Infrastructure L3 Switch Secure Technical Implementation Guide - Cisco
- Version/Release: V8R29
- Published: 2018-11-27
- Released: 2019-01-25
-
Expand All:
- Severity:
-
Sort:
Compare
Select any two versions of this STIG to compare the individual requirements
View
Select any old version/release of this STIG to view the previous requirements
- RMF Control
- Severity
- Low
- CCI
- Version
- NET1020
- Vuln IDs
-
- V-3000
- Rule IDs
-
- SV-15474r3_rule
Checks: C-12940r3_chk
Review the network device interface ACLs to verify all deny statements are logged. Cisco IOS example: interface FastEthernet 0/0 description external interface peering with ISP or non-DoD network ip address 199.36.92.1 255.255.255.252 ip access-group 100 in … access-list 100 deny icmp any any fragments log access-list 100 deny ip 169.254.0.0 0.0.255.255 any log access-list 100 deny ip 10.0.0.0 0.255.255.255 any log access-list 100 deny ip 172.16.0.0 0.15.255.255 any log access-list 100 deny ip 192.168.0.0 0.0.255.255 any log access-list 100 permit icmp any host 199.36.92.1 echo-reply access-list 100 permit icmp any host 199.36.90.10 echo-reply access-list 100 deny icmp any any log access-list 100 deny ip any any log
Fix: F-3025r4_fix
Configure interface ACLs to log all deny statements.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1800
- Vuln IDs
-
- V-3008
- Rule IDs
-
- SV-3008r1_rule
Checks: C-3837r1_chk
Have the SA display the configuration settings that enable this feature. Review the network topology diagram, and review VPN concentrators. Determine if tunnel mode is being used by reviewing the configuration. Examples: In CISCO Router(config)# crypto ipsec transform-set transform-set-name transform1 Router(cfg-crypto-tran)# mode tunnel OR in Junos edit security ipsec security-association sa-name] mode tunnel
Fix: F-3033r1_fix
Establish the VPN as a tunneled VPN. Terminate the tunneled VPN outside of the firewall. Ensure all host-to-host VPN are established between trusted known hosts.
- RMF Control
- Severity
- High
- CCI
- Version
- NET0230
- Vuln IDs
-
- V-3012
- Rule IDs
-
- SV-3012r4_rule
Checks: C-3456r6_chk
Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required. If passwords aren't used to administrative access to the device, this is a finding.
Fix: F-3037r6_fix
Configure the network devices so it will require a password to gain administrative access to the device.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0340
- Vuln IDs
-
- V-3013
- Rule IDs
-
- SV-3013r5_rule
Checks: C-3474r11_chk
Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't." If the device configuration does not have a logon banner as stated above, this is a finding.
Fix: F-3038r9_fix
Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1639
- Vuln IDs
-
- V-3014
- Rule IDs
-
- SV-15453r2_rule
Checks: C-12918r4_chk
Review the management connection for administrative access and verify the network element is configured to time-out the connection after 10 minutes or less of inactivity. The default for the VTY line is 10 minutes and may not appear in the display of the configuration. The VTY line should contain the following command: exec-timeout 10
Fix: F-3039r5_fix
Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0820
- Vuln IDs
-
- V-3020
- Rule IDs
-
- SV-15330r2_rule
Checks: C-12796r2_chk
Review the device configuration to ensure that DNS servers have been defined if it has been configured as a client resolver (name lookup). The configuration should look similar to one of the following examples: ip domain-lookup ip name-server 192.168.1.253 or no ip domain-lookup The first configuration example has DNS lookup enabled and hence has defined its DNS server. The second example has DNS lookup disabled. Note: ip domain-lookup is enabled by default. Hence it may not be shown—depending on the IOS release. If it is enabled, it will be shown near the beginning of the configuration.
Fix: F-3045r2_fix
Configure the device to include DNS servers or disable domain lookup.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0890
- Vuln IDs
-
- V-3021
- Rule IDs
-
- SV-15332r2_rule
Checks: C-12798r3_chk
Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network. The following examples for SNMP v1, 2, and 3 depict the use of an ACL to restrict SNMP access to the device. SNMP v1/v2c Configuration Example The example ACL NMS_LIST is used to define what network management stations can access the device for write and read only (poll). ip access-list standard NMS_LIST permit 10.1.1.24 permit 10.1.1.22 permit 10.1.1.23 ! snmp-server community ourCommStr RO RW NMS_LIST snmp-server community write_pw RW NMS_LIST snmp-server enable traps snmp linkdown linkup snmp-server host 10.1.1.1 trap_comm_string Note: If you enter the snmp-server host command with no keywords, the default is version 1 and to send all enabled traps to the host. No informs will be sent to this host. If no traps or informs keyword is present, traps are sent. SNMP v3 Configuration Example The example ACL NMS_LIST and ADMIN_LIST are used to define what network management stations and administrator (users) desktops can access the device. ip access-list standard ADMIN_LIST permit 10.1.1.35 permit 10.1.1.36 ip access-list standard NMS_LIST permit 10.1.1.24 permit 10.1.1.22 permit 10.1.1.23 ! snmp-server group NOC v3 priv read VIEW_ALL write VIEW_LIMIT access NMS_LIST snmp-server group TRAP_GROUP v3 priv notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F snmp-server group ADMIN_GROUP v3 priv read VIEW_ALL write VIEW_ALL access ADMIN_LIST snmp-server view VIEW_ALL internet included snmp-server view VIEW_LIMIT internet included snmp-server view VIEW_LIMIT internet.6.3.15 excluded snmp-server view VIEW_LIMIT internet.6.3.16 excluded snmp-server view VIEW_LIMIT internet.6.3.18 excluded snmp-server enable traps snmp linkdown linkup snmp-server host 10.1.1.24 version 3 priv TRAP_NMS1 Note: For the configured group TRAP_GROUP, the notify view is auto-generated by the snmp-server host command which bind the user (TRAP_NMS1) and the group it belongs to (TRAP_GROUP) to the list of notifications (traps or informs) which are sent to the host. Hence, the configuration snmp-server group TRAP_GROUP v3 results in the following: snmp-server group TRAP_GROUP v3 priv notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F Note: Not required but for illustration purpose, the VIEW_LIMIT excludes MIB objects which could potentially reveal information about configured SNMP credentials. These objects are snmpUsmMIB, snmpVacmMIB, and snmpCommunityMIB which is configured as 1.3.6.1.6.3.15, 1.3.6.1.6.3.16, and 1.3.6.1.6.3.18 respectively Note that SNMPv3 users are not shown in a running configuration. You can view them with the show snmp user command. So for example, if the following users were configured as such. snmp-server user HP_OV NOC v3 auth sha HPOVpswd priv aes 256 HPOVsecretkey snmp-server user Admin1 ADMIN_GROUP v3 auth sha Admin1PW priv aes 256 Admin1key snmp-server user Admin2 ADMIN_GROUP v3 auth md5 Admin2pass priv 3des Admin2key snmp-server user TRAP_NMS1 TRAP_GROUP v3 auth sha trap_nms1_pw priv aes trap_nms1_key The show snmp user command would depict the configured users as follows: R1#show snmp user User name: HP_OV Engine ID: AB12CD34EF56 storage-type: nonvolatile active Authentication Protocol: SHA Privacy Protocol: AES256 Group-name: NOC User name: Admin1 Engine ID: 800000090300C20013080000 storage-type: nonvolatile active Authentication Protocol: SHA Privacy Protocol: AES256 Group-name: ADMIN_GROUP User name: Admin2 Engine ID: 800000090300C20013080000 storage-type: nonvolatile active Authentication Protocol: MD5 Privacy Protocol: 3DES Group-name: ADMIN_GROUP User name: TRAP_NMS1 Engine ID: 800000090300C20013080000 storage-type: nonvolatile active Authentication Protocol: SHA Privacy Protocol: AES256 Group-name: TRAP_GROUP R1#
Fix: F-3046r4_fix
Configure the network devices to only allow SNMP access from only addresses belonging to the management network.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0400
- Vuln IDs
-
- V-3034
- Rule IDs
-
- SV-15290r2_rule
Checks: C-3489r4_chk
Review the device configuration to determine if authentication is configured for all IGP peers. If authentication is not configured for all IGP peers, this is a finding.
Fix: F-3059r3_fix
Configure authentication for all IGP peers.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1675
- Vuln IDs
-
- V-3043
- Rule IDs
-
- SV-3043r4_rule
Checks: C-3825r7_chk
Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access. If unique community strings or accounts are not used for SNMP peers, this is a finding.
Fix: F-3068r4_fix
Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.
- RMF Control
- Severity
- High
- CCI
- Version
- NET0460
- Vuln IDs
-
- V-3056
- Rule IDs
-
- SV-3056r7_rule
Checks: C-3503r11_chk
Review the network device configuration and validate there are no group accounts configured for access. If a group account is configured on the device, this is a finding.
Fix: F-3081r9_fix
Configure individual user accounts for each authorized person then remove any group accounts.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0465
- Vuln IDs
-
- V-3057
- Rule IDs
-
- SV-15471r4_rule
Checks: C-12937r5_chk
Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the least privilege level unless deemed necessary for assigned duties. If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding. Below is an example of assigning a privilege level to a local user account and changing the default privilege level of the configure terminal command. username junior-engineer1 privilege 7 password xxxxxx privilege exec level 7 configure terminal The above example only covers local accounts. You will also need to check the accounts and their associated privilege levels configured in the authentication server. You can also use TACACS+ for even more granularity at the command level as shown in the following example: user = junior-engineer1 { password = clear "xxxxx" service = shell { set priv-lvl = 7 } }
Fix: F-3082r5_fix
Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0470
- Vuln IDs
-
- V-3058
- Rule IDs
-
- SV-3058r5_rule
Checks: C-3505r5_chk
Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device. If an unauthorized account is configured for access to the device, this is a finding.
Fix: F-3083r5_fix
Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.
- RMF Control
- Severity
- High
- CCI
- Version
- NET0600
- Vuln IDs
-
- V-3062
- Rule IDs
-
- SV-41449r2_rule
Checks: C-39960r6_chk
Review all Cisco IOS routers and switches to determine if the global command "service password-encryption" is present in the configurations. Also, review all accounts created on the device to ensure they have been setup using the "username name secret password" command. The following command will be found in the device configurations Device# show run ! service password-encryption ! username name secret 5 $1$geU5$vc/uDRS5dWiOrpQJTimBw/ enable secret 5 $1%mer9396y30d$FDA/292/
Fix: F-40534r1_fix
Configure the network element to ensure passwords are not viewable when displaying configuration information. Device(config)# service password Device(config)# username name secret S3cr3T! Device(config)# enable secret $MyS3cr3TPW$ Device(config)# end
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1638
- Vuln IDs
-
- V-3069
- Rule IDs
-
- SV-15451r4_rule
Checks: C-12916r6_chk
Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. -SSHv2 -SCP -HTTPS -SSL -TLS This is an example that enables SSHv2/SCP/HTTPS on an IOS Device: ! ip domain-name example.com ! crypto key generate rsa modulus 2048 ! ip ssh time-out 60 ip ssh authentication-retries 3 ip ssh source-interface GigabitEthernet 0/1 ip ssh version 2 ip ssh server algorithm mac hmac-sha1 hmac-sha1-96 ip ssh server algorithm encryption aes128-cbc aes192-cbc aes256-cbc ! line vty 0 15 transport input ssh ! ip scp server enable ! ip http secure-server If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.
Fix: F-3094r5_fix
Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET1640
- Vuln IDs
-
- V-3070
- Rule IDs
-
- SV-15455r3_rule
Checks: C-12920r3_chk
Review the router or switch configuration to ensure that all logon connection attempts are logged as shown in the following example: logging on login on-failure log every 1 login on-success log every 1 If all logon connection attempts are not logged, this is a finding.
Fix: F-3095r3_fix
Configure the device to log all access attempts to the device to establish a management connection for administrative access.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET1030
- Vuln IDs
-
- V-3072
- Rule IDs
-
- SV-3072r3_rule
Checks: C-3636r6_chk
Review the running and boot configurations to determine if they are synchronized. IOS Procedure: With online editing, the "show running-config" command will only show the current running configuration settings, which are different from the IOS defaults. The "show startup-config" command will show the NVRAM startup configuration. Compare the two configurations to ensure they are synchronized. JUNOS Procedure: This will never be a finding. The active configuration is stored on flash as juniper.conf. A candidate configuration allows configuration changes while in configuration mode without initiating operational changes. The router implements the candidate configuration when it is committed; thereby, making it the new active configuration--at which time it will be stored on flash as juniper.conf and the old juniper.conf will become juniper.conf.1. If running configuration and boot configurations are not the same, this is a finding.
