1.3.6.1.6.3.15, 1.3.6.1.6.3.16, and 1.3.6.1.6.3.18 respectively\n\n\nSNMPv3 users are not shown in a running configuration. You can view them with the show \"snmp user\" command. So for example, if the following users were configured as such.\n\nsnmp-server user HP_OV NOC v3 auth sha HPOVpswd priv aes 256 HPOVsecretkey\nsnmp-server user Admin1 ADMIN_GROUP v3 auth sha Admin1PW priv aes 256 Admin1key\nsnmp-server user Admin2 ADMIN_GROUP v3 auth md5 Admin2pass priv 3des Admin2key\nsnmp-server user TRAP_NMS1 TRAP_GROUP v3 auth sha trap_nms1_pw priv aes trap_nms1_key\n\nThe show snmp user command would depict the configured users as follows:\n\nDevice#show snmp user\n\nUser name: HP_OV\nEngine ID: AB12CD34EF56\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: NOC\n\nUser name: Admin1\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: ADMIN_GROUP\n\nUser name: Admin2\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: MD5\nPrivacy Protocol: 3DES\nGroup-name: ADMIN_GROUP\n\nUser name: TRAP_NMS1\nEngine ID: 800000090300C20013080000\nstorage-type: nonvolatile active\nAuthentication Protocol: SHA\nPrivacy Protocol: AES256\nGroup-name: TRAP_GROUP",
"description": "Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.",
"fixid": "F-3902r7_fix",
"fixtext": "Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.",
"iacontrols": [
"ECSC-1"
],
"id": "V-3969",
"ruleID": "SV-30086r3_rule",
"severity": "medium",
"title": "The network device must only allow SNMP read-only access.",
"version": "NET0894"
},
"V-4582": {
"checkid": "C-20059r4_chk",
"checktext": "Review the network device's configuration and verify authentication is required for console access. \n\nIf the device is accessed via the aux port, then verify that this port also requires authentication. If it is not used, then it must be disabled. The console port and the disabled aux port should look similar to the configuration example below that references an authentication list configured as AUTH_LIST. \n\naaa authentication login AUTH_LIST group tacacs+ local\n!\nline con 0\n login authentication AUTH_LIST\n exec-timeout 10 0\n\nOr using the default method list as shown in the example below.\n \naaa authentication login default group tacacs+ local\n!\nline con 0\n exec-timeout 10 0\n",
"description": "Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.",
"fixid": "F-4515r4_fix",
"fixtext": "Configure authentication for console access on the network device.",
"iacontrols": null,
"id": "V-4582",
"ruleID": "SV-19270r4_rule",
"severity": "high",
"title": "The network device must require authentication for console access.",
"version": "NET1623"
},
"V-4584": {
"checkid": "C-12942r2_chk",
"checktext": "Cisco IOS routers and switches use level 6 (informational) when logging packets that are dropped via access control list. (%SEC-6-IPACCESSLOGNP: list 1 denied 0 1.1.1.2 -> 1.1.1.1, 1 packet). Hence, it is imperative that log messages at level 6 are captured for further analysis and incident reporting. However, these messages do not need to go to the console, but must go to the syslog server. \n\nTo avoid being locked out of the console in the event of an intensive log message generation such as when a large number of packets are being dropped, you can implement any of the following:\n\n1. Limit the amount of logging based on same packet matching via the access-list log-update threshold command. The configured threshold specifies how often syslog messages are generated and sent after the initial packet match on a per flow basis. \n2. Rate-limit messages at specific severity levels destined to be logged at the console via logging rate-limit command.\n3. Have only messages at levels 0-5 (or 0-4) go to the console and messages at level 0-6 go to the syslog server. \n\nThe buffer could be set to notification level or altered to a different level when required (i.e. debugging).\n\nFollowing would be an example configuration:\n\n!\nlogging buffered 4096 informational\nlogging console notifications\n\u2026\n!