STIGQter: STIG Summary: Cisco NX-OS Switch NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.

DISA Rule

SV-220503r604141_rule

Vulnerability Number

V-220503

Group Title

SRG-APP-000411-NDM-000330

Rule Version

CISC-ND-001200

Severity

CAT I

CCI(s)

• CCI-002890 - The information system implements cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Enable fips mode via the command fips mode enable.

Check Contents

Verify that FIPS mode is enabled as shown in the example below:

fips mode enable

Note: Cisco NX-OS software supports only SSH version 2 (SSHv2). Beginning in Cisco NX-OS Release 5.1, SSH runs in FIPS mode. Source: Cisco Nexus 7000 Series NX-OS Security Configuration Guide, Release 6.x

If the switch is not configured to use FIPS-validated HMAC to protect the integrity of remote maintenance sessions, this is a finding.

Vulnerability Number

V-220503

Documentable

False

Rule Version

CISC-ND-001200

Severity Override Guidance

Verify that FIPS mode is enabled as shown in the example below:

fips mode enable

Note: Cisco NX-OS software supports only SSH version 2 (SSHv2). Beginning in Cisco NX-OS Release 5.1, SSH runs in FIPS mode. Source: Cisco Nexus 7000 Series NX-OS Security Configuration Guide, Release 6.x

If the switch is not configured to use FIPS-validated HMAC to protect the integrity of remote maintenance sessions, this is a finding.

Check Content Reference

M

Target Key

4066

Comments