Fix: F-3097r4_fix
Add procedures to the standard operating procedure to keep the running configuration synchronized with the startup configuration.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0720
- Vuln IDs
-
- V-3078
- Rule IDs
-
- SV-3078r3_rule
Checks: C-3551r5_chk
Review all Cisco device configurations to verify service udp-small-servers and service tcp-small-servers are not found. If TCP and UDP servers are not disabled, this is a finding. Note: The TCP and UDP small servers are enabled by default on Cisco IOS Software Version 11.2 and earlier. They are disabled by default on Cisco IOS Software Versions 11.3 and later.
Fix: F-3103r4_fix
Change the device configuration to include the following IOS commands: no service tcp-small-servers and no service udp-small-servers for each device running an IOS version prior to 12.0. This is the default for IOS versions 12.0 and later (i.e., these commands will not appear in the running configuration.)
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0730
- Vuln IDs
-
- V-3079
- Rule IDs
-
- SV-15305r2_rule
Checks: C-12701r2_chk
Review the device configuration. Beginning with IOS 12.1(5), finger is disabled by default. For IOS version 12.0 through 12.1(4), verify that the no ip finger command is present. For any version prior to 12.0, verify that the no service finger command is present.
Fix: F-3104r4_fix
Configure the device to disable the Finger service.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0760
- Vuln IDs
-
- V-3080
- Rule IDs
-
- SV-3080r4_rule
Checks: C-3574r8_chk
Review the device configuration to determine if the configuration auto-loading feature is disabled. If the configuration auto-loading feature is enabled when the device is connected to an operational network, this is a finding.
Fix: F-3105r6_fix
Disable the configuration auto-loading feature, when connected to an operational network.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0770
- Vuln IDs
-
- V-3081
- Rule IDs
-
- SV-15316r2_rule
Checks: C-12782r2_chk
Review the configuration to determine if source routing is enabled. The IOS command no ip source-route must be included in the configuration.
Fix: F-3106r2_fix
Configure the router to disable IP source routing.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0790
- Vuln IDs
-
- V-3083
- Rule IDs
-
- SV-3083r3_rule
Checks: C-3578r4_chk
IP directed broadcast is disabled by default in IOS version 12.0 and higher so the command "no ip directed-broadcast" will not be displayed in the running configuration--verify that the running configuration does not contain the command "ip directed-broadcast". For versions prior to 12.0 ensure the command "no ip directed-broadcast" is displayed in the running configuration. If IP directed broadcasts are enabled on layer 3 interfaces, this is a finding.
Fix: F-3108r4_fix
Disable IP directed broadcasts on all layer 3 interfaces.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0740
- Vuln IDs
-
- V-3085
- Rule IDs
-
- SV-41467r2_rule
Checks: C-39966r3_chk
Verify the command "ip http-server" is not enabled in the configuration (the HTTPS server may be enabled for administrative access). As of 12.4, the http server is disabled by default. However, since many defaults are not shown by IOS, you may not see the command "no ip http-server" in the configuration depending on the release. If the HTTP server is enabled, this is a finding.
Fix: F-3110r4_fix
Configure the device to disable using HTTP (port 80) for administrative access.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0750
- Vuln IDs
-
- V-3086
- Rule IDs
-
- SV-3086r3_rule
Checks: C-3573r7_chk
Review the device configuration to determine if BOOTP services are enabled. If BOOTP is enabled, this is a finding.
Fix: F-3111r6_fix
Configure the device to disable all BOOTP services.
- RMF Control
- Severity
- High
- CCI
- Version
- NET0240
- Vuln IDs
-
- V-3143
- Rule IDs
-
- SV-3143r4_rule
Checks: C-40236r3_chk
Review the network devices configuration to determine if the vendor default password is active. If any vendor default passwords are used on the device, this is a finding.
Fix: F-35391r3_fix
Remove any vendor default passwords from the network devices configuration.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0700
- Vuln IDs
-
- V-3160
- Rule IDs
-
- SV-15302r2_rule
Checks: C-12697r2_chk
Have the administrator enter the show version command to determine the installed IOS version. As of June 2010, the latest major release is 12.4 for routers and 12.2 for switches (both access and multi-layer). The release being used must have all IAVMs resolved and must not be in a Cisco deferred status or has been made obsolete. Ask the administrator login to the Cisco Software Center to download software. Select the specific router or switch model. Select the IOS Software link and then Verify that the release being used is listed under the release family (will need to expand the list) and not in the deferred list. If the release is not listed in either the release family or deferred, then the release is obsolete. Verify that all IAVMs have been addressed. Note: Cisco software in a differed state will still be at the Cisco Software Center and available for download under the deferred group, whereas software made obsolete is no longer available for download. Deferred status occurs when a software maintenance release is made obsolete and removed from order ability and service outside of Cisco's normal release schedule, or Cisco cancels a scheduled maintenance release from reaching the First-Customer-Ship (FCS) milestone. Deferrals are most often related to software quality issues. A deferral can be performed for an entire maintenance release, or just for certain sets of platforms or features within a release. A deferral prior to the FCS milestone may be performed by Cisco to protect customers from receiving software with known catastrophic defects. A deferral after FCS will expedite obsolescence for the release to limit the exposure of customers.
Fix: F-3185r4_fix
Update operating system to a supported version that addresses all related IAVMs.
- RMF Control
- Severity
- High
- CCI
- Version
- NET1636
- Vuln IDs
-
- V-3175
- Rule IDs
-
- SV-15448r4_rule
Checks: C-12913r8_chk
Review the network device configuration to verify all management connections for administrative access require authentication. aaa authentication login AUTH_LIST group tacacs+ local ! line vty 0 4 login authentication AUTH_LIST exec-timeout 10 0 transport input ssh Or using the default method list as shown in the example below. aaa authentication login default group tacacs+ local ! line vty 0 4 exec-timeout 10 0 transport input ssh
Fix: F-3200r3_fix
Configure authentication for all management connections.
- RMF Control
- Severity
- High
- CCI
- Version
- NET1660
- Vuln IDs
-
- V-3196
- Rule IDs
-
- SV-3196r4_rule
Checks: C-3820r6_chk
Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption. Downgrades: If the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II. If the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III. If the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model. If the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.
Fix: F-3221r5_fix
If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).
- RMF Control
- Severity
- High
- CCI
- Version
- NET1665
- Vuln IDs
-
- V-3210
- Rule IDs
-
- SV-3210r4_rule
Checks: C-3822r7_chk
Review the network devices configuration and verify if either of the SNMP community strings "public" or "private" is being used. If default or well-known community strings are used for SNMP, this is a finding.
Fix: F-3235r4_fix
Configure unique SNMP community strings replacing the default community strings.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0440
- Vuln IDs
-
- V-3966
- Rule IDs
-
- SV-15469r6_rule
Checks: C-12935r7_chk
Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one local account of last resort configured locally for an emergency. Verify the username and password for the local account of last resort is contained within a sealed envelope kept in a safe. If an authentication server is used and more than one local account exists, this is a finding.
Fix: F-3899r9_fix
Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1624
- Vuln IDs
-
- V-3967
- Rule IDs
-
- SV-15444r2_rule
Checks: C-12909r2_chk
Review the configuration and verify that a session using the console port will time out after 10 minutes or less of inactivity as shown in the following example: line con 0 exec-timeout 10 0
Fix: F-3900r4_fix
Configure the timeout for idle console connection to 10 minutes or less.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0894
- Vuln IDs
-
- V-3969
- Rule IDs
-
- SV-30086r3_rule
Checks: C-12800r7_chk
Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3. If write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the IAO, this is a finding. SNMP v1/v2c Configuration Example Device# show run ! ip access-list standard NMS_LIST permit 10.1.1.22 permit 10.1.1.24 ! snmp-server community c0macc3ss RO NMS_LIST snmp-server community R34dWr1t3 RW NMS_LIST snmp-server location Somewhere USA snmp-server contact snmp.admin@snmp.mil snmp-server enable traps snmp host 10.1.1.22 traps SNMPv1 snmp host 10.1.1.24 traps SNMPv2c SNMP v3 Configuration Example The example ACL NMS_LIST and ADMIN_LIST are used to define what network management stations and administrator (users) desktops can access the device. Examine all group statements to determine what groups are allowed write access. Have the administrator enter a "show snmp user" command and examine all users for these groups to verify that they must be authenticated. Device# show run ! ip access-list standard ADMIN_LIST permit 10.1.1.35 permit 10.1.1.36 ip access-list standard NMS_LIST permit 10.1.1.24 permit 10.1.1.22 permit 10.1.1.23 ! snmp-server group NOC v3 priv read VIEW_ALL write VIEW_LIMIT access NMS_LIST snmp-server group TRAP_GROUP v3 priv notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F snmp-server group ADMIN_GROUP v3 priv read VIEW_ALL write VIEW_ALL access ADMIN_LIST snmp-server view VIEW_ALL internet included snmp-server view VIEW_LIMIT internet included snmp-server view VIEW_LIMIT internet.6.3.15 excluded snmp-server view VIEW_LIMIT internet.6.3.16 excluded snmp-server view VIEW_LIMIT internet.6.3.18 excluded snmp-server enable traps snmp linkdown linkup snmp-server host 10.1.1.24 version 3 priv TRAP_NMS1 Note: For the configured group TRAP_GROUP, the notify view is auto-generated by the snmp-server host command which bind the user (TRAP_NMS1) and the group it belongs to (TRAP_GROUP) to the list of notifications (traps or informs) which are sent to the host. Hence, the configuration snmp-server group TRAP_GROUP v3 results in the following: snmp-server group TRAP_GROUP v3 priv notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F Note: Also, for illustration purpose only, the VIEW_LIMIT excludes MIB objects which could potentially reveal information about configured SNMP credentials. These objects are snmpUsmMIB, snmpVacmMIB, and snmpCommunityMIB which is configured as 1.3.6.1.6.3.15, 1.3.6.1.6.3.16, and 1.3.6.1.6.3.18 respectively SNMPv3 users are not shown in a running configuration. You can view them with the show "snmp user" command. So for example, if the following users were configured as such. snmp-server user HP_OV NOC v3 auth sha HPOVpswd priv aes 256 HPOVsecretkey snmp-server user Admin1 ADMIN_GROUP v3 auth sha Admin1PW priv aes 256 Admin1key snmp-server user Admin2 ADMIN_GROUP v3 auth md5 Admin2pass priv 3des Admin2key snmp-server user TRAP_NMS1 TRAP_GROUP v3 auth sha trap_nms1_pw priv aes trap_nms1_key The show snmp user command would depict the configured users as follows: Device#show snmp user User name: HP_OV Engine ID: AB12CD34EF56 storage-type: nonvolatile active Authentication Protocol: SHA Privacy Protocol: AES256 Group-name: NOC User name: Admin1 Engine ID: 800000090300C20013080000 storage-type: nonvolatile active Authentication Protocol: SHA Privacy Protocol: AES256 Group-name: ADMIN_GROUP User name: Admin2 Engine ID: 800000090300C20013080000 storage-type: nonvolatile active Authentication Protocol: MD5 Privacy Protocol: 3DES Group-name: ADMIN_GROUP User name: TRAP_NMS1 Engine ID: 800000090300C20013080000 storage-type: nonvolatile active Authentication Protocol: SHA Privacy Protocol: AES256 Group-name: TRAP_GROUP
Fix: F-3902r7_fix
Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-VLAN-004
- Vuln IDs
-
- V-3971
- Rule IDs
-
- SV-3971r2_rule
Checks: C-4028r3_chk
Review the device configuration and verify that access ports have not been assigned membership to the VLAN 1. If any access ports are found in VLAN 1, this is a finding.
Fix: F-3904r2_fix
Best practices for VLAN-based networks is to prune unnecessary ports from gaining access to VLAN 1 as well as the management VLAN, and to separate in-band management, device protocol, and data traffic.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET-VLAN-005
- Vuln IDs
-
- V-3972
- Rule IDs
-
- SV-3972r2_rule
Checks: C-4030r3_chk
Review the device configuration to determine if VLAN 1 is pruned from all trunk and access switch ports. If VLAN 1 is not pruned from trunk or access switch ports where it's not required, this is a finding.