\nlogging trap debugging \nlogging host 1.1.1.1\n!\n\nThe default state for logging is on and the default for the syslog server is informational (i.e. logging trap informational). Hence, the commands logging on and logging trap informational will not be shown via show run command. Hence, have the operator issue a show logging command to verify logging is on and the level for the syslog server (i.e. trap).\n\n\n\nR1#show logging\n\nSyslog logging: enabled (12 messages dropped, 0 messages rate-limited,\n 0 flushes, 0 overruns, xml disabled, filtering disabled)\n \n\u2026\n \n Console logging: level notifications, 56 messages logged, xml disabled,\n filtering disabled\n Monitor logging: level debugging, 0 messages logged, xml disabled,\n filtering disabled\n Buffer logging: level informational, 6 messages logged, xml disabled,\n filtering disabled\n\u2026\n\n Trap logging: level informational, 73 message lines logged\n Logging to 1.1.1.1 (udp port 514, audit disabled,\n authentication disabled, encryption disabled, link up),\n 37 message lines logged, \n 0 message lines rate-limited, \n 0 message lines dropped-by-MD, \n xml disabled, sequence number disabled\n filtering disabled \n\n\nThe table below lists the severity levels and message types for all log data.\n\nSeverity \nLevel Message Type\n\n0 Emergencies\n1 Alerts\n2 Critical\n3 Errors\n4 Warning\n5 Notifications\n6 Informational\n7 Debugging\n",
"description": "Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. Syslog levels 0-6 are the levels required to collect the necessary information to help in the recovery process.",
"fixid": "F-4517r6_fix",
"fixtext": "Configure the network device to log all messages except debugging and send all log data to a syslog server.",
"iacontrols": null,
"id": "V-4584",
"ruleID": "SV-15476r2_rule",
"severity": "low",
"title": "The network element must log all messages except debugging and send all log data to a syslog server.",
"version": "NET1021"
},
"V-5611": {
"checkid": "C-12914r4_chk",
"checktext": "Review the configuration and verify that management access to the device is allowed only from the management network address space. The configuration should look similar to the following:\n\naccess-list 3 permit 192.168.1.10 log\naccess-list 3 permit 192.168.1.11 log\naccess-list 3 deny any log\n\u2026..\nline vty 0 4\n access-class 3 in\n\nIf management access can be gained from outside of the authorized management network, this is a finding.",
"description": "Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.",
"fixid": "F-5522r4_fix",
"fixtext": "Configure an ACL or filter to restrict management access to the device from only the management network.",
"iacontrols": null,
"id": "V-5611",
"ruleID": "SV-15449r3_rule",
"severity": "medium",
"title": "The network element must only allow management connections for administrative access from hosts residing in to the management network.",
"version": "NET1637"
},
"V-5612": {
"checkid": "C-12922r2_chk",
"checktext": "Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period.\n\nip ssh time-out 60 ",
"description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network element.",
"fixid": "F-5523r5_fix",
"fixtext": "Configure the network devices so it will require a secure shell timeout of 60 seconds or less.",
"iacontrols": null,
"id": "V-5612",
"ruleID": "SV-15457r2_rule",
"severity": "medium",
"title": "The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.",
"version": "NET1645"
},
"V-5613": {
"checkid": "C-12923r2_chk",
"checktext": "Review the configuration and verify the number of unsuccessful SSH login attempts is set at 3.\n\nip ssh authentication-retries 3",
"description": "An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.",
"fixid": "F-5524r9_fix",
"fixtext": "Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.",
"iacontrols": null,
"id": "V-5613",
"ruleID": "SV-15458r2_rule",
"severity": "medium",
"title": "The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface.",
"version": "NET1646"
},
"V-5614": {
