STIGQter: STIG Summary: Cisco NX OS Switch NDM Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 05 Jan 2026:

The Cisco switch must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

DISA Rule

SV-220513r1137887_rule

Vulnerability Number

V-220513

Group Title

SRG-APP-000516-NDM-000336

Rule Version

CISC-ND-001370

Severity

CAT I

CCI(s)

• CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.

Weight

10

Fix Recommendation

Configure the Cisco switch to use at least two authentication servers as shown in the following example:

Step 1: Define the authentication servers.

SW1(config)# radius-server host 10.1.48.10 key xxxxxx
SW1(config)# radius-server host 10.1.48.11 key xxxxxx

Step 2: Configure the AAA group.

SW1(config)# aaa group server radius RADIUS_SERVERS
SW1(config-radius)# server 10.1.48.10
SW1(config-radius)# server 10.1.48.11

Step 3: Use the AAA servers for login authentication for both in-band and console access methods.

SW1(config)# aaa authentication login default group RADIUS_SERVERS
SW1(config)# aaa authentication login console group RADIUS_SERVERS

Check Contents

Review the Cisco switch configuration to verify that the device is configured to use at least two authentication servers as primary source for authentication.

Step 1: Verify that an AAA server group is configured for login authentication for both in-band and console access methods.

aaa authentication login default group RADIUS_SERVERS
aaa authentication login console group RADIUS_SERVERS

Step 2: Verify that at least two AAA servers have been defined for the server group as shown in the example below:

radius-server host 10.1.48.10 key 7 "xxxxxx"
radius-server host 10.1.48.11 key 7 "xxxxxx"
authentication accounting
aaa group server radius RADIUS_SERVERS
server 10.1.48.10
server 10.1.48.11

If the Cisco switch is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Vulnerability Number

V-220513

Documentable

False

Rule Version

CISC-ND-001370

Severity Override Guidance

Review the Cisco switch configuration to verify that the device is configured to use at least two authentication servers as primary source for authentication.

Step 1: Verify that an AAA server group is configured for login authentication for both in-band and console access methods.

aaa authentication login default group RADIUS_SERVERS
aaa authentication login console group RADIUS_SERVERS

Step 2: Verify that at least two AAA servers have been defined for the server group as shown in the example below:

radius-server host 10.1.48.10 key 7 "xxxxxx"
radius-server host 10.1.48.11 key 7 "xxxxxx"
authentication accounting
aaa group server radius RADIUS_SERVERS
server 10.1.48.10
server 10.1.48.11

If the Cisco switch is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Check Content Reference

M

Target Key

4066