Fix: F-3905r2_fix
Best practice for VLAN-based networks is to prune unnecessary ports from gaining access to VLAN 1 and insure that it does not traverse trunks not requiring VLAN 1 traffic.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET-VLAN-002
- Vuln IDs
-
- V-3973
- Rule IDs
-
- SV-3973r2_rule
Checks: C-4035r3_chk
Review the device configuration to determine if all disabled ports have been placed into an unused VLAN. The VLAN must not be VLAN 1. If disabled ports are not assigned to an unused VLAN or have been placed into VLAN 1, this is a finding.
Fix: F-3906r2_fix
Assign all disabled ports to an unused VLAN. Do not use VLAN1.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-VLAN-009
- Vuln IDs
-
- V-3984
- Rule IDs
-
- SV-3984r2_rule
Checks: C-4034r2_chk
Review the switch configurations and examine all access ports. Verify that they do not belong to the native VLAN. If any access switch ports are assigned to the native VLAN, it is a finding.
Fix: F-3917r2_fix
To insure the integrity of the trunk link and prevent unauthorized access, the native VLAN of the trunk port should be changed from the default VLAN 1 to its own unique VLAN. Access switchports must never be assigned to the native VLAN.
- RMF Control
- Severity
- High
- CCI
- Version
- NET1623
- Vuln IDs
-
- V-4582
- Rule IDs
-
- SV-19270r4_rule
Checks: C-20059r4_chk
Review the network device's configuration and verify authentication is required for console access. If the device is accessed via the aux port, then verify that this port also requires authentication. If it is not used, then it must be disabled. The console port and the disabled aux port should look similar to the configuration example below that references an authentication list configured as AUTH_LIST. aaa authentication login AUTH_LIST group tacacs+ local ! line con 0 login authentication AUTH_LIST exec-timeout 10 0 Or using the default method list as shown in the example below. aaa authentication login default group tacacs+ local ! line con 0 exec-timeout 10 0
Fix: F-4515r4_fix
Configure authentication for console access on the network device.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET1021
- Vuln IDs
-
- V-4584
- Rule IDs
-
- SV-15476r2_rule
Checks: C-12942r2_chk
Cisco IOS routers and switches use level 6 (informational) when logging packets that are dropped via access control list. (%SEC-6-IPACCESSLOGNP: list 1 denied 0 1.1.1.2 -> 1.1.1.1, 1 packet). Hence, it is imperative that log messages at level 6 are captured for further analysis and incident reporting. However, these messages do not need to go to the console, but must go to the syslog server. To avoid being locked out of the console in the event of an intensive log message generation such as when a large number of packets are being dropped, you can implement any of the following: 1. Limit the amount of logging based on same packet matching via the access-list log-update threshold command. The configured threshold specifies how often syslog messages are generated and sent after the initial packet match on a per flow basis. 2. Rate-limit messages at specific severity levels destined to be logged at the console via logging rate-limit command. 3. Have only messages at levels 0-5 (or 0-4) go to the console and messages at level 0-6 go to the syslog server. The buffer could be set to notification level or altered to a different level when required (i.e. debugging). Following would be an example configuration: ! logging buffered 4096 informational logging console notifications … ! logging trap debugging logging host 1.1.1.1 ! The default state for logging is on and the default for the syslog server is informational (i.e. logging trap informational). Hence, the commands logging on and logging trap informational will not be shown via show run command. Hence, have the operator issue a show logging command to verify logging is on and the level for the syslog server (i.e. trap). R1#show logging Syslog logging: enabled (12 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) … Console logging: level notifications, 56 messages logged, xml disabled, filtering disabled Monitor logging: level debugging, 0 messages logged, xml disabled, filtering disabled Buffer logging: level informational, 6 messages logged, xml disabled, filtering disabled … Trap logging: level informational, 73 message lines logged Logging to 1.1.1.1 (udp port 514, audit disabled, authentication disabled, encryption disabled, link up), 37 message lines logged, 0 message lines rate-limited, 0 message lines dropped-by-MD, xml disabled, sequence number disabled filtering disabled The table below lists the severity levels and message types for all log data. Severity Level Message Type 0 Emergencies 1 Alerts 2 Critical 3 Errors 4 Warning 5 Notifications 6 Informational 7 Debugging
Fix: F-4517r6_fix
Configure the network device to log all messages except debugging and send all log data to a syslog server.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1637
- Vuln IDs
-
- V-5611
- Rule IDs
-
- SV-15449r3_rule
Checks: C-12914r4_chk
Review the configuration and verify that management access to the device is allowed only from the management network address space. The configuration should look similar to the following: access-list 3 permit 192.168.1.10 log access-list 3 permit 192.168.1.11 log access-list 3 deny any log ….. line vty 0 4 access-class 3 in If management access can be gained from outside of the authorized management network, this is a finding.
Fix: F-5522r4_fix
Configure an ACL or filter to restrict management access to the device from only the management network.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1645
- Vuln IDs
-
- V-5612
- Rule IDs
-
- SV-15457r2_rule
Checks: C-12922r2_chk
Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period. ip ssh time-out 60
Fix: F-5523r5_fix
Configure the network devices so it will require a secure shell timeout of 60 seconds or less.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1646
- Vuln IDs
-
- V-5613
- Rule IDs
-
- SV-15458r2_rule
Checks: C-12923r2_chk
Review the configuration and verify the number of unsuccessful SSH login attempts is set at 3. ip ssh authentication-retries 3
Fix: F-5524r9_fix
Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0722
- Vuln IDs
-
- V-5614
- Rule IDs
-
- SV-5614r3_rule
Checks: C-3552r5_chk
Review the device configuration to determine if the PAD service is enabled. If the PAD service is enabled, this is a finding.
Fix: F-5525r5_fix
Configure the device to disable the PAD service.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0724
- Vuln IDs
-
- V-5615
- Rule IDs
-
- SV-5615r3_rule
Checks: C-3559r7_chk
Review the device configuration to verify the "service tcp-keepalives-in" command is configured. If TCP Keep-Alives are not enabled, this is a finding.
Fix: F-5526r7_fix
Configure the device to enable TCP Keep-Alives.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0726
- Vuln IDs
-
- V-5616
- Rule IDs
-
- SV-5616r3_rule
Checks: C-3562r5_chk
Review the device configuration to verify that identification support is not enabled via "ip identd" global command. It is disabled by default. If identifications support is enabled, this is a finding.
Fix: F-5527r5_fix
Configure the device to disable identification support.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0781
- Vuln IDs
-
- V-5618
- Rule IDs
-
- SV-5618r3_rule
Checks: C-3577r7_chk
Review the configuration to determine if gratuitous ARP is disabled. If gratuitous ARP is enabled, this is a finding.
Fix: F-5529r5_fix
Disable gratuitous ARP on the device.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-VLAN-008
- Vuln IDs
-
- V-5622
- Rule IDs
-
- SV-5622r2_rule
Checks: C-3770r3_chk
Review the device configuration and examine all trunk links. Verify the native VLAN has been configured to a VLAN other than the default VLAN 1. If the native VLAN has been configured to VLAN 1, this is a finding.
Fix: F-5533r2_fix
To ensure the integrity of the trunk link and prevent unauthorized access, the native VLAN of the trunk port should be changed from the default VLAN 1 to its own unique VLAN. The native VLAN must be the same on both ends of the trunk link; otherwise traffic could accidently leak between broadcast domains.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-VLAN-007
- Vuln IDs
-
- V-5623
- Rule IDs
-
- SV-5623r2_rule
Checks: C-58983r1_chk
Review the device configuration to determine if trunking has been disabled on access ports. If trunking is enabled on any access port, this is a finding.
Fix: F-5534r1_fix
Disable trunking on all access ports.
- RMF Control
- Severity
- High
- CCI
- Version
- NET-NAC-009
- Vuln IDs
-
- V-5626
- Rule IDs
-
- SV-42190r5_rule
Checks: C-40570r7_chk
Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms using the following procedure: Step 1: Verify that an 802.1x authentication server has been configured similar to the following example: radius-server host x.x.x.x auth-port 1813 key xxxxxxxxxxxxx aaa new-model aaa authentication dot1x default group radius Step 2: Verify 802.1x authentication has been enabled globally on the network device similar to the following example: dot1x system-auth-control Step 3: Verify that all host-facing access switchports are configured to use 802.1x similar to the examples below: interface fastethernet0/2 switchport mode access dot1x port-control auto Note: The “force-authorized” attribute must not be configured in leu of “auto” on the “dot1x port-control” command as this will bypass authentication and enable the switchport in an authorized state. Note: MAC Authentication Bypass (MAB) must be configured on those switch ports connected to devices that do not support an 802.1x supplicant as shown in the following example: interface fastethernet0/2 switchport mode access dot1x mac-auth-bypass If 802.1x authentication or MAB is not configured on all access switch ports connecting to LAN outlets or devices not located in the telecom room, wiring closets, or equipment rooms, this is a finding.
Fix: F-5537r5_fix
Configure 802.1 x authentication on all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. Configure MAB on those switch ports connected to devices that do not support an 802.1x supplicant.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-VLAN-006
- Vuln IDs
-
- V-5628
- Rule IDs
-
- SV-5628r2_rule
Checks: C-3767r3_chk
Review the device configurations to determine if a dedicated VLAN(s) have been implemented for the management network. VLAN 1 must not be used. If a dedicated VLAN or VLANs have not been established for the management network, this is a finding. If VLAN 1 is used for management, this is also a finding.
Fix: F-5539r2_fix
Best practices for VLAN-based networks is create a dedicated management VLAN, prune unnecessary ports from gaining access to VLAN 1 as well as the management VLAN, and to separate in-band management, device protocol, and data traffic.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0949
- Vuln IDs
-
- V-5645
- Rule IDs
-
- SV-5645r4_rule
Checks: C-3605r10_chk
Determine if the Cisco Layer 3 device supports the use of CEF switching mode. If the current IOS version available for the device does not support CEF in any capacity, this requirement will be NA. Most Cisco Layer 3 devices will support CEF in either Distributed or Central Mode. 1. If the device supports Distributed CEF Mode (dCEF), verify that it has been globally enabled. 2. If the device only supports Central CEF Mode (CEF), verify the function has been globally enabled. Many of the devices have CEF enabled by default and many of the configurations will not show if CEF functionality is enabled. To verify CEF is running on a Cisco Layer 3 device with IOS run the following command: router#show ip cef %CEF not running If CEF is shown to be not running, this is a finding.
Fix: F-5556r7_fix
1. If the Cisco Layer 3 IP device is not enabled by default, enable Distributed CEF Mode globally. Router(config)# ip cef distributed 2. If Distributed CEF Mode is not supported, enable Centralized CEF Mode globally. Router(config)# ip cef 3. If CEF is not supported in any capacity on the device, this finding is NA.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0965
- Vuln IDs
-
- V-5646
- Rule IDs
-
- SV-15435r4_rule
Checks: C-12900r6_chk
Review the device configuration to validate threshold filters or timeout periods are set for dropping excessive half-open TCP connections. For timeout periods, the time should be set to 10 seconds or less. If the device can not be configured for 10 seconds or less, it should be set to the least amount of time allowable in the configuration. Threshold filters will need to be determined by the organization for optimal filtering. IOS Configuration Example: ip tcp synwait-time 10
Fix: F-5557r6_fix
Configure the device to drop half-open TCP connections through threshold filtering or timeout periods.
- RMF Control
- Severity
- High
- CCI
- Version
- NET0425
- Vuln IDs
-
- V-7009
- Rule IDs
-
- SV-7363r3_rule
Checks: C-3496r6_chk
Review the running configuration to determine if key authentication has been defined with an infinite lifetime. If an infinite key has not been configured, this is a finding. OSPFv2 Example interface GigabitEthernet0/1 ip address 10.1.12.2 255.255.255.0 ip ospf authentication key-chain OSPF_KEY key chain OSPF_KEY key 1 key-string WWWWW send-lifetime 16:00:00 Feb 22 2017 16:00:00 Aug 22 2017 accept-lifetime 16:00:00 Feb 22 2017 16:00:00 Aug 22 2017 cryptographic-algorithm hmac-sha-256 key 2 key-string XXXXX send-lifetime 16:00:00 Aug 21 2017 16:00:00 Feb 20 2018 accept-lifetime 16:00:00 Aug 21 2017 16:00:00 Feb 20 2018 cryptographic-algorithm hmac-sha-256 key 99999 key-string YYYYY send-lifetime 15:59:00 Feb 20 2018 infinite accept-lifetime 15:59:00 Feb 20 2018 infinite cryptographic-algorithm hmac-sha-256 Notes: Note: Only Interior Gateway Protocols (IGPs) use key chains. Notes: When using authentication keys, it is imperative the site is in compliance with the NTP policies. The router has to know the time! Notes: Must make this a high number to ensure you have plenty of room to put keys in before it. All subsequent keys will be decremented by one (9998, 9997...).