"checkid": "C-3552r5_chk",
"checktext": "Review the device configuration to determine if the PAD service is enabled.\n\nIf the PAD service is enabled, this is a finding.",
"description": "Packet Assembler Disassembler (PAD) is an X.25 component seldom used. It collects the data transmissions from the terminals and gathers them into a X.25 data stream and vice versa. PAD acts like a multiplexer for the terminals. If enabled, it can render the device open to attacks. Some voice vendors use PAD on internal routers.",
"fixid": "F-5525r5_fix",
"fixtext": "Configure the device to disable the PAD service.",
"iacontrols": null,
"id": "V-5614",
"ruleID": "SV-5614r3_rule",
"severity": "low",
"title": "Network devices must have the PAD service disabled.",
"version": "NET0722"
},
"V-5615": {
"checkid": "C-3559r7_chk",
"checktext": "Review the device configuration to verify the \"service tcp-keepalives-in\" command is configured.\n\nIf TCP Keep-Alives are not enabled, this is a finding.",
"description": "Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These \"orphaned\" sessions use up valuable router resources and can also be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keepalive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the keepalive message, the sending router will clear the connection and free resources allocated to the session.",
"fixid": "F-5526r7_fix",
"fixtext": "Configure the device to enable TCP Keep-Alives.",
"iacontrols": null,
"id": "V-5615",
"ruleID": "SV-5615r3_rule",
"severity": "low",
"title": "Network devices must have TCP Keep-Alives enabled for TCP sessions.",
"version": "NET0724"
},
"V-5616": {
"checkid": "C-3562r5_chk",
"checktext": "Review the device configuration to verify that identification support is not enabled via \"ip identd\" global command. It is disabled by default. \n\nIf identifications support is enabled, this is a finding.",
"description": "Identification support allows one to query a TCP port for identification. This feature enables an unsecured protocol to report the identity of a client initiating a TCP connection and a host responding to the connection. Identification support can connect a TCP port on a host, issue a simple text string to request information, and receive a simple text-string reply. This is another mechanism to learn the router vendor, model number, and software version being run.",
"fixid": "F-5527r5_fix",
"fixtext": "Configure the device to disable identification support.",
"iacontrols": null,
"id": "V-5616",
"ruleID": "SV-5616r3_rule",
"severity": "low",
"title": "Network devices must have identification support disabled.",
"version": "NET0726"
},
"V-5618": {
"checkid": "C-3577r7_chk",
"checktext": "Review the configuration to determine if gratuitous ARP is disabled.\n\nIf gratuitous ARP is enabled, this is a finding.",
"description": "A gratuitous ARP is an ARP broadcast in which the source and destination MAC addresses are the same. It is used to inform the network about a host IP address. A spoofed gratuitous ARP message can cause network mapping information to be stored incorrectly, causing network malfunction.",
"fixid": "F-5529r5_fix",
"fixtext": "Disable gratuitous ARP on the device.",
"iacontrols": null,
"id": "V-5618",
"ruleID": "SV-5618r3_rule",
"severity": "medium",
"title": "Gratuitous ARP must be disabled.",
"version": "NET0781"
},
"V-5645": {
"checkid": "C-3605r10_chk",
"checktext": "Determine if the Cisco Layer 3 device supports the use of CEF switching mode. If the current IOS version available for the device does not support CEF in any capacity, this requirement will be NA.\n\nMost Cisco Layer 3 devices will support CEF in either Distributed or Central Mode. \n\n1. If the device supports Distributed CEF Mode (dCEF), verify that it has been globally enabled.\n\n2. If the device only supports Central CEF Mode (CEF), verify the function has been globally enabled. \n\nMany of the devices have CEF enabled by default and many of the configurations will not show if CEF functionality is enabled. To verify CEF is running on a Cisco Layer 3 device with IOS run the following command:\n\nrouter#show ip cef\n%CEF not running\n\nIf CEF is shown to be not running, this is a finding.",
