STIGQter STIGQter: STIG Summary: Cisco IOS XE Switch NDM Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.

DISA Rule

SV-220536r531084_rule

Vulnerability Number

V-220536

Group Title

SRG-APP-000156-NDM-000250

Rule Version

CISC-ND-000530

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure SSH to use FIPS-140-2 compliant HMACs as shown in the example below:

SW1(config)#ip ssh version 2
SW1(config)#iip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr

Note: An SSH configuration enables a server and client to authorize the negotiation of only those algorithms that are configured from the allowed list. If a user tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

Check Contents

Review the Cisco switch configuration to verify that SSH is configured to use FIPS-140-2 compliant HMACs as shown in the example below:

ip ssh version 2
ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr

Note: An SSH configuration enables a server and client to authorize the negotiation of only those algorithms that are configured from the allowed list. If a remote party tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

If the switch is not configured to implement replay-resistant authentication mechanisms for network access to privileged accounts, this is a finding.

Vulnerability Number

V-220536

Documentable

False

Rule Version

CISC-ND-000530

Severity Override Guidance

Review the Cisco switch configuration to verify that SSH is configured to use FIPS-140-2 compliant HMACs as shown in the example below:

ip ssh version 2
ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr

Note: An SSH configuration enables a server and client to authorize the negotiation of only those algorithms that are configured from the allowed list. If a remote party tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

If the switch is not configured to implement replay-resistant authentication mechanisms for network access to privileged accounts, this is a finding.

Check Content Reference

M

Target Key

4067

Comments