STIGQter: STIG Summary: Cisco IOS Router RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Cisco perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

DISA Rule

SV-216584r531085_rule

Vulnerability Number

V-216584

Group Title

SRG-NET-000364-RTR-000111

Rule Version

CISC-RT-000360

Severity

CAT III

CCI(s)

CCI-002403 - The information system only allows incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

Fix Recommendation

Disable LLDP transmit on all external interfaces as shown in the example below.

R5(config)#int g0/1
R5(config-if)#no lldp transmit

Check Contents

This requirement is not applicable for the DODIN Backbone.

Step 1: Verify LLDP is not enabled globally via the command

lldp run

By default LLDP is not enabled globally. If LLDP is enabled, proceed to step 2.

Step 2: Verify LLDP is not enabled on any external interface as shown in the example below.

interface GigabitEthernet0/1
ip address x.1.12.1 255.255.255.252
no lldp transmit

Note: LLDP is enabled by default on all interfaces once it is enabled globally; hence the command lldp transmit will not be visible on the interface configuration.

If LLDP transmit is enabled on any external interface, this is a finding.

The Cisco perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments