STIGQter STIGQter: STIG Summary: Cisco NX-OS Switch NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Cisco switch must produce audit records containing information to establish where the events occurred.

DISA Rule

SV-220484r604141_rule

Vulnerability Number

V-220484

Group Title

SRG-APP-000097-NDM-000227

Rule Version

CISC-ND-000290

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Enable OAL as shown in the example below:

SW1(config)# logging ip access-list cache entries nnnn

Set the ‘log’ parameter after any ‘deny’ entries in the ACL as referenced in the check text above.

Check Contents

Step 1: Review the deny statements in all interface ACLs to determine if the log parameter has been configured as shown in the example below:

ip access-list extended BLOCK_INBOUND
deny icmp any any log

Step 2: Verify that the Optimized Access-list Logging (OAL) has been configured.

logging ip access-list cache entries nnnn

Note: Once OAL has been enabled, the logged ACL hits can be viewed via the show log ip access-list cache command.

If the switch is not configured with the log-input parameter after any deny statements to note where packets have been dropped via an ACL, this is a finding.

Vulnerability Number

V-220484

Documentable

False

Rule Version

CISC-ND-000290

Severity Override Guidance

Step 1: Review the deny statements in all interface ACLs to determine if the log parameter has been configured as shown in the example below:

ip access-list extended BLOCK_INBOUND
deny icmp any any log

Step 2: Verify that the Optimized Access-list Logging (OAL) has been configured.

logging ip access-list cache entries nnnn

Note: Once OAL has been enabled, the logged ACL hits can be viewed via the show log ip access-list cache command.

If the switch is not configured with the log-input parameter after any deny statements to note where packets have been dropped via an ACL, this is a finding.

Check Content Reference

M

Target Key

4066

Comments