Check: CSCO-NM-000360
Cisco ISE NDM STIG:
CSCO-NM-000360
(in versions v1 r6 through v1 r3)
Title
The Cisco ISE must be configured to disable Wireless Setup for production systems. (Cat I impact)
Discussion
ISE Wireless Setup is beta software so is not authorized for use in DoD. Wireless Setup is disabled by default after fresh installation of Cisco ISE. If you upgrade ISE from a previous version, the Wireless Setup menu does not appear. Wireless Setup requires ports 9103 and 9104 to be open. To close those ports, use the CLI to disable Wireless Setup. You can enable Wireless Setup in the ISE CLI with the command application configure ise, picking the option to enable Wireless Setup.
Check Content
If wireless setup is not availabe in this version of the product, this is not applicable. Verify Wi-Fi setup has been disabled on a device after initial setup and the device has been placed on the production network. Show application status Wi-Fi setup. If wireless setup is not disabled, this is a finding.
Fix Text
Use the application configure command in EXEC mode to disable wireless setup. application configure disable Wi-Fi setup
Additional Identifiers
Rule ID: SV-242641r879588_rule
Vulnerability ID: V-242641
Group Title: SRG-APP-000142-NDM-000245
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000382 |
The organization configures the information system to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services. |
Controls
| Number | Title |
|---|---|
| CM-7 |
Least Functionality |