STIGQter: STIG Summary: Cisco IOS XR Router NDM Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 01 Apr 2026:

The Cisco router must be configured to authenticate Network Time Protocol (NTP) sources using authentication with FIPS-compliant algorithms.

DISA Rule

SV-216540r1156820_rule

Vulnerability Number

V-216540

Group Title

SRG-APP-000395-NDM-000347

Rule Version

CISC-ND-001150

Severity

CAT II

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

Configure the Cisco router to authenticate NTP sources using authentication with FIPS-compliant algorithms as shown in the example below:

RP/0/0/CPU0:router# configure
RP/0/0/CPU0:router(config)# ntp
RP/0/0/CPU0:router(config-ntp)# authentication-key 1 hmac-sha2 encrypted xxxxxx
RP/0/0/CPU0:router(config-ntp)# trusted-key 1
RP/0/0/CPU0:router(config-ntp)# authenticate
RP/0/0/CPU0:router(config-ntp)# server 198.51.100.1 key 1
RP/0/0/CPU0:router(config-ntp)# commit

Check Contents

Review the Cisco router configuration to verify that it authenticates NTP sources using authentication with FIPS-compliant algorithms as shown in the configuration example below:

ntp
authentication-key 1 hmac-sha2 encrypted xxxxxx
trusted-key 1
authenticate
server 198.51.100.1 key 1

If the Cisco router is not configured to authenticate NTP sources using authentication with FIPS-compliant algorithms, this is a finding.

Vulnerability Number

V-216540

Documentable

False

Rule Version

CISC-ND-001150

Severity Override Guidance

Review the Cisco router configuration to verify that it authenticates NTP sources using authentication with FIPS-compliant algorithms as shown in the configuration example below:

ntp
authentication-key 1 hmac-sha2 encrypted xxxxxx
trusted-key 1
authenticate
server 198.51.100.1 key 1

If the Cisco router is not configured to authenticate NTP sources using authentication with FIPS-compliant algorithms, this is a finding.

Check Content Reference

M

Target Key

4023