STIGQter: STIG Summary: Cisco IOS XR Router NDM Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 01 Apr 2026:

The Cisco router must be configured to be configured to prohibit the use of all unnecessary and nonsecure functions and services.

DISA Rule

SV-216529r1043177_rule

Vulnerability Number

V-216529

Group Title

SRG-APP-000142-NDM-000245

Rule Version

CISC-ND-000470

Severity

CAT I

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

Disable the following services if enabled as shown in the example below.

RP/0/0/CPU0:R3(config)#no service ipv4 tcp-small-servers
RP/0/0/CPU0:R3(config)#no service ipv4 udp-small-servers
RP/0/0/CPU0:R3(config)#no http client vrf xxxxx
RP/0/0/CPU0:R3(config)#no telnet ipv4 server
RP/0/0/CPU0:R3(config)#no service call-home

Check Contents

Verify that the router does not have any unnecessary or nonsecure ports, protocols, and services enabled. For example, the following commands should not be in the configuration:

service ipv4 tcp-small-servers max-servers 10
service ipv4 udp-small-servers max-servers 10
http client vrf xxxxx
telnet vrf default ipv4 server max-servers 1
service call-home

Note: Certain legacy devices may require 'service call-home' be enabled to support Smart Licensing as they do not support the newer smart transport configuration. Those devices do not incur a finding for having call-home enabled for Smart Licensing.

If any unnecessary or nonsecure ports, protocols, or services are enabled, this is a finding.

Vulnerability Number

V-216529

Documentable

False

Rule Version

CISC-ND-000470

Severity Override Guidance

Verify that the router does not have any unnecessary or nonsecure ports, protocols, and services enabled. For example, the following commands should not be in the configuration:

service ipv4 tcp-small-servers max-servers 10
service ipv4 udp-small-servers max-servers 10
http client vrf xxxxx
telnet vrf default ipv4 server max-servers 1
service call-home

Note: Certain legacy devices may require 'service call-home' be enabled to support Smart Licensing as they do not support the newer smart transport configuration. Those devices do not incur a finding for having call-home enabled for Smart Licensing.

If any unnecessary or nonsecure ports, protocols, or services are enabled, this is a finding.

Check Content Reference

M

Target Key

4023