STIGQter: STIG Summary: Cisco IOS Switch NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.

DISA Rule

SV-220588r521267_rule

Vulnerability Number

V-220588

Group Title

SRG-APP-000156-NDM-000250

Rule Version

CISC-ND-000530

Severity

CAT II

CCI(s)

• CCI-001941 - The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.

Weight

10

Fix Recommendation

Configure SSH to use FIPS-140-2 compliant HMACs as shown in the example below:

SW1(config)#ip ssh version 2
SW1(config)#ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr

Note: An SSH configuration enables a server and client to authorize the negotiation of only algorithms that are configured from the allowed list. If a user tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

Check Contents

Review the Cisco switch configuration to verify that SSH is configured to use FIPS-140-2 compliant HMACs as shown in the example below:

ip ssh version 2
ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr

Note: An SSH configuration enables a server and client to authorize the negotiation of only algorithms that are configured from the allowed list. If a remote party tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

If the switch is not configured to implement replay-resistant authentication mechanisms for network access to privileged accounts, this is a finding.

Vulnerability Number

V-220588

Documentable

False

Rule Version

CISC-ND-000530

Severity Override Guidance

Review the Cisco switch configuration to verify that SSH is configured to use FIPS-140-2 compliant HMACs as shown in the example below:

ip ssh version 2
ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr

Note: An SSH configuration enables a server and client to authorize the negotiation of only algorithms that are configured from the allowed list. If a remote party tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

If the switch is not configured to implement replay-resistant authentication mechanisms for network access to privileged accounts, this is a finding.

Check Content Reference

M

Target Key

4069

Comments