Fix: F-6611r3_fix
This check is in place to ensure keys do not expire creating a DOS due to adjacencies being dropped and routes being aged out. The recommendation is to use two rotating six month keys with a third key set as infinite lifetime. The lifetime key should be changed 7 days after the rotating keys have expired and redefined.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET1629
- Vuln IDs
-
- V-7011
- Rule IDs
-
- SV-15446r2_rule
Checks: C-12911r2_chk
Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it. The following configuration disables the Cisco IOS auxiliary port: line aux 0 no exec Note: The command transport input none must be configured under the line aux 0. However, this is the default and will not be shown in the running configuration.
Fix: F-6614r3_fix
Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0422
- Vuln IDs
-
- V-14667
- Rule IDs
-
- SV-15301r4_rule
Checks: C-12696r5_chk
Review device configuration for key expirations of 180 days or less. If rotating keys are not configured to expire at 180 days or less, this is a finding.
Fix: F-14125r4_fix
Configure the device so rotating keys expire at 180 days or less.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0744
- Vuln IDs
-
- V-14669
- Rule IDs
-
- SV-15314r2_rule
Checks: C-12780r2_chk
Verify that the following BSDr global commands are not defined in the configuration: ip rcmd rcp-enable ip rcmd rsh-enable These commands have been disabled by default in IOS since version 12.0.
Fix: F-14130r4_fix
Configure the device to disable BSDr command services.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0813
- Vuln IDs
-
- V-14671
- Rule IDs
-
- SV-16089r4_rule
Checks: C-13749r4_chk
Review the network element configuration and verify that it is authenticating NTP messages received from the NTP server or peer using a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. Downgrade: If the network device is not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, then MD5 can be utilized for NTP message authentication and the finding can be downgraded to a CAT III. If the network element is not configured to authenticate received NTP messages using a FIPS-approved message authentication code algorithm, this is a finding. A downgrade can be determined based on the criteria above.
Fix: F-14132r4_fix
Configure the device to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0897
- Vuln IDs
-
- V-14672
- Rule IDs
-
- SV-16091r2_rule
Checks: C-13848r5_chk
Review the configuration and verify the loopback interface address is used as the source address when originating TACACS+ or RADIUS traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. Verify that a loopback address has been configured as shown in the following example: interface loopback 0 ip address 10.10.2.1 255.255.255.255 … ip tacacs source-interface Loopback0 ip radius source-interface Loopback0 Note: IOS allows multiple loopback interfaces to be defined.
Fix: F-14134r5_fix
Configure the device to use its loopback or OOB management interface address as the source address when originating authentication services traffic.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0898
- Vuln IDs
-
- V-14673
- Rule IDs
-
- SV-15340r2_rule
Checks: C-12806r2_chk
Review the configuration and verify the loopback interface address is used as the source address when originating syslog traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. The configuration should look similar as shown in the following example: interface loopback 0 ip address 10.10.2.1 255.255.255.255 … logging on logging host 192.168.1.100 logging source-interface Loopback0 Note: IOS allows multiple loopback interfaces to be defined.
Fix: F-14135r4_fix
Configure the device to use its loopback or OOB management interface address as the source address when originating syslog traffic.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0899
- Vuln IDs
-
- V-14674
- Rule IDs
-
- SV-15343r2_rule
Checks: C-12809r3_chk
Review the configuration and verify the loopback interface address is used as the source address when originating NTP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. The configuration should look similar as shown in the following example: interface loopback 0 ip address 10.10.2.1 255.255.255.255 … ntp server 129.237.32.2 ntp server 142.181.31.6 ntp source Loopback0 Note: IOS allows multiple loopback interfaces to be defined.
Fix: F-14136r4_fix
Configure the device to use its loopback or OOB management interface address as the source address when originating NTP traffic.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0900
- Vuln IDs
-
- V-14675
- Rule IDs
-
- SV-15346r2_rule
Checks: C-12812r2_chk
Review the configuration and verify the loopback interface address is used as the source address when originating SNMP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. The configuration should look similar as shown in the following example: interface loopback 0 ip address 10.10.2.1 255.255.255.255 … … snmp-server trap-source Loopback0 Note: IOS allows multiple loopback interfaces to be defined.
Fix: F-14137r4_fix
Configure the device to use its loopback or OOB management interface address as the source address when originating SNMP traffic.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0901
- Vuln IDs
-
- V-14676
- Rule IDs
-
- SV-15349r2_rule
Checks: C-12815r2_chk
Review the configuration and verify the loopback interface address is used as the source address when originating NetFlow traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. The configuration should look similar as shown in the following example: interface loopback 0 ip address 10.10.2.1 255.255.255.255 … … ip flow-sampling-mode packet-interval 100 ip flow-export destination 192.168.3.33 9991 ip flow-export source Loopback0 Note: IOS allows multiple loopback interfaces to be defined.
Fix: F-14138r2_fix
Configure the router to use its loopback or OOB management interface address as the source address when originating NetFlow traffic.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0902
- Vuln IDs
-
- V-14677
- Rule IDs
-
- SV-15352r3_rule
Checks: C-12819r6_chk
Review the configuration and verify a loopback interface address is used as the source address when originating TFTP or FTP traffic. Router# show run Building configuration... ! ! interface Loopback0 description Loopback interface ip address x.x.x.x 255.255.255.255 no ip directed-broadcast ! ... ip telnet source-interface Loopback0 ip tftp source-interface Loopback0 ip ftp source-interface Loopback0 If the device is managed from an OOB management network, the OOB interface must be used instead. Router# show run Building configuration... ! ... ip tftp source-interface fe0/0 ip ftp source-interface fe0/0
Fix: F-40461r1_fix
Configure the network device to use a loopback interface address as the source address when originating TFTP or FTP traffic. Example: Router(config)# interface loopback 0 Router(config-if)# ip address x.x.x.x 255.255.255.255 Router(config)# ip ftp source-interface loopback0 Router(config)# ip tftp source-interface loopback0 If an OOB management interface is being used, configure the interface for TFTP or FTP traffic origination. Example: Router(config)# ip ftp source-interface fe0/0 Router(config)# ip tftp source-interface fe0/0
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0903
- Vuln IDs
-
- V-14681
- Rule IDs
-
- SV-15359r2_rule
Checks: C-12826r2_chk
Verify that the peering session with iBGP neighbors use the loopback address as the source address as shown in the example below: interface loopback 0 ip address 10.10.2.1 255.255.255.255 … router bgp 100 neighbor 200.200.200.2 remote-as 200 neighbor 188.20.120.2 remote-as 144 neighbor 10.10.2.2 remote-as 100 neighbor 10.10.2.2 update-source Loopback0 neighbor 10.10.2.3 remote-as 100 neighbor 10.10.2.3 update-source Loopback0
Fix: F-14148r3_fix
Configure the network device's loopback address as the source address for iBGP peering.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-IPV6-025
- Vuln IDs
-
- V-14693
- Rule IDs
-
- SV-15397r2_rule
Checks: C-12864r2_chk
Review the device configuration to ensure FEC0::/10 IP addresses are not defined. If FEC0::/10 IP addresses are defined, this is a finding.
Fix: F-14158r1_fix
Configure the device using authorized IP addresses.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-IPV6-033
- Vuln IDs
-
- V-14705
- Rule IDs
-
- SV-15425r1_rule
Checks: C-12892r1_chk
IOS Procedure: Review all Cisco routers to ensure that CEF has been enabled. The configuration should look similar to the following: ipv6 cef
Fix: F-14170r1_fix
The IAO will ensure that the ipv6 cef command has been configured on Cisco routers.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-IPV6-034
- Vuln IDs
-
- V-14707
- Rule IDs
-
- SV-15429r1_rule
Checks: C-12894r1_chk
Unicast Strict mode: Review the router configuration to ensure uRPF has been configured on all internal interfaces.
Fix: F-14172r1_fix
The network element must be configured to ensure that an ACL is configured to restrict the router from accepting any outbound IP packet that contains an external IP address in the source field.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1647
- Vuln IDs
-
- V-14717
- Rule IDs
-
- SV-15460r2_rule
Checks: C-12925r2_chk
If SSH is used for administrative access, then Version 2 must be configured as shown in the following example: ip ssh version 2
Fix: F-14184r5_fix
Configure the network device to use SSH version 2.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-TUNL-017
- Vuln IDs
-
- V-15288
- Rule IDs
-
- SV-16068r2_rule
Checks: C-13687r4_chk
Verify ISATAP tunnels are terminated on the infrastructure routers or L3 switches within the enclave. Example configuration of an ISATAP tunnel endpoint: interface tunnel 1 no ip address no ip redirects tunnel source ethernet 1 tunnel mode ipv6ip isatap ipv6 address 2001:0DB8::/64 eui-64 no ipv6 nd suppress-ra
Fix: F-14730r6_fix
Terminate ISATAP tunnels at the infrastructure router to prohibit tunneled traffic from exiting the enclave perimeter prior to inspection by the IDS, IPS, or firewall.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0433
- Vuln IDs
-
- V-15432
- Rule IDs
-
- SV-16259r4_rule
Checks: C-14439r6_chk
Verify an authentication server is required to access the device and that there are two or more authentication servers defined. If the device is not configured for two separate authentication servers, this is a finding.
Fix: F-15096r3_fix
Configure the device to use two separate authentication servers.
- RMF Control
- Severity
- High
- CCI
- Version
- NET0441
- Vuln IDs
-
- V-15434
- Rule IDs
-
- SV-16261r5_rule
Checks: C-14441r6_chk
Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online. If the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.
Fix: F-15098r7_fix
Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1807
- Vuln IDs
-
- V-17754
- Rule IDs
-
- SV-18945r2_rule
Checks: C-19015r3_chk
Review the device configuration to determine if IPSec tunnels used in transiting management traffic are filtered to only accept authorized traffic based on source and destination IP addresses of the management network. If filters are not restricting only authorized management traffic into the IPSec tunnel, this is a finding.
Fix: F-17652r2_fix
Configure filters based on source and destination IP address to restrict only authorized management traffic into IPSec tunnels used for transiting management data.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1808
- Vuln IDs
-
- V-17814
- Rule IDs
-
- SV-19063r1_rule
Checks: C-19020r1_chk
Verify the configuration at the remote VPN end-point is a mirror configuration as that reviewed for the local end-point.