"description": "The Cisco Express Forwarding (CEF) switching mode replaces the traditional Cisco routing cache with a data structure that mirrors the entire system routing table. Because there is no need to build cache entries when traffic starts arriving for new destinations, CEF behaves more predictably when presented with large volumes of traffic addressed to many destinations such as a SYN flood attacks. Because many SYN flood attacks use randomized source addresses to which the hosts under attack will reply to, there can be a substantial amount of traffic for a large number of destinations that the router will have to handle. Consequently, routers configured for CEF will perform better under SYN floods directed at hosts inside the network than routers using the traditional cache.",
"fixid": "F-5556r7_fix",
"fixtext": "1. If the Cisco Layer 3 IP device is not enabled by default, enable Distributed CEF Mode globally.\n\nRouter(config)# ip cef distributed\n\n2. If Distributed CEF Mode is not supported, enable Centralized CEF Mode globally.\n\nRouter(config)# ip cef\n\n3. If CEF is not supported in any capacity on the device, this finding is NA.",
"iacontrols": [
"ECSC-1"
],
"id": "V-5645",
"ruleID": "SV-5645r4_rule",
"severity": "medium",
"title": "Cisco Express Forwarding (CEF) must be enabled on all supported Cisco Layer 3 IP devices.",
"version": "NET0949"
},
"V-5646": {
"checkid": "C-12900r6_chk",
"checktext": "Review the device configuration to validate threshold filters or timeout periods are set for dropping excessive half-open TCP connections.\n\nFor timeout periods, the time should be set to 10 seconds or less. If the device can not be configured for 10 seconds or less, it should be set to the least amount of time allowable in the configuration. Threshold filters will need to be determined by the organization for optimal filtering.\n\nIOS Configuration Example: \nip tcp synwait-time 10",
"description": "A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator.\n\nAn attacker\u2019s goal in this scenario is to cause a denial of service to the network or device by initiating a high volume of TCP packets, then never sending an acknowledgement, leaving connections in a half-opened state. Without the device having a connection or time threshold for these half-opened sessions, the device risks being a victim of a denial of service attack. Setting a TCP timeout threshold will instruct the device to shut down any incomplete connections. Services such as SSH, BGP, SNMP, LDP, etc. are some services that may be prone to these types of denial of service attacks. If the router does not have any BGP connections with BGP neighbors across WAN links, values could be set to even tighter constraints.",
"fixid": "F-5557r6_fix",
"fixtext": "Configure the device to drop half-open TCP connections through threshold filtering or timeout periods.",
"iacontrols": [
"ECSC-1"
],
"id": "V-5646",
"ruleID": "SV-15435r4_rule",
"severity": "medium",
"title": "The network device must drop half-open TCP connections through filtering thresholds or timeout periods.",
"version": "NET0965"
},
"V-7009": {
"checkid": "C-3496r6_chk",
"checktext": "Review the running configuration to determine if key authentication has been defined with an infinite lifetime.\n\nIf an infinite key has not been configured, this is a finding.\n\nOSPFv2 Example\n\ninterface GigabitEthernet0/1\n ip address 10.1.12.2 255.255.255.0\n ip ospf authentication key-chain OSPF_KEY\n\n\nkey chain OSPF_KEY\n\nkey 1\n key-string WWWWW \n send-lifetime 16:00:00 Feb 22 2017 16:00:00 Aug 22 2017\n accept-lifetime 16:00:00 Feb 22 2017 16:00:00 Aug 22 2017\n cryptographic-algorithm hmac-sha-256\n\nkey 2\n key-string XXXXX \n send-lifetime 16:00:00 Aug 21 2017 16:00:00 Feb 20 2018\n accept-lifetime 16:00:00 Aug 21 2017 16:00:00 Feb 20 2018\n cryptographic-algorithm hmac-sha-256\n\nkey 99999\n key-string YYYYY \n send-lifetime 15:59:00 Feb 20 2018 infinite\n accept-lifetime 15:59:00 Feb 20 2018 infinite\n cryptographic-algorithm hmac-sha-256 \n\nNotes: Note: Only Interior Gateway Protocols (IGPs) use key chains.\n\nNotes: When using authentication keys, it is imperative the site is in compliance with the NTP policies. The router has to know the time!\n\nNotes: Must make this a high number to ensure you have plenty of room to put keys in before it. All subsequent keys will be decremented by one (9998, 9997...).\n",
