STIGQter: STIG Summary: Cisco IOS XE Router NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Cisco router must be configured to terminate all network connections associated with device management after 10 minutes of inactivity.

DISA Rule

SV-215833r531083_rule

Vulnerability Number

V-215833

Group Title

SRG-APP-000190-NDM-000267

Rule Version

CISC-ND-000720

Severity

CAT I

CCI(s)

• CCI-001133 - The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Set the idle timeout value to "10" minutes or less on all configured login classes as shown in the example below.

R1(config)#line vty 0 4
R1(config-line)#exec-timeout 10 0
R1(config-line)#exit
R1(config)#line con 0
R1(config-line)#exec-timeout 10 0
R1(config-line)#exit
R2(config)#ip http timeout-policy idle 600 life nnnn requests nn

Check Contents

Review the Cisco router configuration to verify that all network connections associated with a device management have an idle timeout value set to 10 minutes or less as shown in the following example:

ip http secure-server
ip http timeout-policy idle 600 life nnnn requests nn
…
…
…
line con 0
exec-timeout 10 0
line vty 0 4
exec-timeout 10 0

If the Cisco router is not configured to terminate all network connections associated with a device management after "10" minutes of inactivity, this is a finding.

Vulnerability Number

V-215833

Documentable

False

Rule Version

CISC-ND-000720

Severity Override Guidance

Review the Cisco router configuration to verify that all network connections associated with a device management have an idle timeout value set to 10 minutes or less as shown in the following example:

ip http secure-server
ip http timeout-policy idle 600 life nnnn requests nn
…
…
…
line con 0
exec-timeout 10 0
line vty 0 4
exec-timeout 10 0

If the Cisco router is not configured to terminate all network connections associated with a device management after "10" minutes of inactivity, this is a finding.

Check Content Reference

M

Target Key

4020

Comments