Fix: F-17724r1_fix
Configure he crypto access-list used to identify the traffic to be protected so that it is a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0985
- Vuln IDs
-
- V-17815
- Rule IDs
-
- SV-19297r1_rule
Checks: C-20142r1_chk
Verify that the OOBM interface is an adjacency only in the IGP routing domain for the management network. The following would be an example where EIGRP is run on the management network 10.0.0.0 and OSPF in the managed network 172.20.0.0. The network 10.1.20.0/24 is the OOBM backbone and 10.1.1.0 is the local management LAN connecting to the OOBM interfaces of the managed network (i.e., the private and service network) elements. interface Serial0/0 description to_OOBM_Backbone ip address 10.1.20.3 255.255.255.0 interface Fastethernet 0/0 description Enclave_Management_LAN ip address 10.1.1.1 255.255.255.0 interface Fastethernet 0/1 description to_our_PrivateNet ip address 172.20.4.2 255.255.255.0 interface Fastethernet 0/2 description to_our_ServiceNet ip address 172.20.5.2 255.255.255.0 ! router ospf 1 network 172.20.0.0 ! router eigrp 12 network 10.0.0.0 passive-interface Fastethernet 0/1 Note: the passive-interface command is configured to avoid building an EIGRP adjacency with a managed router, while at the same time, enabling EIGRP to advertise the enclave’s management subnet to the EIGRP neighbors of the management network backbone. If the non-dedicated OOBM gateway and the NOC gateway are not connected by an OOB backbone—that is, connectivity is provided over an IP backbone (i.e. NIPRNet)—and an IGP is used to advertise routes within the management network, the IGP traffic must be encapsulated via GRE so that it can traverse the IPsec tunnel. The configuration below is an example of GRE over IPSec. The IPSec policy is applied to the GRE traffic that will encapsulate IGP packets (notice the EIGRP network statement includes the GRE tunnel; hence, EIGRP will form adjacencies with neighbors on the other side of this tunnel. Premise Router Configuration crypto isakmp policy 10 authentication pre-share crypto isakmp key ourkey address 166.4.24.3 ! crypto ipsec transform-set VPN-trans esp-3des esp-md5-hmac ! crypto map vpnmap 10 ipsec-isakmp set peer 166.4.24.3 set transform-set VPN-trans match address 102 ! interface Ethernet1 ip address 10.1.1.1 255.255.255.0 ! interface Serial1/0 ip address 141.22.4.3 255.255.255.252 ! interface Tunnel0 ip address 10.10.255.1 255.255.255.252 ip mtu 1400 tunnel source Serial0/0 tunnel destination 166.4.24.3 crypto map vpnmap ! router eigrp 100 network 10.0.0.0 0.0.0.255 no auto-summary ! ip route 0.0.0.0 0.0.0.0 141.22.4.1 ! access-list 102 permit gre host 141.22.4.3 host 166.4.24.3 OOBM VPN Gateway Configuration crypto isakmp policy 10 authentication pre-share crypto isakmp key ourkey address 141.22.4.3 ! crypto ipsectransform-set VPN-trans esp-3des esp-md5-hmac ! crypto map vpnmap 10 ipsec-isakmp set peer 141.22.4.3 set transform-set VPN-trans match address 102 ! interface Ethernet1 ip address 10.1.2.1 255.255.255.0 ! interface Serial1/0 ip address 166.4.24.3 255.255.255.252 ! interface Tunnel0 ip address 10.10.255.2 255.255.255.252 ip mtu 1400 tunnel source Serial0/0 tunnel destination 141.22.4.3 crypto map vpnmap ! router eigrp 100 network 10.0.0.0 0.0.0.255 no auto-summary ! ip route 0.0.0.0 0.0.0.0 166.4.24.1 ! access-list 102 permit gre host 166.4.24.3 host 141.22.4.3
Fix: F-17730r1_fix
Ensure that multiple IGP instances configured on the OOBM gateway router peer only with their appropriate routing domain. Verify that the all interfaces are configured for the appropriate IGP instance.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0986
- Vuln IDs
-
- V-17816
- Rule IDs
-
- SV-19299r1_rule
Checks: C-20200r1_chk
Verify that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa. Route advertisements between two the two routing domains such as OSPF and EIGRP can only be shared via redistribution. Verify that there are no redistribute commands configured under IGP domain for the management network that would enable distributing routes from the IGP domain of the managed network, or vice-versa. The following would be an example of redistributing routes from EIGRP into OSPF. router ospf 1 network 172.20.0.0 redistribute eigrp 12 IOS supports multiple instances of OSPF and EIGRP that are configured using a different process ID. Each EIGRP or OSPF process will run only on the interfaces of the networks specified. Each EIGRP process maintains a separate topology database; likewise, each OSPF process maintains a separate link-state database. Route advertisements between two processes can only be shared via redistribution. Verify that there are no redistribution commands that would distribute routes from the IGP routing domain for the management network into the IGP routing domain of the managed network, or vice-versa. The following would be an example of redistributing routes from one EIGRP into another EIGRP. ! router eigrp 15 network 172.20.0.0 ! router eigrp 10 network 10.0.0.0 redistribute eigrp 15 As an alternative, static routes can be used to forward management traffic to the OOBM interface; however, this method may not scale well. If static routes are used to forward management traffic to the OOB backbone network, verify that the OOBM interface is not an IGP adjacency and that the correct destination prefix has been configured to forward the management traffic to the correct next-hop and interface for the static route. In the following configuration examples, 10.1.1.0/24 is the management network and 10.1.20.4 is the interface address of the OOB backbone router that the OOB gateway router connects to. The network 10.1.20.0/24 is the OOBM backbone. interface Serial0/0 description to_OOBM_Backbone ip address 10.1.20.3 255.255.255.0 interface Fastethernet 0/0 description to_our_PrivateNet ip address 172.20.4.2 255.255.255.0 interface Fastethernet 0/1 description to_our_ServiceNet ip address 172.20.5.2 255.255.255.0 ! router ospf 1 network 172.20.0.0 ! ip route 10.1.1.0 255.255.255.0 10.1.20.4 Serial0/0
Fix: F-17731r1_fix
Ensure that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0987
- Vuln IDs
-
- V-17817
- Rule IDs
-
- SV-19301r2_rule
Checks: C-20202r1_chk
Review the ACL or filters for the router’s receive path and verify that only traffic sourced from the management network is allowed to access the router. This would include both management and control plane traffic. Step 1: Verify that the global ip receive acl statement has been configured as shown in the following example: ip receive acl 199 Note: The IOS IP Receive ACL feature provides filtering capability for traffic that is destined for the router. The IP Receive ACL filtering occurs after any input ACL bound to the ingress interface. On distributed platforms (i.e., 12000 series), the IP receive ACL filters traffic on the distributed line cards before packets are received by the route processor; thereby preventing the flood from degrading the performance of the route processor. Step 2: Determine the address block of the management network at the NOC. In the example configuration below, the 10.2.2.0/24 is the management network at the NOC. Step 3: Verify that the ACL referenced by the ip receive acl statement restricts all management plane traffic to the validated network management address block at the NOC. Management traffic can include telnet, SSH, SNMP, TACACS, RADIUS, TFTP, FTP, and ICMP. Control plane traffic from OOBM backbone neighbors should also be allowed to access the router. The ACL configuration should look similar to the following: access-list 199 deny ip any any fragments access-list 199 permit ospf 10.1.20.0 0.0.0.255 any access-list 199 permit tcp 10.2.2.0 0.0.0.255 any eq ssh access-list 199 permit udp host 10.2.2.24 any eq snmp access-list 199 permit udp host 10.2.2.25 any eq snmp access-list 199 permit udp host 10.2.2.26 any eq ntp access-list 199 permit udp host 10.2.2.27 any eq ntp access-list 199 permit tcp host 10.2.2.30 eq tacacs any gt 1023 established access-list 199 permit tcp host 10.2.2.77 eq ftp any gt 1023 established access-list 199 permit tcp host 10.2.2.77 gt 1024 any eq ftp-data access-list 199 permit icmp 10.2.2.0 0.0.0.255 any access-list 199 deny ip any any log In the example above, the OSPF neighbors would be adjacencies with the OOBM backbone network 10.1.20.0/24. If the platform does not support the receive path filter, then verify that all non-OOBM interfaces have an ingress ACL to restrict access to that interface address or any of the router’s loopback addresses to only traffic sourced from the management network. Exception would be to allow packets destined to these interfaces used for troubleshooting such as ping and traceroute.
Fix: F-17732r1_fix
Ensure that traffic from the managed network is not able to access the OOBM gateway router using either receive path or interface ingress ACLs.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0988
- Vuln IDs
-
- V-17818
- Rule IDs
-
- SV-19303r1_rule
Checks: C-20204r1_chk
Examine the egress filter on the OOBM interface of the gateway router to verify that only traffic sourced from the management address space is allowed to transit the OOBM backbone. In the example configurations below, the 10.1.1.0/24 is the management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC. IOS interface Serial0/0 description to_OOBM_Backbone ip address 10.1.20.3 255.255.255.0 ip access-group 101 out interface Fastethernet 0/0 description Enclave_Management_LAN ip address 10.1.1.1 255.255.255.0 interface Fastethernet 0/1 description to_our_ServiceNet ip address 172.20.5.2 255.255.255.0 ! access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 access-list 101 deny ip any any log
Fix: F-17733r1_fix
Configure the OOBM gateway router interface ACLs to ensure traffic from the managed network does not leak into the management network.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0989
- Vuln IDs
-
- V-17819
- Rule IDs
-
- SV-19305r1_rule
Checks: C-20206r1_chk
Examine the ingress filter on the OOBM interface of the gateway router to verify that traffic is only destined to the local management address space. In the example configurations below, the 10.1.1.0/24 is the local management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC. IOS interface Serial0/0 description to_OOBM_Backbone ip address 10.1.20.3 255.255.255.0 ip access-group 100 in ip access-group 101 out interface Fastethernet 0/0 description Enclave_Management_LAN ip address 10.1.1.2 255.255.255.0 interface Fastethernet 0/1 description to_our_ServiceNet ip address 172.20.5.2 255.255.255.0 interface Fastethernet 0/2 description to_our_PrivateNet ip address 172.20.4.2 255.255.255.0 ! access-list 100 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255 access-list 100 deny ip any any log
Fix: F-17734r2_fix
Configure access control lists or filters to block any traffic from the management network destined for the managed network's production address spaces.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0991
- Vuln IDs
-
- V-17821
- Rule IDs
-
- SV-20205r2_rule
Checks: C-22335r2_chk
After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify that the interface has been assigned an address from the local management address block. In this example, that is 10.1.1.0/24. Cisco router interface Fastethernet 0/0 description Enclave_Management_LAN ip address 10.1.1.22 255.255.255.0 Cisco Catalyst MLS Switch interface VLAN 101 description Management_VLAN ip address 10.1.1.22 255.255.255.0 … … interface FastEthernet1/6 switchport access vlan 101 switchport mode access or interface FastEthernet1/6 no switchport ip address 10.1.1.22 255.255.255.0 Caveat: If the interface is configured as a routed interface as shown in the above configuration, the requirements specified in NOC180 must be implemented.
Fix: F-17736r2_fix
Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0992
- Vuln IDs
-
- V-17822
- Rule IDs
-
- SV-20208r1_rule
Checks: C-22338r1_chk
Step 1: Verify that the managed interface has an inbound and outbound ACL configured as shown in the following example: interface FastEthernet1/1 description Enclave_Management_LAN ip address 10.1.1.22 255.255.255.0 ip access-group 100 in ip access-group 101 out Step 2: Verify that the ingress ACL blocks all transit traffic—that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. In the example the management network at the NOC is 10.2.2.0/24. access-list 100 permit ip 10.2.2.0 0.0.0.255 host 10.1.1.22 access-list 100 deny ip any any log Note that the destination used by any host within the management network to access the managed elements must be via the management interface. The loopback should not be a valid address since these prefixes would not be advertised into the management network IGP domain. This could only be possible if the managed network Elements: had an IGP adjacency with the managed network, which should not be the case. Step 3: Verify that the egress ACL blocks any traffic not originated by the managed element access-list 101 deny ip any any log Cisco router-generated packets are not inspected by outgoing access-lists. Hence, the above configuration would simply drop any packets not generated by the router itself and allow all local traffic. To filter local traffic, IOS provides a feature called local policy routing, which enables the administrator to apply a route-map to any local router-generated traffic. To prohibit outgoing traffic from the local router to any destination other than the NOC, the a configuration such as the following could be used: ! Do not drop traffic destined to 10.2.2.0/24. Hence, do not include it in ! the local policy route map, but include all other destinations. ! ip access-list extended BLOCK_INVALID_DEST deny ip any 10.2.2.0 0.0.0.255 permit ip any any ! route-map LOCAL_POLICY 10 match ip address BLOCK_INVALID_DEST set interface Null 0 ! ip local policy route-map LOCAL_POLICY Alternative Solution: The IOS Management Plane Protection Feature Cisco introduced the Management Plane Protection (MPP) feature with IOS 12.4(6)T which allows any physical in-band interface to be dedicated for OOB management. The MPP feature allows a network operator to designate one or more router interfaces as management interfaces. Management traffic is permitted to enter a device only through these management interfaces. All of the other in-band interfaces not enabled for MPP will automatically drop all ingress packets associated with any of the supported MPP protocols (FTP, HTTP, HTTPS, SCP, SSH, SNMP, Telnet, and TFTP). Hence, after MPP is enabled, no interfaces except management interfaces will accept network management traffic destined to the device. This feature also provides the capability to restrict which management protocols are allowed. This feature does not change the behavior of the console, auxiliary, and management Ethernet interfaces. The following configuration example depicts FastEthernet1/1 as being the designated management interface that will only allow ssh and snmp traffic. control-plane host management-interface FastEthernet1/1 allow ssh snmp ! interface FastEthernet1/1 description Enclave_Management_LAN ip address 10.1.1.22 255.255.255.0
Fix: F-17737r2_fix
If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0993
- Vuln IDs
-
- V-17823
- Rule IDs
-
- SV-19334r2_rule
Checks: C-20313r4_chk
If the managed network element is a layer 3 device, review the configuration to verify the management interface is configured as passive for the IGP instance for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration. The following configuration would be an example where OSPF is only enabled on all interfaces except the management interface: interface Fastethernet 0/0 description Enclave_Management_LAN ip address 10.1.1.22 255.255.255.0 ip access-group 100 in ip access-group 101 out interface Fastethernet 0/1 description to_our_PrivateNet ip address 172.20.4.2 255.255.255.0 interface Fastethernet 0/2 description to_our_ServiceNet ip address 172.20.5.2 255.255.255.0 interface Fastethernet 1/1 description to_our_DMZ ip address 172.20.3.1 255.255.255.0 ! router ospf 1 network 172.20.0.0 255.255.255.0 area 1 Note: The MPP feature has no effect on control plane traffic. Hence, the routing protocol must still be configured so that it is not enabled on the management interface.
