STIGQter: STIG Summary: Cisco ACI NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Cisco ACI SSH sessions must be terminated after five minutes of inactivity.

DISA Rule

SV-271969r1168379_rule

Vulnerability Number

V-271969

Group Title

SRG-APP-000190-NDM-000267

Rule Version

CACI-ND-000054

Severity

CAT I

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Set the GUI idle timeout, which affects SSH on both APIC and Switches:
1. Navigate to Admin >> AAA >> Security.
2. In the Work pane, choose Default Settings >> Edit.
3. In the Properties section, set "Web Token Timeout (s)" to 300 or less.

Check Contents

Verify the maximum GUI idle duration before requiring login refresh is set to 300 seconds or less:

1. Navigate to Admin >> AAA >> Security.
2. In the Work pane, choose Default Settings >> Edit.
3. In the Properties section, verify "Web Token Timeout (s)" is set to 300 or less.

Note: If not set, then the default values are used, this is a finding.

If "Web Token Timeout (s)" is not set to 300 or less, this is a finding.

Vulnerability Number

V-271969

Documentable

False

Rule Version

CACI-ND-000054

Severity Override Guidance

Verify the maximum GUI idle duration before requiring login refresh is set to 300 seconds or less:

1. Navigate to Admin >> AAA >> Security.
2. In the Work pane, choose Default Settings >> Edit.
3. In the Properties section, verify "Web Token Timeout (s)" is set to 300 or less.

Note: If not set, then the default values are used, this is a finding.

If "Web Token Timeout (s)" is not set to 300 or less, this is a finding.

Check Content Reference

M

Target Key

5682