STIGQter STIGQter: STIG Summary: Cisco IOS XE Router NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Cisco router must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.

DISA Rule

SV-215845r531083_rule

Vulnerability Number

V-215845

Group Title

SRG-APP-000412-NDM-000331

Rule Version

CISC-ND-001210

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure the Cisco router to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions using a FIPS 140-2 approved algorithm as shown in the examples below.

SSH Example

R1(config)#ip ssh server algorithm encryption aes128-cbc aes128-ctr aes192-cbc aes192-ctr

HTTPS Example

R2(config)#ip http secure-ciphersuite aes-128-cbc-sha

Check Contents

Review the Cisco router configuration to verify that it is compliant with this requirement.

SSH Example

ip ssh version 2
ip ssh server algorithm encryption aes128-cbc aes128-ctr aes192-cbc aes192-ctr


HTTPS Example

ip http secure-server
ip http secure-ciphersuite aes-128-cbc-sha
ip http secure-client-auth
ip http secure-trustpoint CA_XXX

If the router is not configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions using a FIPS 140-2 approved algorithm, this is a finding.

Vulnerability Number

V-215845

Documentable

False

Rule Version

CISC-ND-001210

Severity Override Guidance

Review the Cisco router configuration to verify that it is compliant with this requirement.

SSH Example

ip ssh version 2
ip ssh server algorithm encryption aes128-cbc aes128-ctr aes192-cbc aes192-ctr


HTTPS Example

ip http secure-server
ip http secure-ciphersuite aes-128-cbc-sha
ip http secure-client-auth
ip http secure-trustpoint CA_XXX

If the router is not configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions using a FIPS 140-2 approved algorithm, this is a finding.

Check Content Reference

M

Target Key

4020

Comments