STIGQter: STIG Summary: Cisco NX-OS Switch RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Cisco perimeter switch must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.

DISA Rule

SV-237760r648795_rule

Vulnerability Number

V-237760

Group Title

SRG-NET-000512-RTR-000014

Rule Version

CISC-RT-000391

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure the switch to suppress Router Advertisements on all external IPv6-enabled interfaces as shown in the example below.

SW1(config)# interface e1/1
SW1(config-if-range)# ipv6 nd suppress-ra
SW1(config-if-range)# end

Check Contents

Review the switch configuration to verify that Router Advertisements are suppressed on all external IPv6-enabled interfaces as shown in the example below.

interface Ethernet1/1
no switchport
ipv6 address 2001::1:24:3/64
ipv6 nd suppress-ra
no shutdown


If the switch is not configured to suppress Router Advertisements on all external IPv6-enabled interfaces, this is a finding.

Vulnerability Number

V-237760

Documentable

False

Rule Version

CISC-RT-000391

Severity Override Guidance

Review the switch configuration to verify that Router Advertisements are suppressed on all external IPv6-enabled interfaces as shown in the example below.

interface Ethernet1/1
no switchport
ipv6 address 2001::1:24:3/64
ipv6 nd suppress-ra
no shutdown


If the switch is not configured to suppress Router Advertisements on all external IPv6-enabled interfaces, this is a finding.

Check Content Reference

M

Target Key

4075

Comments