STIGQter: STIG Summary: Cisco IOS XE Switch RTR Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Apr 2026:

The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

DISA Rule

SV-220995r1107540_rule

Vulnerability Number

V-220995

Group Title

SRG-NET-000362-RTR-000110

Rule Version

CISC-RT-000120

Severity

CAT I

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.
• CCI-004866 - Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.

Weight

10

Fix Recommendation

Configure the Cisco switch to protect against known types of DoS attacks on the route processor.

Step 1: Configure the default policer rates for all control plane CPU queues and save the configuration.

Device> enable
Device# configure terminal
Device(config)# cpp system-default
Defaulting CPP : Policer rate for all classes will be set to their defaults
Device(config)# end
Device# copy running-configuration startup-configuration

Step 2: View the policy map and verify the correct policer rates are set according to organization-defined standards.

show policy-map control-plane

Step 3: Change any policer rates to match the organization-defined standards.

Note: Starting from Cisco IOS XE Fuji 16.8.1a, the creation of user-defined class-maps is not supported. A user can only enable/disable a CPU queue or change the policer rate of a CPU queue.

Check Contents

Review the Cisco switch configuration to verify it is compliant with this requirement.

Step 1: To verify that the CoPP policy map has been saved, issue the "show running-config" command in privileged EXEC mode and verify the following line exists in the output:

policy-map system-cpp-policy

Step 2: To view the policy map and verify the correct policer rates are set according to organization-defined standards, run the following command:

show policy-map control-plane

Note: Starting from Cisco IOS XE Fuji 16.8.1a, the creation of user-defined class-maps is not supported. A user can only enable/disable a CPU queue or change the policer rate of a CPU queue.

If the Cisco switch is not configured to protect against known types of DoS attacks by employing organization-defined security safeguards, this is a finding.

Vulnerability Number

V-220995

Documentable

False

Rule Version

CISC-RT-000120

Severity Override Guidance

Review the Cisco switch configuration to verify it is compliant with this requirement.

Step 1: To verify that the CoPP policy map has been saved, issue the "show running-config" command in privileged EXEC mode and verify the following line exists in the output:

policy-map system-cpp-policy

Step 2: To view the policy map and verify the correct policer rates are set according to organization-defined standards, run the following command:

show policy-map control-plane

Note: Starting from Cisco IOS XE Fuji 16.8.1a, the creation of user-defined class-maps is not supported. A user can only enable/disable a CPU queue or change the policer rate of a CPU queue.

If the Cisco switch is not configured to protect against known types of DoS attacks by employing organization-defined security safeguards, this is a finding.

Check Content Reference

M

Target Key

4074