STIGQter: STIG Summary: Cisco ACI Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

The Cisco ACI must be configured to authenticate all routing protocol messages using a NIST-validated FIPS 198-1 message authentication code algorithm.

DISA Rule

SV-272078r1168402_rule

Vulnerability Number

V-272078

Group Title

SRG-NET-000168-RTR-000078

Rule Version

CACI-RT-000018

Severity

CAT II

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-001184 - Protect the authenticity of communications sessions.

Weight

10

Fix Recommendation

Configure authentication for every protocol that affects the routing or forwarding tables to use key chain (TCP-AO) authentication. Configure all supported control plane protocols. This typically includes protocols such as BGP and OSPF.

Navigate to Tenants >> {{your_tenants}} >> Networking >> L3Outs >> {{your_L3Out}} >> Logical Node Profiles >> {{your_node_profile}} >> Logical Interface Profiles >> {{your_interface_Profile} >> OSPF|EIGRP|BGP Interface profile.

Check Contents

If EIGRP, RIP, and IS-IS protocols are used (these protocols only support MD5 authentication), this is a finding.

Review the switch configuration using the show bgp and show ospf commands to verify BGP and OSPF. Navigate to Tenants >> {{your_tenants}} >> Networking >> L3Outs >> {{your_L3Out}} >> Logical Node Profiles >> {{your_node_profile}} >> Logical Interface Profiles >> {{your_interface_Profile}>> OSPF|EIGRP|BGP Interface profile.

If authentication protocols that affect the routing or forwarding tables are not configured to use key chain (TCP-AO) authentication with 180 maximum lifetime, this is a finding.

Vulnerability Number

V-272078

Documentable

False

Rule Version

CACI-RT-000018

Severity Override Guidance

If EIGRP, RIP, and IS-IS protocols are used (these protocols only support MD5 authentication), this is a finding.

Review the switch configuration using the show bgp and show ospf commands to verify BGP and OSPF. Navigate to Tenants >> {{your_tenants}} >> Networking >> L3Outs >> {{your_L3Out}} >> Logical Node Profiles >> {{your_node_profile}} >> Logical Interface Profiles >> {{your_interface_Profile}>> OSPF|EIGRP|BGP Interface profile.

If authentication protocols that affect the routing or forwarding tables are not configured to use key chain (TCP-AO) authentication with 180 maximum lifetime, this is a finding.

Check Content Reference

M

Target Key

5684