"description": "Only Interior Gateway Protocols (IGPs) use key chains. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates--both with a 180-day or less lifetime. A third key must also be defined with an infinite lifetime. Both of these steps ensure there will always be a key that can be placed into service by all peers. If a time period occurs during which no key is activated, authentication cannot occur; hence, route updates will not occur. The lifetime key should be changed 7 days after successful key rotation and synchronization has occurred with all peers.",
"fixid": "F-6611r3_fix",
"fixtext": "This check is in place to ensure keys do not expire creating a DOS due to adjacencies being dropped and routes being aged out. The recommendation is to use two rotating six month keys with a third key set as infinite lifetime. The lifetime key should be changed 7 days after the rotating keys have expired and redefined.",
"iacontrols": null,
"id": "V-7009",
"ruleID": "SV-7363r3_rule",
"severity": "high",
"title": "An Infinite Lifetime key must be set to never expire. The lifetime of the key will be configured as infinite for route authentication, if supported by the current approved router software version.",
"version": "NET0425"
},
"V-7011": {
"checkid": "C-12911r2_chk",
"checktext": "Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it. The following configuration disables the Cisco IOS auxiliary port:\n \nline aux 0\n no exec\n\nNote: The command transport input none must be configured under the line aux 0. However, this is the default and will not be shown in the running configuration.\n",
"description": "The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network.\n\nSecured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.\n",
"fixid": "F-6614r3_fix",
"fixtext": "Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.",
"iacontrols": null,
"id": "V-7011",
"ruleID": "SV-15446r2_rule",
"severity": "low",
"title": "The network element\u2019s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.",
"version": "NET1629"
}
},
"profiles": {
"MAC-1_Classified": {
"description": "",
"findings": {
"V-14667": "true",
"V-14669": "true",
"V-14671": "true",
"V-14672": "true",
"V-14673": "true",
"V-14674": "true",
"V-14675": "true",
"V-14676": "true",
"V-14677": "true",
"V-14681": "true",
"V-14693": "true",
"V-14705": "true",
"V-14707": "true",
"V-14717": "true",
"V-15288": "true",
"V-15432": "true",
"V-15434": "true",
"V-17754": "true",
"V-17814": "true",
"V-17815": "true",
"V-17816": "true",
"V-17817": "true",
"V-17818": "true",
"V-17819": "true",
"V-17821": "true",
"V-17822": "true",
"V-17823": "true",
"V-17834": "true",
"V-17835": "true",
"V-17836": "true",
"V-17837": "true",
"V-18522": "true",
"V-18790": "true",
"V-19188": "true",
"V-19189": "true",
"V-23747": "true",
"V-28784": "true",
"V-3000": "true",
"V-3008": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3034": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-30577": "true",
"V-30578": "true",
"V-3058": "true",
"V-30617": "true",
"V-3062": "true",
"V-30660": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-30736": "true",
"V-30744": "true",
"V-3078": "true",
"V-3079": "true",
"V-3080": "true",
"V-3081": "true",
"V-3083": "true",
"V-3085": "true",
"V-3086": "true",
"V-31285": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5616": "true",
"V-5618": "true",
"V-5645": "true",
"V-5646": "true",
"V-7009": "true",
"V-7011": "true"