Fix: F-17738r2_fix
Configure the management interface as passive for the IGP instance configured for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0994
- Vuln IDs
-
- V-17824
- Rule IDs
-
- SV-19337r1_rule
Checks: C-20316r1_chk
Review the managed switch configuration and verify that the access port connected to the OOBM access switch has been assigned to the management VLAN. By default, the management VLAN is VLAN 1; however, the management VLAN must be configured to a different VLAN. As shown in the following configuration example, FastEthernet0/1 is the port connected to the OOBM access switch and VLAN 101 is the management VLAN. interface FastEthernet0/1 switchport access vlan 10 switchport mode access ! interface FastEthernet0/2 switchport access vlan 2 switchport mode access ! interface FastEthernet0/3 switchport access vlan 2 switchport mode access ! interface FastEthernet0/4 switchport access vlan 2 switchport mode access This can also be verified by entering a Privileged EXEC show vlan command on the switch CLI as illustrated in the following example output of a Cisco 2950: 2950#show vlan VLAN Name Status Ports ---- ------------------------ --------- ------------------------------- 2 Production active Fa0/2, Fa0/3, Fa0/4, Fa0/5, ... Fa0/21, Fa0/22, Fa0/23, Fa0/24 10 Management active Fa0/1
Fix: F-17739r1_fix
If the management interface is an access switchport, assign it to a separate management VLAN while the remainder of the access switchports can be assigned to user VLANs belonging to the managed network. This provides some level of separation between the management network and the managed network.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0995
- Vuln IDs
-
- V-17825
- Rule IDs
-
- SV-19338r1_rule
Checks: C-20317r1_chk
Review the managed switch configuration and verify that an address has been configured for management VLAN from space belonging to the OOBM network that has been assigned to that site. interface VLAN10 ip address 10.1.1.10 255.255.255.0 description Management VLAN Note: The IP address of the switch can be accessed only by nodes connected to ports that belong to the management VLAN. A default gateway address as shown below must be configured using the address of the OOBM gateway router interface connecting to the OOBM access switch. This will ensure that all management traffic is forwarded toward the NOC using the switchport attached to the OOBM access switch. ip default-gateway 10.1.1.1
Fix: F-17740r1_fix
Assign an IP address to the management VLAN from the address space belonging to the OOBM network.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0996
- Vuln IDs
-
- V-17826
- Rule IDs
-
- SV-19339r1_rule
Checks: C-20318r1_chk
The management VLAN must be pruned from any VLAN trunk links belonging to the managed network’s infrastructure. By default all the VLANs that exist on a switch are active on a trunk link. Since the switch is being managed via OOBM connection, management traffic should not traverse any trunk links. The following Catalyst IOS configuration is an example of a trunk link with the management VLAN (i.e. 10) pruned from a trunk. interface fastEthernet0/1 switchport trunk encapsulation dot1q switchport mode dynamic desirable switchport trunk native vlan 3 switchport trunk allowed vlan 2-9 This can also be verified with the show interface trunk command as shown below: Switch-A# show interface trunk Port Mode Encapsulation Status Native vlan Fa0/1 desirable 802.1q trunking 3 Port Vlans allowed on trunk Fa0/1 2-9 Port Vlans in spanning tree forwarding state and not pruned Fa0/1 2-5 Note: VTP pruning allows the switch to not forward user traffic for VLANs that are not active on a remote switch. This feature dynamically prunes unneeded traffic across trunk links. VTP pruning needs to be enabled on the server for the VTP domains—after which all VTP clients in the VTP domain will automatically enable VTP pruning. To enable VTP pruning on a Cisco IOS switch, you use the vtp pruning VLAN configuration or global configuration command. Since, the management VLAN will be active on all managed switchs, VTP will never prune this VLAN. Hence, it will have to be manually removed as shown above.
Fix: F-17741r1_fix
Ensure that the access switchport connecting to the OOBM access switch is the only port with membership to the management VLAN
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0997
- Vuln IDs
-
- V-17827
- Rule IDs
-
- SV-19340r1_rule
Checks: C-20319r1_chk
The management VLAN must be pruned from any VLAN trunk links belonging to the managed network’s infrastructure. By default all the VLANs that exist on a switch are active on a trunk link. Since the switch is being managed via OOBM connection, management traffic should not traverse any trunk links. The following Catalyst IOS configuration is an example of a trunk link with the management VLAN (i.e. 10) pruned from a trunk. interface fastEthernet0/1 switchport trunk encapsulation dot1q switchport mode dynamic desirable switchport trunk native vlan 3 switchport trunk allowed vlan 2-9 This can also be verified with the show interface trunk command as shown below: Switch-A# show interface trunk Port Mode Encapsulation Status Native vlan Fa0/1 desirable 802.1q trunking 3 Port Vlans allowed on trunk Fa0/1 2-9 Port Vlans in spanning tree forwarding state and not pruned Fa0/1 2-5 Note: VTP pruning allows the switch to not forward user traffic for VLANs that are not active on a remote switch. This feature dynamically prunes unneeded traffic across trunk links. VTP pruning needs to be enabled on the server for the VTP domains—after which all VTP clients in the VTP domain will automatically enable VTP pruning. To enable VTP pruning on a Cisco IOS switch, you use the vtp pruning VLAN configuration or global configuration command. Since, the management VLAN will be active on all managed switchs, VTP will never prune this VLAN. Hence, it will have to be manually removed as shown above.
Fix: F-17744r1_fix
Prune the management VLAN from any VLAN trunk links belonging to the managed network’s infrastructure.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1003
- Vuln IDs
-
- V-17832
- Rule IDs
-
- SV-19702r1_rule
Checks: C-20816r1_chk
Review the switch configuration and verify that the management VLAN has been assigned an IP address from the management network address block. Following is an example for a Cisco Catalyst switch: interface VLAN 10 description Management VLAN ip address 10.1.1.10 255.255.255.0 Note: The IP address of the switch can be accessed only by nodes connected to ports that belong to the management VLAN.
Fix: F-17749r1_fix
Configure the management VLAN with an IP address from the management network address block.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1004
- Vuln IDs
-
- V-17833
- Rule IDs
-
- SV-19703r2_rule
Checks: C-19250r3_chk
Review the configuration to determine if an inbound ACL has been configured for the management VLAN interface to block non-management traffic. If an inbound ACL has not been configured, this is a finding.
Fix: F-17750r1_fix
If an MLS is used to provide inter-VLAN routing, configure an inbound ACL for the management network VLAN interface.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1005
- Vuln IDs
-
- V-17834
- Rule IDs
-
- SV-19308r1_rule
Checks: C-20257r1_chk
Review the router configuration and verify that an inbound ACL has been configured for the management network sub-interface as illustrated in the following example configuration: IOS interface GigabitEthernet3 no ip redirects no ip directed-broadcast interface GigabitEthernet3.10 encapsulation dot1q 10 description Management VLAN ip address 10.1.1.1 255.255.255.0 ip access-group 108 in ! access-list 108 permit …
Fix: F-17751r1_fix
If a router is used to provide inter-VLAN routing, configure an inbound ACL for the management network sub-interface for the trunk link to block non-management traffic.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET1006
- Vuln IDs
-
- V-17835
- Rule IDs
-
- SV-19310r1_rule
Checks: C-20259r1_chk
Verify that all traffic from the managed network to the management network and vice-versa is secured via IPSec encapsulation. In the configuration examples, 10.2.2.0/24 is the management network at the NOC and 192.168.1.0/24 is address space used at the network being managed (i.e., the enclave). For Cisco router, the access-list referenced by the crypto map must have the source and destination addresses belonging to the management network address space at the enclave and NOC respectively. hostname Premrouter ! interface Serial1/0 ip address 19.16.1.1 255.255.255.0 description NIPRNet_Link crypto map myvpn interface Fastethernet 0/0 description Enclave_Management_LAN ip address 192.168.1.1 255.255.255.0 ! crypto isakmp policy 1 authentication pre-share lifetime 84600 crypto isakmp key ******* address 19.16.2.1 ! crypto ipsec transform-set toNOC esp-des esp-md5-hmac ! crypto map myvpn 10 ipsec-isakmp set peer 19.16.2.1 set transform-set toNOC match address 101 ! access-list 101 permit ip any 10.2.2.0 0.0.0.255
Fix: F-17752r1_fix
Where IPSec technology is deployed to connect the managed network to the NOC, it is imperative that the traffic entering the tunnels is restricted to only the authorized management packets based on destination address.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET1007
- Vuln IDs
-
- V-17836
- Rule IDs
-
- SV-19313r1_rule
Checks: C-20262r1_chk
class-map match-all MANAGEMENT-TRAFFIC match access-group name CLASSIFY-MANAGEMENT-TRAFFIC ! policy-map DIST-LAYER-POLICY class MANAGEMENT-TRAFFIC set ip dscp 48 ! interface FastEthernet0/0 description link to LAN1 ip address 192.168.1.1 255.255.255.0 service-policy input DIST-LAYER-POLICY interface FastEthernet0/1 description link to LAN2 ip address 192.168.2.1 255.255.255.0 service-policy input DIST-LAYER-POLICY interface FastEthernet0/2 description link to core ip address 192.168.13.1 255.255.255.0 ! ip access-list extended CLASSIFY-MANAGEMENT-TRAFFIC permit ip any 10.2.2.0 0.0.0.255 Note: Traffic is marked using the set command in a policy map. For DSCP rewrite, if a packet encounters both input and output classification policy, the output policy has precedence. If there is no output policy, then the input policy has precedence.
Fix: F-17756r1_fix
When management traffic must traverse several nodes to reach the management network, classify and mark management traffic at the nearest upstream MLS or router.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET1008
- Vuln IDs
-
- V-17837
- Rule IDs
-
- SV-19315r1_rule
Checks: C-20264r1_chk
When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic. This will ensure that management traffic receives guaranteed bandwidth at each forwarding device along the path to the management network. Step 1: Verify that a service policy is bound to all core or internal router interfaces as shown in the configuration below: interface FastEthernet0/1 ip address 192.168.2.1 255.255.255.0 service-policy output QoS-Policy interface FastEthernet0/2 ip address 192.168.1.1 255.255.255.0 service-policy output QoS-Policy Step 2: Verify that the class-maps place management traffic in the appropriate forwarding class as shown in the example below: class-map match-all best-effort match ip dscp 0 class-map match-any data-AF13-AF23 match ip dscp 14 match ip dscp 22 class-map match-any video-AF33-AF43 match ip dscp 30 match ip dscp 38 class-map match-all voice-EF match ip dscp 46 class-map match-all network-control match ip dscp 48 Step 3: Verify that the classes are receiving the required service. policy-map QoS-Policy class best-effort bandwidth percent 10 random-detect dscp-based class data-AF13-AF23 bandwidth percent 30 random-detect dscp-based class video-AF33 bandwidth percent 15 random-detect dscp-based class video-AF43 bandwidth percent 20 random-detect dscp-based class voice-EF priority percent 20 class network-control bandwidth percent 5 random-detect dscp-based Note 1: The dscp-based argument enables WRED to use the DSCP value of a packet when it calculates the drop probability for the packet; whereas if the prec-based argument is specified, WRED will use the IP Precedence value to calculate drop probability. If neither is specified, the default is prec-based. Note 2: LLQ is enabled with the priority command using either a kbps value or a bandwidth percentage using the percent keyword followed by a percentage value. Note 3: Traffic that does not meet the match criteria specified in the forwarding classes is treated as belonging to the default forwarding class. If a default class is not configured, the default class has no QoS functionality. These packets are then placed into a FIFO queue and forwarded at a rate determined by the available underlying bandwidth. This FIFO queue is managed by tail drop—a means of avoiding congestion that treats all traffic equally and does not differentiate between classes of service. When the output queue is full and tail drop is in effect, packets are dropped until the congestion is eliminated and the queue is no longer full. The following example configures a default class called policy1. policy-map policy1 class class-default fair-queue 10 queue-limit 20 The default class shown above has these characteristics: 10 queues for traffic that does not meet the match criteria of other classes whose policy is defined by policy1, and a maximum of 20 packets per queue before tail drop is enacted to handle additional queued packets.
