STIGQter STIGQter: STIG Summary: Cisco NX OS Switch NDM Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 05 Jan 2026:

The Cisco switch must produce audit records containing information to establish where the events occurred.

DISA Rule

SV-220484r1026067_rule

Vulnerability Number

V-220484

Group Title

SRG-APP-000097-NDM-000227

Rule Version

CISC-ND-000290

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Enable OAL as shown in the example below:

SW1(config)# logging ip access-list cache entries nnnn

Set the 'log' parameter after any 'deny' entries in the ACL as referenced in the check text above.

Check Contents

Step 1: Review the deny statements in all ACLs to determine if the log parameter has been configured as shown in the example below:

ip access-list extended BLOCK_INBOUND
deny icmp any any log

Step 2: Verify that the Optimized Access-list Logging (OAL) has been configured.

logging ip access-list cache entries nnnn

Note: Once OAL has been enabled, the logged ACL hits can be viewed via the show logging ip access-list cache command.

If the switch is not configured with the log parameter after any deny statements to note where packets have been dropped via an ACL, this is a finding.

Vulnerability Number

V-220484

Documentable

False

Rule Version

CISC-ND-000290

Severity Override Guidance

Step 1: Review the deny statements in all ACLs to determine if the log parameter has been configured as shown in the example below:

ip access-list extended BLOCK_INBOUND
deny icmp any any log

Step 2: Verify that the Optimized Access-list Logging (OAL) has been configured.

logging ip access-list cache entries nnnn

Note: Once OAL has been enabled, the logged ACL hits can be viewed via the show logging ip access-list cache command.

If the switch is not configured with the log parameter after any deny statements to note where packets have been dropped via an ACL, this is a finding.

Check Content Reference

M

Target Key

4066