},
"id": "MAC-1_Classified",
"title": "I - Mission Critical Classified"
},
"MAC-1_Public": {
"description": "",
"findings": {
"V-14667": "true",
"V-14669": "true",
"V-14671": "true",
"V-14672": "true",
"V-14673": "true",
"V-14674": "true",
"V-14675": "true",
"V-14676": "true",
"V-14677": "true",
"V-14681": "true",
"V-14693": "true",
"V-14705": "true",
"V-14707": "true",
"V-14717": "true",
"V-15288": "true",
"V-15432": "true",
"V-15434": "true",
"V-17754": "true",
"V-17814": "true",
"V-17815": "true",
"V-17816": "true",
"V-17817": "true",
"V-17818": "true",
"V-17819": "true",
"V-17821": "true",
"V-17822": "true",
"V-17823": "true",
"V-17834": "true",
"V-17835": "true",
"V-17836": "true",
"V-17837": "true",
"V-18522": "true",
"V-18790": "true",
"V-19188": "true",
"V-19189": "true",
"V-23747": "true",
"V-28784": "true",
"V-3000": "true",
"V-3008": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3034": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-30577": "true",
"V-30578": "true",
"V-3058": "true",
"V-30617": "true",
"V-3062": "true",
"V-30660": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-30736": "true",
"V-30744": "true",
"V-3078": "true",
"V-3079": "true",
"V-3080": "true",
"V-3081": "true",
"V-3083": "true",
"V-3085": "true",
"V-3086": "true",
"V-31285": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5616": "true",
"V-5618": "true",
"V-5645": "true",
"V-5646": "true",
"V-7009": "true",
"V-7011": "true"
},
"id": "MAC-1_Public",
"title": "I - Mission Critical Public"
},
"MAC-1_Sensitive": {
"description": "",
"findings": {
"V-14667": "true",
"V-14669": "true",
"V-14671": "true",
"V-14672": "true",
"V-14673": "true",
"V-14674": "true",
"V-14675": "true",
"V-14676": "true",
"V-14677": "true",
"V-14681": "true",
"V-14693": "true",
"V-14705": "true",
"V-14707": "true",
"V-14717": "true",
"V-15288": "true",
"V-15432": "true",
"V-15434": "true",
"V-17754": "true",
"V-17814": "true",
"V-17815": "true",
"V-17816": "true",
"V-17817": "true",
"V-17818": "true",
"V-17819": "true",
"V-17821": "true",
"V-17822": "true",
"V-17823": "true",
"V-17834": "true",
"V-17835": "true",
"V-17836": "true",
"V-17837": "true",
"V-18522": "true",
"V-18790": "true",
"V-19188": "true",
"V-19189": "true",
"V-23747": "true",
"V-28784": "true",
"V-3000": "true",
"V-3008": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3034": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-30577": "true",
"V-30578": "true",
"V-3058": "true",
"V-30617": "true",
"V-3062": "true",
"V-30660": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-30736": "true",
"V-30744": "true",
"V-3078": "true",
"V-3079": "true",
"V-3080": "true",
"V-3081": "true",
"V-3083": "true",
"V-3085": "true",
"V-3086": "true",
"V-31285": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5616": "true",
"V-5618": "true",
"V-5645": "true",
"V-5646": "true",
"V-7009": "true",
"V-7011": "true"
},
"id": "MAC-1_Sensitive",
"title": "I - Mission Critical Sensitive"
},
"MAC-2_Classified": {
"description": "",
"findings": {
"V-14667": "true",
"V-14669": "true",
"V-14671": "true",
"V-14672": "true",
"V-14673": "true",
"V-14674": "true",
"V-14675": "true",
"V-14676": "true",
"V-14677": "true",
"V-14681": "true",
"V-14693": "true",
"V-14705": "true",
"V-14707": "true",
"V-14717": "true",
"V-15288": "true",
"V-15432": "true",
"V-15434": "true",
"V-17754": "true",
"V-17814": "true",
"V-17815": "true",
"V-17816": "true",
"V-17817": "true",
"V-17818": "true",
"V-17819": "true",
"V-17821": "true",
"V-17822": "true",
"V-17823": "true",
"V-17834": "true",
"V-17835": "true",
"V-17836": "true",
"V-17837": "true",
"V-18522": "true",
"V-18790": "true",
"V-19188": "true",
"V-19189": "true",
"V-23747": "true",
"V-28784": "true",
"V-3000": "true",
"V-3008": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3034": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-30577": "true",
"V-30578": "true",
"V-3058": "true",
"V-30617": "true",
"V-3062": "true",
"V-30660": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-30736": "true",
"V-30744": "true",
"V-3078": "true",
"V-3079": "true",
"V-3080": "true",
"V-3081": "true",
"V-3083": "true",
"V-3085": "true",
"V-3086": "true",
"V-31285": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5616": "true",
"V-5618": "true",
"V-5645": "true",
"V-5646": "true",
"V-7009": "true",
"V-7011": "true"
},
"id": "MAC-2_Classified",
"title": "II - Mission Support Classified"
},
"MAC-2_Public": {
"description": "",
"findings": {
"V-14667": "true",
"V-14669": "true",
"V-14671": "true",
"V-14672": "true",
"V-14673": "true",
"V-14674": "true",
"V-14675": "true",
"V-14676": "true",
"V-14677": "true",
"V-14681": "true",
"V-14693": "true",
"V-14705": "true",
"V-14707": "true",
"V-14717": "true",
"V-15288": "true",
"V-15432": "true",
"V-15434": "true",
"V-17754": "true",
"V-17814": "true",
"V-17815": "true",
"V-17816": "true",
"V-17817": "true",
"V-17818": "true",
"V-17819": "true",
"V-17821": "true",
"V-17822": "true",
"V-17823": "true",
"V-17834": "true",
"V-17835": "true",
"V-17836": "true",
"V-17837": "true",
"V-18522": "true",
"V-18790": "true",
"V-19188": "true",
"V-19189": "true",
"V-23747": "true",
"V-28784": "true",
"V-3000": "true",
"V-3008": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3034": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-30577": "true",
"V-30578": "true",
"V-3058": "true",
"V-30617": "true",
"V-3062": "true",
"V-30660": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-30736": "true",
"V-30744": "true",
"V-3078": "true",
"V-3079": "true",
"V-3080": "true",
"V-3081": "true",
"V-3083": "true",
"V-3085": "true",
"V-3086": "true",
"V-31285": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5616": "true",
"V-5618": "true",
"V-5645": "true",
"V-5646": "true",
"V-7009": "true",
"V-7011": "true"
},
"id": "MAC-2_Public",
"title": "II - Mission Support Public"
},
"MAC-2_Sensitive": {
"description": "",
"findings": {
"V-14667": "true",
"V-14669": "true",
"V-14671": "true",
"V-14672": "true",
"V-14673": "true",
"V-14674": "true",
"V-14675": "true",
"V-14676": "true",
"V-14677": "true",
"V-14681": "true",
"V-14693": "true",
"V-14705": "true",
"V-14707": "true",
"V-14717": "true",
"V-15288": "true",
"V-15432": "true",
"V-15434": "true",
"V-17754": "true",
"V-17814": "true",
"V-17815": "true",
"V-17816": "true",
"V-17817": "true",
"V-17818": "true",
"V-17819": "true",
"V-17821": "true",
"V-17822": "true",
"V-17823": "true",
"V-17834": "true",
"V-17835": "true",
"V-17836": "true",
"V-17837": "true",
"V-18522": "true",
"V-18790": "true",
"V-19188": "true",
"V-19189": "true",
"V-23747": "true",
"V-28784": "true",
"V-3000": "true",
"V-3008": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3034": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-30577": "true",
"V-30578": "true",
"V-3058": "true",
"V-30617": "true",
"V-3062": "true",
"V-30660": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-30736": "true",
"V-30744": "true",
"V-3078": "true",
"V-3079": "true",
"V-3080": "true",
"V-3081": "true",
"V-3083": "true",
"V-3085": "true",
"V-3086": "true",
"V-31285": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5616": "true",
"V-5618": "true",
"V-5645": "true",
"V-5646": "true",
"V-7009": "true",
"V-7011": "true"
},
"id": "MAC-2_Sensitive",
"title": "II - Mission Support Sensitive"
},
"MAC-3_Classified": {
"description": "",
"findings": {
"V-14667": "true",
"V-14669": "true",
"V-14671": "true",
"V-14672": "true",
"V-14673": "true",
"V-14674": "true",
"V-14675": "true",
"V-14676": "true",
"V-14677": "true",
"V-14681": "true",
"V-14693": "true",
"V-14705": "true",
"V-14707": "true",
"V-14717": "true",
"V-15288": "true",
"V-15432": "true",
"V-15434": "true",
"V-17754": "true",
"V-17814": "true",
"V-17815": "true",
"V-17816": "true",
"V-17817": "true",
"V-17818": "true",
"V-17819": "true",
"V-17821": "true",
"V-17822": "true",
"V-17823": "true",
"V-17834": "true",
"V-17835": "true",
"V-17836": "true",
"V-17837": "true",
"V-18522": "true",
"V-18790": "true",
"V-19188": "true",
"V-19189": "true",
"V-23747": "true",
"V-28784": "true",
