STIGQter: STIG Summary: Cisco IOS XR Router NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Cisco router must be configured to terminate all network connections associated with device management after 10 minutes of inactivity.

DISA Rule

SV-216532r531088_rule

Vulnerability Number

V-216532

Group Title

SRG-APP-000190-NDM-000267

Rule Version

CISC-ND-000720

Severity

CAT I

CCI(s)

CCI-001133 - The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

Fix Recommendation

Set the idle timeout value to "10" minutes or less on all configured login classes as shown in the example below.

RP/0/0/CPU0:R3(config)#line con
RP/0/0/CPU0:R3(config-line)#exec-timeout
RP/0/0/CPU0:R3(config)#line default
RP/0/0/CPU0:R3(config-line)#exec-timeout 10 0

Check Contents

Review the Cisco router configuration to verify that all network connections associated with a device management have an idle timeout value set to "10" minutes or less as shown in the following example:

line console
…
…
…
exec-timeout 10 0
!
line default
…
…
…
exec-timeout 10 0
transport input ssh

If the Cisco router is not configured to terminate all network connections associated with a device management after 10 minutes of inactivity, this is a finding.

The Cisco router must be configured to terminate all network connections associated with device management after 10 minutes of inactivity.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments