STIGQter: STIG Summary: Cisco ACI Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Cisco ACI must be configured so the BGP neighbor is directly connected and will not connect a BGP session to a directly connected neighbor device's loopback address.

DISA Rule

SV-272094r1168411_rule

Vulnerability Number

V-272094

Group Title

SRG-NET-000362-RTR-000124

Rule Version

CACI-RT-000034

Severity

CAT III

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

If ACI is determined to be configured differently than the default settings, reconfigure to default settings by performing the actions on the BGP connectivity profile (path below).

Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Out >> {{your_l3out}} >> Logical Node Profiles >> {{your_Logical_node_Profile}} >> Logical Interface Profiles >> {{your_logical_interface_profile}} >> BGP peer x.x.x.x >> Policy.

Reset the following in the policy:

Disable Connected Check is unmarked
EBGP Multihop TTL = 1

Check Contents

Review the BGP configuration to verify that TTL security has been configured to the default settings.

Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Out >> {{your_l3out}} >> Logical Node Profiles >> {{your_Logical_node_Profile}} >> Logical Interface Profiles >> {{your_logical_interface_profile}} >> BGP peer x.x.x.x >> Policy.

Verify the following in the policy:

Disable Connected Check is unmarked
EBGP Multihop TTL = 1

If the Cisco ACI is not configured to use GTSM for all Exterior BGP peering sessions, this is a finding.

Vulnerability Number

V-272094

Documentable

False

Rule Version

CACI-RT-000034

Severity Override Guidance

Review the BGP configuration to verify that TTL security has been configured to the default settings.

Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Out >> {{your_l3out}} >> Logical Node Profiles >> {{your_Logical_node_Profile}} >> Logical Interface Profiles >> {{your_logical_interface_profile}} >> BGP peer x.x.x.x >> Policy.

Verify the following in the policy:

Disable Connected Check is unmarked
EBGP Multihop TTL = 1

If the Cisco ACI is not configured to use GTSM for all Exterior BGP peering sessions, this is a finding.

Check Content Reference

M

Target Key

5684