"V-3000": "true",
"V-3008": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3034": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-30577": "true",
"V-30578": "true",
"V-3058": "true",
"V-30617": "true",
"V-3062": "true",
"V-30660": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-30736": "true",
"V-30744": "true",
"V-3078": "true",
"V-3079": "true",
"V-3080": "true",
"V-3081": "true",
"V-3083": "true",
"V-3085": "true",
"V-3086": "true",
"V-31285": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5616": "true",
"V-5618": "true",
"V-5645": "true",
"V-5646": "true",
"V-7009": "true",
"V-7011": "true"
},
"id": "MAC-3_Classified",
"title": "III - Administrative Classified"
},
"MAC-3_Public": {
"description": "",
"findings": {
"V-14667": "true",
"V-14669": "true",
"V-14671": "true",
"V-14672": "true",
"V-14673": "true",
"V-14674": "true",
"V-14675": "true",
"V-14676": "true",
"V-14677": "true",
"V-14681": "true",
"V-14693": "true",
"V-14705": "true",
"V-14707": "true",
"V-14717": "true",
"V-15288": "true",
"V-15432": "true",
"V-15434": "true",
"V-17754": "true",
"V-17814": "true",
"V-17815": "true",
"V-17816": "true",
"V-17817": "true",
"V-17818": "true",
"V-17819": "true",
"V-17821": "true",
"V-17822": "true",
"V-17823": "true",
"V-17834": "true",
"V-17835": "true",
"V-17836": "true",
"V-17837": "true",
"V-18522": "true",
"V-18790": "true",
"V-19188": "true",
"V-19189": "true",
"V-23747": "true",
"V-28784": "true",
"V-3000": "true",
"V-3008": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3034": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-30577": "true",
"V-30578": "true",
"V-3058": "true",
"V-30617": "true",
"V-3062": "true",
"V-30660": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-30736": "true",
"V-30744": "true",
"V-3078": "true",
"V-3079": "true",
"V-3080": "true",
"V-3081": "true",
"V-3083": "true",
"V-3085": "true",
"V-3086": "true",
"V-31285": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5616": "true",
"V-5618": "true",
"V-5645": "true",
"V-5646": "true",
"V-7009": "true",
"V-7011": "true"
},
"id": "MAC-3_Public",
"title": "III - Administrative Public"
},
"MAC-3_Sensitive": {
"description": "",
"findings": {
"V-14667": "true",
"V-14669": "true",
"V-14671": "true",
"V-14672": "true",
"V-14673": "true",
"V-14674": "true",
"V-14675": "true",
"V-14676": "true",
"V-14677": "true",
"V-14681": "true",
"V-14693": "true",
"V-14705": "true",
"V-14707": "true",
"V-14717": "true",
"V-15288": "true",
"V-15432": "true",
"V-15434": "true",
"V-17754": "true",
"V-17814": "true",
"V-17815": "true",
"V-17816": "true",
"V-17817": "true",
"V-17818": "true",
"V-17819": "true",
"V-17821": "true",
"V-17822": "true",
"V-17823": "true",
"V-17834": "true",
"V-17835": "true",
"V-17836": "true",
"V-17837": "true",
"V-18522": "true",
"V-18790": "true",
"V-19188": "true",
"V-19189": "true",
"V-23747": "true",
"V-28784": "true",
"V-3000": "true",
"V-3008": "true",
"V-3012": "true",
"V-3013": "true",
"V-3014": "true",
"V-3020": "true",
"V-3021": "true",
"V-3034": "true",
"V-3043": "true",
"V-3056": "true",
"V-3057": "true",
"V-30577": "true",
"V-30578": "true",
"V-3058": "true",
"V-30617": "true",
"V-3062": "true",
"V-30660": "true",
"V-3069": "true",
"V-3070": "true",
"V-3072": "true",
"V-30736": "true",
"V-30744": "true",
"V-3078": "true",
"V-3079": "true",
"V-3080": "true",
"V-3081": "true",
"V-3083": "true",
"V-3085": "true",
"V-3086": "true",
"V-31285": "true",
"V-3143": "true",
"V-3160": "true",
"V-3175": "true",
"V-3196": "true",
"V-3210": "true",
"V-3966": "true",
"V-3967": "true",
"V-3969": "true",
"V-4582": "true",
"V-4584": "true",
"V-5611": "true",
"V-5612": "true",
"V-5613": "true",
"V-5614": "true",
"V-5615": "true",
"V-5616": "true",
"V-5618": "true",
"V-5645": "true",
"V-5646": "true",
"V-7009": "true",
"V-7011": "true"
},
"id": "MAC-3_Sensitive",
"title": "III - Administrative Sensitive"
}
},
"slug": "infrastructure_router__cisco",
"title": "Infrastructure Router Security Technical Implementation Guide Cisco",
"version": "8"
}
}