STIGQter: STIG Summary: Cisco NX OS Switch NDM Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 05 Jan 2026:

The Cisco switch must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must disconnect the session.

DISA Rule

SV-220480r960840_rule

Vulnerability Number

V-220480

Group Title

SRG-APP-000065-NDM-000214

Rule Version

CISC-ND-000150

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

Configure the Cisco switch to enforce the limit of three consecutive invalid logon attempts as shown in the example below:

SW2(config)# ssh login-attempts 3

Check Contents

Review the Cisco switch configuration to verify that it enforces the limit of three consecutive invalid logon attempts as shown in the example below:

ssh login-attempts 3

If the Cisco switch is not configured to enforce the limit of three consecutive invalid logon attempts, this is a finding.

NOTE: The NX-OS switch does not lock out the account, it disconnects the session. The AAA server will lock out the user account on three failed attempts.

Vulnerability Number

V-220480

Documentable

False

Rule Version

CISC-ND-000150

Severity Override Guidance

Review the Cisco switch configuration to verify that it enforces the limit of three consecutive invalid logon attempts as shown in the example below:

ssh login-attempts 3

If the Cisco switch is not configured to enforce the limit of three consecutive invalid logon attempts, this is a finding.

NOTE: The NX-OS switch does not lock out the account, it disconnects the session. The AAA server will lock out the user account on three failed attempts.

Check Content Reference

M

Target Key

4066