STIGQter: STIG Summary: Cisco IOS XE Switch NDM Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 01 Apr 2026:

The Cisco switch must be configured to prohibit the use of all unnecessary and nonsecure functions and services.

DISA Rule

SV-220534r1043177_rule

Vulnerability Number

V-220534

Group Title

SRG-APP-000142-NDM-000245

Rule Version

CISC-ND-000470

Severity

CAT I

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

Disable the following services if enabled as shown in the example below:

SW2(config)#no boot network
SW2(config)#no ip boot server
SW2(config)#no ip bootp server
SW2(config)#no ip dns server
SW2(config)#no ip identd
SW2(config)#no ip finger
SW2(config)#no ip http server
SW2(config)#no ip rcmd rcp-enable
SW2(config)#no ip rcmd rsh-enable
SW2(config)#no service config
SW2(config)#no service finger
SW2(config)#no service tcp-small-servers
SW2(config)#no service udp-small-servers
SW2(config)#no service pad
SW2(config)#no service call-home
SW2(config)#end

Check Contents

Verify that the switch does not have any unnecessary or nonsecure ports, protocols, and services enabled. For example, the following commands should not be in the configuration:

boot network
ip boot server
ip bootp server
ip dns server
ip identd
ip finger
ip http server
ip rcmd rcp-enable
ip rcmd rsh-enable
service config
service finger
service tcp-small-servers
service udp-small-servers
service pad
service call-home

Note: Certain legacy devices may require 'service call-home' be enabled to support Smart Licensing as they do not support the newer smart transport configuration. Those devices do not incur a finding for having call-home enabled for Smart Licensing.

If any unnecessary or nonsecure ports, protocols, or services are enabled, this is a finding.

Vulnerability Number

V-220534

Documentable

False

Rule Version

CISC-ND-000470

Severity Override Guidance

Verify that the switch does not have any unnecessary or nonsecure ports, protocols, and services enabled. For example, the following commands should not be in the configuration:

boot network
ip boot server
ip bootp server
ip dns server
ip identd
ip finger
ip http server
ip rcmd rcp-enable
ip rcmd rsh-enable
service config
service finger
service tcp-small-servers
service udp-small-servers
service pad
service call-home

Note: Certain legacy devices may require 'service call-home' be enabled to support Smart Licensing as they do not support the newer smart transport configuration. Those devices do not incur a finding for having call-home enabled for Smart Licensing.

If any unnecessary or nonsecure ports, protocols, or services are enabled, this is a finding.

Check Content Reference

M

Target Key

4067