BaselineWatch
1 STIGs
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Network devices STIGs

1 STIG followed · All platforms
All 42 CAT I 8CAT II 34CAT III 0 Browse in the Register

CAT I 8

Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.

  1. CISC-ND-000470 CAT I V-215823 · SRG-APP-000142-NDM-000245

    The Cisco router must be configured to prohibit the use of all unnecessary and nonsecure functions and services.

    Maps to CM-7 via CCI-000382
    Check

    Verify that the router does not have any unnecessary or nonsecure ports, protocols, and services enabled. For example, the following commands should not be in the configuration: boot network ip boot server ip bootp server ip dns server ip identd ip finger ip http server ip rcmd rcp-enable ip rcmd rsh-enable service config service finger service tcp-small-servers service udp-small-servers service pad service call-home Note: Certain legacy devices may require 'service call-home' be enabled to support Smart Licensing as they do not support the newer smart transport configuration. Those devices do not incur a finding for having call-home enabled for Smart Licensing. If any unnecessary or nonsecure ports, protocols, or services are enabled, this is a finding.

    Fix

    Disable the following services if enabled as shown in the example below. R2(config)#no boot network R2(config)#no ip boot server R2(config)#no ip bootp server R2(config)#no ip dns server R2(config)#no ip identd R2(config)#no ip finger R2(config)#no ip http server R2(config)#no ip rcmd rcp-enable R2(config)#no ip rcmd rsh-enable R2(config)#no service config R2(config)#no service finger R2(config)#no service tcp-small-servers R2(config)#no service udp-small-servers R2(config)#no service pad R2(config)#no service call-home R2(config)#end

  2. CISC-ND-000620 CAT I V-215832 · SRG-APP-000171-NDM-000258

    The Cisco router must only store cryptographic representations of passwords.

    Maps to IA-5(1), SC-28(3) via CCI-004062, CCI-004910, CCI-000196
    Check

    Review the router configuration to determine if passwords are encrypted as shown in the example below. service password-encryption If the router is not configured to encrypt passwords, this is a finding.

    Fix

    Configure the router to encrypt all passwords. R4(config)#service password-encryption R4(config)#end

  3. CISC-ND-000720 CAT I V-215833 · SRG-APP-000190-NDM-000267

    The Cisco router must be configured to terminate all network connections associated with device management after five minutes of inactivity.

    Maps to SC-10 via CCI-001133
    Check

    Review the Cisco router configuration to verify that all network connections associated with a device management have an idle timeout value set to five minutes or less as shown in the following example: ip http secure-server ip http timeout-policy idle 300 life nnnn requests nn … … … line con 0 exec-timeout 5 0 line vty 0 1 exec-timeout 5 0 If the Cisco router is not configured to terminate all network connections associated with a device management after five minutes of inactivity, this is a finding.

    Fix

    Set the idle timeout value to five minutes or less on all configured login classes as shown in the example below. R1(config)#line vty 0 1 R1(config-line)#exec-timeout 5 0 R1(config-line)#exit R1(config)#line con 0 R1(config-line)#exec-timeout 5 0 R1(config-line)#exit R2(config)#ip http timeout-policy idle 300 life nnnn requests nn

  4. CISC-ND-001200 CAT I V-215844 · SRG-APP-000411-NDM-000330

    The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.

    Maps to IA-2(8), MA-4(6) via CCI-002890, CCI-001941
    Check

    Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. NOTE: Although allowed by SP800-131Ar2 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and Government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. SSH Example ip ssh version 2 ip ssh server algorithm mac hmac-sha2-256 If the Cisco router is not configured to use FIPS-validated HMAC to protect the integrity of remote maintenance sessions, this is a finding.

    Fix

    Configure SSH to use FIPS-validated HMAC for remote maintenance sessions as shown in the following example: SSH Example R1(config)#ip ssh version 2 R1(config)#ip ssh server algorithm mac hmac-sha2-256

  5. CISC-ND-001210 CAT I V-215845 · SRG-APP-000412-NDM-000331

    The Cisco router must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.

    Maps to MA-4(6) via CCI-003123
    Check

    Review the Cisco router configuration to verify that it is compliant with this requirement. SSH Example ip ssh version 2 ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr If the router is not configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions using a FIPS 140-2 approved algorithm, this is a finding.

    Fix

    Configure the Cisco router to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions using a FIPS 140-2 approved algorithm as shown in the examples below. SSH Example R1(config)#ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr

  6. CISC-ND-001370 CAT I V-215854 · SRG-APP-000516-NDM-000336

    The Cisco router must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

    Maps to CM-6(1) via CCI-000370
    Check

    Review the Cisco router configuration to verify the device is configured to use at least two authentication servers as primary source for authentication as shown in the following example: aaa new-model ! aaa authentication CONSOLE group radius local aaa authentication login LOGIN_AUTHENTICATION group radius local … … … ip http authentication aaa login-authentication LOGIN_AUTHENTICATION ip http secure-server … … … radius-server host x.x.x.x auth-port 1812 acct-port 1813 key xxxxxx radius-server host x.x.x.x auth-port 1812 acct-port 1813 key xxxxxx … … … line con 0 exec-timeout 5 0 login authentication CONSOLE line vty 0 1 exec-timeout 5 0 login authentication LOGIN_AUTHENTICATION If the Cisco router is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

    Fix

    Step 1: Configure the Cisco router to use at least two authentication servers as shown in the following example: R4(config)#radius host 10.1.48.2 key xxxxxx R4(config)#radius host 10.1.48.3 key xxxxxx Step 2: Configure the authentication order to use the authentication servers as primary source for authentication as shown in the following example: R4(config)#aaa authentication CONSOLE group radius local R4(config)#aaa authentication login LOGIN_AUTHENTICATION group radius local Step 3: Configure all network connections associated with a device management to use the authentication servers for the purpose of login authentication. R4(config)#line vty 0 1 R4(config-line)#login authentication LOGIN_AUTHENTICATION R4(config-line)#exit R4(config)#line con 0 R4(config-line)#login authentication CONSOLE R4(config-line)#exit R4(config)#ip http authentication aaa login-authentication LOGIN_AUTHENTICATION

  7. CISC-ND-001450 CAT I V-220139 · SRG-APP-000516-NDM-000350

    The Cisco router must be configured to send log data to at least two syslog servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).

    Maps to AU-4(1) via CCI-001851
    Check

    Verify that the router is configured to send logs to at least two syslog servers. The configuration should look similar to the example below: logging x.x.x.x logging x.x.x.x If the router is not configured to send log data to the syslog servers, this is a finding.

    Fix

    Configure the router to send log messages to the syslog servers as shown in the example below. R4(config)#logging host x.x.x.x R4(config)#logging host x.x.x.x

  8. CISC-ND-001470 CAT I V-220140 · SRG-APP-000516-NDM-000351

    The Cisco router must be running an IOS release that is currently supported by Cisco Systems.

    Maps to CM-6 via CCI-000366
    Check

    Verify that the router is in compliance with this requirement by having the router administrator enter the following command: show version Verify that the release is still supported by Cisco. All releases supported by Cisco can be found on the following URL: www.cisco.com/c/en/us/support/ios-nx-os-software If the router is not running a supported release, this is a finding.

    Fix

    Upgrade the router to a supported release.