An error occurred:

Perimeter L3 Switch STIG - Cisco

Perimeter L3 Switch Security Technical Implementation Guide - Cisco

ID Vuln ID Title Cat Status
NET0162 V-4622 The ISSO/NSO will ensure premise router interfaces that connect to an AG (i.e., ISP) are configured with an ingress ACL that only permits packets with destination addresses within the sites address space. Cat I
NET0164 V-4623 The ISSO/NSO will ensure the premise router does not have a routing protocol session with a peer router belonging to an AS (Autonomous System) of the AG service provider. A static route is the only acceptable route to an AG. Cat I
NET0166 V-4624 The IAO/NSO will ensure the AG network service provider IP addresses are not redistributed into or advertised to the NIPRNet or any router belonging to any other Autonomous System (AS) i.e. to another AG device in another AS. Cat III
NET0167 V-14632 The ISSO/NSO will ensure the route to the AG network adheres to the PPS CAL boundary 13 and 14 policies and is in compliance with all perimeter filtering defined in the perimeter and router sections of the Network STIG. Cat II
NET0230 V-3012 Network devices must be password protected. Cat I
NET0240 V-3143 Network devices must not have any default manufacturer passwords. Cat I
NET0340 V-3013 Network devices must display the DoD-approved logon banner warning. Cat II
NET0400 V-3034 The network element must authenticate all IGP peers. Cat II
NET0405 V-28784 A service or feature that calls home to the vendor must be disabled. Cat II
NET0408 V-31285 The network element must authenticate all BGP peers within the same or between autonomous systems (AS). Cat II
NET0410 V-3035 BGP connections must be restricted to authorized IP addresses of neighbors from trusted Autonomous Systems. Cat II
NET0412 V-14666 Each eBGP neighbor must be authenticated with a unique password. Cat II
NET0422 V-14667 Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration of 180 days or less. Cat III
NET0425 V-7009 An Infinite Lifetime key must be set to never expire. The lifetime of the key will be configured as infinite for route authentication, if supported by the current approved router software version. Cat I
NET0433 V-15432 Network devices must use two or more authentication servers for the purpose of granting administrative access. Cat II

Print

Display this benchmark in a printer-friendly format for off-line reference. This display does not include any commands.

Version Changes

If there are multiple versions of this benchmark, Xylok can display the differences between any changes in the checks.