STIGQter: STIG Summary: Cisco NX-OS Switch RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Cisco switch must be configured to have all inactive layer 3 interfaces disabled.

DISA Rule

SV-221076r622190_rule

Vulnerability Number

V-221076

Group Title

SRG-NET-000019-RTR-000007

Rule Version

CISC-RT-000060

Severity

CAT III

CCI(s)

• CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Disable all inactive interfaces as shown below:

SW1(config)# int e4/1 - 11
SW1(config-if-range)# shutdown
SW1(config-if-range)# end

Check Contents

Review the switch configuration and verify that inactive interfaces have been disabled as shown below:

interface Ethernet4/12
shutdown
no switchport

interface Ethernet4/13
shutdown
no switchport
…
…
…
interface Ethernet4/48
shutdown
no switchport

If an interface is not being used but is configured or enabled, this is a finding.

Vulnerability Number

V-221076

Documentable

False

Rule Version

CISC-RT-000060

Severity Override Guidance

Review the switch configuration and verify that inactive interfaces have been disabled as shown below:

interface Ethernet4/12
shutdown
no switchport

interface Ethernet4/13
shutdown
no switchport
…
…
…
interface Ethernet4/48
shutdown
no switchport

If an interface is not being used but is configured or enabled, this is a finding.

Check Content Reference

M

Target Key

4075

Comments