Fix: F-17757r1_fix
When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-SRVFRM-003
- Vuln IDs
-
- V-18522
- Rule IDs
-
- SV-20061r3_rule
Checks: C-21297r6_chk
Review the firewall protecting the server farm to validate an ACL with a deny-by-default security posture has been implemented that secures the servers located on the VLAN. If the filter is not defined on the firewall and the architecture contains a layer 3 switch between the firewall and the server, then review the ACL configured for the VLAN on the L3 switch.
Fix: F-19125r4_fix
Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-SRVFRM-004
- Vuln IDs
-
- V-18523
- Rule IDs
-
- SV-20062r1_rule
Checks: C-21298r1_chk
Review the firewall protecting the server farm. Vlan configurations should have a filter that secures the servers located on the vlan segment. Identify the source ip addresses that have access to the servers and verify the privilege intended with the SA. The filter should be in a deny by default posture. If the filter is not defined on the firewall and the architecture contains a layer 3 switch between the firewall and the server, than review the VLAN definition on the L3 switch.
Fix: F-19126r1_fix
Review the filter and ensure access from other server segments is denied unless necessary for application operation. The intent of the policy should be to protect servers from a server that has been compromised by an intruder.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET-VLAN-023
- Vuln IDs
-
- V-18544
- Rule IDs
-
- SV-20088r2_rule
Checks: C-21399r3_chk
Review the device configuration to determine if a VLAN has been established for printers.
Fix: F-19148r3_fix
Create a VLAN on the device for print type devices and assign printers to the VLAN ID.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-VLAN-024
- Vuln IDs
-
- V-18545
- Rule IDs
-
- SV-20089r2_rule
Checks: C-21406r2_chk
To verify compliance with this requirement, an ACL must be configured on the L3 switch VLAN interface assigned for the printer VLAN, or on the firewall interface connecting to the printer VLAN. Exception to this requirement is traffic from RSD sensors connected to the VLAN. Note: The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are ports 515, 631, 1782, 9100, 9101, and 9102. The SA can review RFC 1700 Port Assignments and review printer vendor documents to determine what ports should be allowed.
Fix: F-19149r1_fix
Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET-NAC-032
- Vuln IDs
-
- V-18565
- Rule IDs
-
- SV-20109r1_rule
Checks: C-21652r1_chk
A shutdown action puts the interface into the error-disabled state immediately and sends an SNMP trap notification if it receives a frame with a different layer 2 source address that what has been configured or learned for port security. The following Catalyst IOS interface command will shutdown the interface when such an event occurs: switchport port-security violation shutdown
Fix: F-19192r1_fix
Configure the port to shutdown when insecure hosts are connected to the wall jack.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-NAC-031
- Vuln IDs
-
- V-18566
- Rule IDs
-
- SV-49133r1_rule
Checks: C-45619r8_chk
Review the switch configuration to verify each access port is configured for a single registered MAC address. Configuring port-security on the Cisco switch access port interface will automatically set the maximum number of registered MAC addresses to one. The value will not show up in the configuration of the switch itself. To validate the access port has a maximum value of one for allowable MAC addresses, you must run the following command: Switch# show port-security interface Show Command Example: Switch# port int fa0/1 Port Security :Enabled Port Status :Secure-down Violation Mode :Shutdown Aging Time :0 mins Aging Type :Absolute SecureStatic Address Aging :Disabled Maximum MAC Addresses :1 Some technologies are exempt from requiring a single MAC address per access port; however, restrictions still apply. VoIP or VTC endpoints may provide a PC port so a PC can be connected. Each of the devices will need to be statically assigned to each access port. Another green initiative where a single LAN drop is shared among several devices is called "hot-desking", which is related to conservation of office space and teleworking. Hot-desking is where several people are assigned to work at the same desk at different times, each user with their own PC. In this case, a different MAC address needs to be permitted for each PC that is connecting to the LAN drop in the workspace. Additionally, this workspace could contain a single phone (and possibly desktop VTC endpoint) used by all assignees and the PC port on it might be the connection for their laptop. In this case, it is best not to use sticky port security, but to use a static mapping of authorized devices or implement 802.1x. If this is not a teleworking remote location, this exemption does not apply.
Fix: F-19193r3_fix
Configure the switch to limit the maximum number of registered MAC addresses on each access switch port to one.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-TUNL-012
- Vuln IDs
-
- V-18790
- Rule IDs
-
- SV-20504r2_rule
Checks: C-22501r1_chk
Identify the tunnel endpoints, then review all routing devices to ensure the tunnel entry point is not used as a default route. Traffic destined to the tunnel should be directed to the tunnel endpoint by static routes, policy based routing, or by the mechanics of the interior routing protocol, but not by default route statements.
Fix: F-19446r1_fix
The SA must carefully plan and configure or let IGP determine what goes into each tunnel.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0966
- Vuln IDs
-
- V-19188
- Rule IDs
-
- SV-21167r2_rule
Checks: C-23285r3_chk
Control Plane Policing (CoPP) If supported by the router, CoPP should be used to increase security on Cisco routers by protecting the RP from unnecessary and malicious traffic. CoPP allows network operators to classify traffic based on importance that then enables the router to filter and rate limit the traffic according to the defined policy for each class. Step 1: Verify traffic types have been classified based on importance levels. The following is an example configuration: class-map match-all CoPP_CRITICAL match access-group name CoPP_CRITICAL class-map match-any CoPP_IMPORTANT match access-group name CoPP_IMPORTANT match protocol arp class-map match-all CoPP_NORMAL match access-group name CoPP_NORMAL class-map match-any CoPP_UNDESIRABLE match access-group name CoPP_UNDESIRABLE class-map match-all CoPP_DEFAULT match access-group name CoPP_DEFAULT Step 2: Review the ACLs referenced by the match access-group commands to determine if the traffic is being classified appropriately. The following is an example configuration: ip access-list extended CoPP_CRITICAL remark our control plane adjacencies are critical permit ospf host [OSPF neighbor A] any permit ospf host [OSPF neighbor B] any permit pim host [PIM neighbor A] any permit pim host [PIM neighbor B] any permit pim host [RP addr] any permit igmp any 224.0.0.0 15.255.255.255 permit tcp host [BGP neighbor] eq bgp host [local BGP addr] permit tcp host [BGP neighbor] host [local BGP addr] eq bgp deny ip any any ip access-list extended CoPP_IMPORTANT permit tcp host [TACACS server] eq tacacs any permit tcp [management subnet] 0.0.0.255 any eq 22 permit udp host [SNMP manager] any eq snmp permit udp host [NTP server] eq ntp any deny ip any any ip access-list extended CoPP_NORMAL remark we will want to rate limit ICMP traffic permit icmp any any echo permit icmp any any echo-reply permit icmp any any time-exceeded permit icmp any any unreachable deny ip any any ip access-list extended CoPP_UNDESIRABLE remark other management plane traffic that should not be received permit udp any any eq ntp permit udp any any eq snmptrap permit tcp any any eq 22 permit tcp any any eq 23 remark other control plane traffic not configured on router permit eigrp any any permit udp any any eq rip deny ip any any ip access-list extended CoPP_DEFAULT permit ip any any Note: Explicitly defining undesirable traffic with ACL entries enables the network operator to collect statistics. Excessive ARP packets can potentially monopolize Route Processor resources, starving other important processes. Currently, ARP is the only Layer 2 protocol that can be specifically classified using the match protocol command. Step 3: Review the policy-map to determine if the traffic is being policed appropriately for each classification. The following is an example configuration: policy-map CONTROL_PLANE_POLICY class CoPP_CRITICAL police 512000 8000 conform-action transmit exceed-action transmit class CoPP_IMPORTANT police 256000 4000 conform-action transmit exceed-action drop class CoPP_NORMAL police 128000 2000 conform-action transmit exceed-action drop class CoPP_UNDESIRABLE police 8000 1000 conform-action drop exceed-action drop class cp-default-in police 64000 1000 conform-action transmit exceed-action drop Step 4: Verify that the CoPP policy is enabled. The following is an example configuration: control-plane service-policy input CONTROL_PLANE_POLICY Note: Starting with IOS release 12.4(4)T, Control Plane Protection (CPPr) can be used to filter as well as police control plane traffic destined to the RP. CPPr is very similar to CoPP and has the ability to filter and police traffic using finer granularity by dividing the aggregate control plane into three separate categories: (1) host, (2) transit, and (3) CEF-exception. Hence, a separate policy-map could be configured for each traffic category. If CoPP is not supported, then the alternative would be the implementation of a receive path filter. Step 1: A receive path ACL or an inbound ACL on each interface must be configured to restrict traffic destined to the router. The IOS IP Receive ACL feature provides filtering capability explicitly for traffic that is destined for the router. Verify that the global ip receive acl statement has been configured as shown in the following example: ip receive acl 199 Note: If the platform does not support the ip receive path acl feature, an inbound ACL on each interface must be configured. Step 2: Verify that the ACL referenced by the ip receive acl statement restricts all control plane and management plane traffic. The ACL configuration should look similar to the following: access-list 199 deny ip any any fragments access-list 199 remark allow specific management plane traffic access-list 199 permit tcp [management subnet] 0.0.0.255 any eq 22 access-list 199 permit udp host [SNMP manager] any eq snmp access-list 199 permit tcp host [TACACS server] eq tacacs any access-list 199 permit udp host [NTP server] eq ntp any access-list 199 permit icmp [management subnet] 0.0.0.255 any access-list 199 remark allow specific control plane traffic access-list 199 permit ospf host [OSPF neighbor A] any access-list 199 permit ospf host [OSPF neighbor B] any access-list 199 permit pim host [PIM neighbor A] any access-list 199 permit pim host [PIM neighbor B] any access-list 199 permit pim host [RP addr] any access-list 199 permit igmp any 224.0.0.0 15.255.255.255 access-list 199 permit tcp host [BGP neighbor] eq bgp host [local BGP addr] access-list 199 permit tcp host [BGP neighbor] host [local BGP addr] eq bgp access-list 199 remark all other traffic destined to the device is dropped access-list 199 deny ip any any Note: If the Management Plane Protection (MPP) feature is enabled for an OOBM interface, there would be no purpose in filtering this traffic on the receive path. With MPP enabled, no interfaces except the management interface will accept network management traffic destined to the device. This feature also provides the capability to restrict which management protocols are allowed. See NET0992 for additional configuration information.
Fix: F-19812r1_fix
Implement control plane protection by classifying traffic types based on importance levels and configure filters to restrict and rate limit the traffic punted to the route processor as according to each class.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET-MCAST-010
- Vuln IDs
-
- V-19189
- Rule IDs
-
- SV-21169r1_rule
Checks: C-23287r1_chk
An administratively scoped IP multicast region is defined to be a topological region in which there are one or more boundary routers with common boundary definitions. Such a router is said to be a boundary for multicast scoped addresses in the range defined in its configuration. In order to support administratively scoped multicast, a multicast boundary router will drop multicast traffic matching an interface's boundary definition in either direction. The IPv4 administrative scoped multicast address space is 239/8 which is divided into two scope levels: the Local Scope and Organization Local Scope. The Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The IPv4 Organization Local Scope is 239.192.0.0/14 is the space from which an organization should allocate sub-ranges when defining scopes for private use. This scope can be expanded to 239.128.0.0/10, 239.64.0.0/10, and 239.0.0.0/10 if necessary. The scope of IPv6 multicast packets are determined by the scope value where 4 (ffx4::/16) is Admin-local, 5 (ffx5::/16) is Site-local, and 8 (ffx8::/16) is Organization-local. Review the multicast topology to determine any documented Admin-local (scope = 4) or Site-local (scope = 5) multicast boundaries for IPv6 traffic or any Local-scope (address block 239.255.0.0/16) boundary for IPv4 traffic. Verify that appropriate boundaries are configured on the applicable multicast-enabled interfaces. IPv4: The following example will establish a multicast boundary on the interface to ensure that Local-scope traffic is not allowed into or out of the administratively scoped IPv4 multicast region: ip multicast-routing ! interface FastEthernet0/1 description Boundary for multicast region A ip address 198.18.0.1 255.255.255.0 ip pim sparse-mode ip multicast boundary MCAST_ADMIN_SCOPED_BOUNDARY ! ip access-list standard MCAST_ADMIN_SCOPED_BOUNDARY deny 239.255.0.0 0.255.255.255 permit 224.0.0.0 15.255.255.255 ! Note: The filter used by multicast boundary command will effect multicast traffic outside of the administratively scoped IPv4 multicast space. If Organization Local Scope traffic must cross this site boundary, include the necessary permit statement from this address range (239.192.0.0 255.252.0.0). To allow global multicast traffic to pass by this boundary, ensure that the filter will permit the global address space (224.0.1.0-238.255.255.255) if the enclave has deployed inter-domain multicast routing. IPv6: The following example will establish a multicast boundary on the interface to ensure that Site-local scope traffic is not allowed into or out of the administratively scoped IPv6 multicast region: ipv6 multicast-routing ! interface FastEthernet0/1 description link to Site A ipv6 address 2001:1:0:146::/64 eui-64 ipv6 multicast boundary scope 5 Note: Filtering the scope value of 5 will ensure that any multicast traffic received by the interface in either direction with a scope equal to or less than 5 (Site-local) will be dropped. Hence, all Site-local and Admin-local traffic will be dropped while allowing Organization-local (scope = 8) and global multicast traffic (scope =14) to be forwarded for an inter-site as well as inter-domain multicast routing deployment.
Fix: F-19813r1_fix
Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The scope of IPv6 multicast packets are determined by the scope value where 4 is Admin-local and 5 is Site-local. Configure the necessary boundary to ensure packets addressed to these administratively scoped multicast addresses do not cross the applicable administrative boundaries.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET0812
- Vuln IDs
-
- V-23747
- Rule IDs
-
- SV-41497r1_rule
Checks: C-12791r2_chk
Review the router or switch configuration and verify that two NTP servers have been defined to synchronize time similar to the following example: ntp update-calendar ntp server 129.237.32.6 ntp server 129.237.32.7 Some platforms have a battery-powered hardware clock, referred to in the command-line interface (CLI) as the "calendar," in addition to the software based system clock. The hardware clock runs continuously, even if the router is powered off or rebooted. If the software clock is synchronized to an outside time source via NTP, it is a good practice to periodically update the hardware clock with the time learned from NTP. Otherwise, the hardware clock will tend to gradually lose or gain time (drift) and the software clock and hardware clock may become out of synchronization with each other. The ntp update-calendar command will enable the hardware clock to be periodically updated with the time specified by the NTP source. The hardware clock will be updated only if NTP has synchronized to an authoritative time server. To force a single update of the hardware clock from the software clock, use the clock update-calendar command in user EXEC mode. Note: Lower end router models (i.e., 2500 series) and access switches (i.e. 2950, 2970, etc) do not have hardware clocks, so this command is not available on those platforms. Any NTP-enabled device that receives and accepts time from a stratum-n server can become a stratum-n+1 server. However, an NTP-enabled device will not accept time updates from an NTP server at a higher stratum; thereby enforcing a tree-level hierarchy of client-server relationships and preventing time synchronization loops. To increase availability, NTP peering can be used between NTP servers. Hence the following example configuration could be used to provide the necessary redundancy: ntp update-calendar ntp server 129.237.32.6 ntp peer 129.237.32.7 Alternative to querying an NTP server for time is to receive NTP updates via server that is broadcasting or multicasting the time update messages. The following interface command would be configured to receive an NTP broadcast message: ntp broadcast client The above command must be configured on two interfaces or there must be two NTP servers on the same LAN segment broadcasting NTP messages. The following interface command would be configured to receive an NTP multicast message: ntp multicast client 239.x.x.x For multicast, two different administratively scoped multicast groups can be used—one for each NTP server. In addition, the router or MLS must also have ip pim dense-mode configured on the interface as well as global ip multicast-routing.
Fix: F-3044r2_fix
Configure the device to use two separate NTP servers.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0405
- Vuln IDs
-
- V-28784
- Rule IDs
-
- SV-38003r3_rule
Checks: C-37332r2_chk
Review the device configuration to determine if the call home service or feature is disabled on the device. On a Cisco product, you will not see the call-home service in the running config unless it's enabled. If the call home service is enabled on the device, this is a finding. Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.
Fix: F-32568r2_fix
Configure the network device to disable the call home service or feature. The command below will disable the call-home service on a Cisco device. Example: hostname(config)# no service call-home Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-MCAST-001
- Vuln IDs
-
- V-30577
- Rule IDs
-
- SV-40312r1_rule
Checks: C-39164r1_chk
If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Review the router or multi-layer switch configuration to determine if multicast routing is enabled and what interfaces are enabled for PIM. Step 1: Determine if multicast routing is enabled. By default, multicast is disabled globally. The following global configuration commands will enable IPv4 and IPv6 multicast routing: ip multicast-routing ipv6 multicast-routing Step 2: PIM is enabled on an interface with either of the following commands: ip pim sparse-mode, ip pim dense-mode, ip pim sparse-dense-mode. Review all interface configurations and verify that only the required interfaces are enabled for PIM as documented in the network topology diagram. With IPv4, PIM is disabled by default on all interfaces. Following is an example of an interface with PIM enabled. interface FastEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip pim sparse-mode You can also verify what IPv4 interfaces are enabled for PIM with the show ip pim interface command. With IPv6, PIM is enabled by default on all IPv6-enabled interfaces if IPv6 multicast routing is enabled on the router via the global ipv6 multicast-routing command. An interface can be disabled for PIM using the no ipv6 pim interface command. interface FastEthernet0/1 ipv6 address 2001:1:0:146::/64 eui-64 no ipv6 pim You can also verify what ipv6 interfaces are enabled for PIM with the show ipv6 pim interface command.
Fix: F-34295r1_fix
If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Enable PIM only on the applicable interfaces according to the multicast topology diagram.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-MCAST-002
- Vuln IDs
-
- V-30578
- Rule IDs
-
- SV-40315r1_rule
Checks: C-39168r1_chk
Review the router or multi-layer switch to determine if either IPv4 or IPv6 multicast routing is enabled. If either is enabled, verify that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram. IPv4 Step 1: Verify that an ACL is configured that will specify the allowable PIM neighbors similar to the following example: ip access-list standard PIM_NEIGHBORS permit 192.0.2.1 permit 192.0.2.3 deny any log Step 2: Verify that a pim neighbor-filter command is configured on all PIM-enabled interfaces that is referencing the PIM neighbor ACL similar to the following example: interface FastEthernet0/3 ip address 192.0.2.2 255.255.255.0 ip pim sparse-mode ip pim neighbor-filter PIM_NEIGHBORS IPv6 Step 1: Verify that an ACL is configured that will specify the allowable PIM neighbors similar to the following example: ipv6 access-list PIM_NEIGHBORS permit host FE80::1 any permit host FE80::3 any deny any any log Note: IPv6 PIM adjacenencies are created using the router unicast link-local addresses Step 2: Verify that a pim neighbor-filter global command is configured ipv6 pim neighbor-filter list PIM_NEIGHBORS
Fix: F-34301r1_fix
If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET-IPV6-059
- Vuln IDs
-
- V-30617
- Rule IDs
-
- SV-40389r1_rule
Checks: C-39253r1_chk
The maximum number of hops used in router advertisements and all IPv6 packets that are originated by the router can be set using the ipv6 hop-limit command in global configuration mode. Review the router or multi-layer switch configuration to determine if the maximum hop limit has been configured. If it has been configured, then it must be set to at least 32. The following global command sets the max hop limit to 128: ipv6 hop-limit 128 Note: The IOS default is 64. Hence, if the hop limit is not configured, the router will be in compliance with the requirement.
Fix: F-34363r2_fix
Configure maximum hop limit to at least 32.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-IPV6-065
- Vuln IDs
-
- V-30660
- Rule IDs
-
- SV-40454r1_rule
Checks: C-39284r1_chk
If the router is functioning as a 6to4 router, verify that there is an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets. Step 1: Determine if the router is functioning as a 6to4 router. You should find a tunnel configuration similar to the following example: interface Tunnel0 no ip address no ip redirects ipv6 address 2000:C0A8:6301::1/64 tunnel source FastEthernet0/1 tunnel mode ipv6ip 6to4 ! … ipv6 route 2002::/16 Tunnel0 Step 2: Verify that there is an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets. You should find a configuration similar to the following example: interface FastEthernet0/1 description internal link ip address 192.168.1.1 255.255.255.0 ipv6 address 6TO4PREFIX ::1:0:0:0:1/64 ip access-group IPV4_EGRESS_FILTER in ! ip access-list extended IPV4_EGRESS_FILTER remark only this 6to4 router can tunnel IPv6 traffic deny 41 any any log … … Note: normally you would want to configure the internal interface for a 6to4 router as dual stack. However IPv6 only is possible and if configured as such, having an IPv4 ACL is irrelevant since the interface will not accept any IPv4 packets.
Fix: F-34388r1_fix
If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets.
- RMF Control
- Severity
- Low
- CCI
- Version
- NET-IPV6-066
- Vuln IDs
-
- V-30736
- Rule IDs
-
- SV-40539r1_rule
Checks: C-39311r1_chk
If the router is functioning as a 6to4 router, verify that an egress filter (inbound on the internal-facing interface) has been configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave. The examples below are using 2002:c612:1::/48 where c612:1 maps to 198.18.0.1 which is the imbedded V4ADDR. The subnet in this example is 2002:c612:1:1::/64. The IPV6 ACL will filter the source address of the IPv6 packets before they are forwarded to the 6to4 tunnel. ipv6 general-prefix 6TO4_PREFIX 6to4 FastEthernet0/1 ! interface Tunnel0 ipv6 address 2000:c0a8:6301::1/64 tunnel source FastEthernet0/0 tunnel mode ipv6ip 6to4 ! interface FastEthernet0/0 ip address 10.1.12.1 255.255.255.0 ipv6 address 6TO4_PREFIX ::1:0:0:0:1/64 ipv6 traffic-filter IPV6_EGRESS_FILTER in ! interface FastEthernet0/1 description DISN CORE facing ip address 198.18.0.1 255.255.255.0 ! ipv6 route 2002::/16 Tunnel0 ! ipv6 access-list IPV6_EGRESS_FILTER permit ipv6 2002:C612:1::/48 any deny ipv6 any any log Note: normally you would want to configure the internal interface dual stack, allthough IPv6 only is possible.
Fix: F-34421r1_fix
If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET-TUNL-034
- Vuln IDs
-
- V-30744
- Rule IDs
-
- SV-40556r1_rule
Checks: C-39321r1_chk
Review the router or multi-layer switch configuration and determine if L2TPv3 has been configured to provide transport across an IP network. If it has been configured, verify that the L2TPv3 session requires authentication. Step 1: Determine if an L2TPv3 pseudowire is configured on an interface which will look similar to the following configuration: pseudowire-class L2TPV3 encapsulation l2tpv3 ip local interface Loopback0 ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface FastEthernet0/0 xconnect 5.5.5.5 1 encapsulation l2tpv3 pw-class L2TPV3 If you do not see a configuration similar to the one above, then this vulnerability is not applicable. Otherwise, proceed to step 2. Step2: Verify that the l2tp-class global command has been configured with authentication as shown in the following example. l2tp-class L2TP_CLASS authentication password 7 011E1F145A1815182E5E4A Note: If a password is not configured in the l2tp-class command the password associated with the remote peer router is taken from the value entered with the global username hostname password value. Note: Layer 2 Forwarding or L2F (RFC2341), which is the "version 1", and L2TPv2 (RFC 2661) are used for remote access services based on the Virtual Private Dial-up Network (VPDN) model—not for tunneling IP packets across a backbone as with L2TPv3. With the VPDN model, a user obtains a layer-2 connection to a RAS using dialup PSTN or ISDN service and then establishes a PPP session over that connection. The L2 termination and PPP session endpoints reside on the RAS. L2TP extends the PPP model by allowing the L2 and PPP endpoints to reside on different devices that are interconnected by a backbone network. A remote access client has an L2 connection to an L2TP Access Concentrator (LAC) that tunnels PPP frames across the IP backbone to the L2TP Network Server (LNS) residing in the private network.
Fix: F-34428r1_fix
Configure L2TPv3 to use authentication for any peering sessions.
- RMF Control
- Severity
- Medium
- CCI
- Version
- NET0408
- Vuln IDs
-
- V-31285
- Rule IDs
-
- SV-41555r2_rule
Checks: C-40049r1_chk
Review the router configuration to determine if authentication is being used for all peers. A password should be defined for each BGP neighbor regardless of the autonomous system the peer belongs as shown in the following example: outer bgp 100 neighbor external-peers peer-group neighbor 171.69.232.90 remote-as 200 neighbor 171.69.232.90 peer-group external-peers neighbor 171.69.232.100 remote-as 300 neighbor 171.69.232.100 peer-group external-peers neighbor 171.69.232.90 password xxxxxxxxxx neighbor 171.69.232.100 password xxxxxxxxxx
Fix: F-14123r2_fix
Configure the device to authenticate all BGP peers.