STIGQter STIGQter: STIG Summary: Cisco ACI Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

The Cisco ACI must not be configured to use IPv6 site local unicast addresses.

DISA Rule

SV-272101r1168417_rule

Vulnerability Number

V-272101

Group Title

SRG-NET-000512-RTR-000013

Rule Version

CACI-RT-000041

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Delete unauthorized addresses. Configure the IPv6 addresses on the ACI fabric's leaf switches and virtual network segments (bridge domains) within the desired tenant to use site local unicast addresses.

Tenants >> {{your_Tenant}} >> Networking >> VRF >> {{your_VRF}} >> Operational >> Route Table >> IPV6 Routes

Remove unauthorized addresses. Remove unauthorized addresses from the Client Endpoints list.

Tenants >> {{your_Tenant}} >> Networking >> VRF >> {{your_VRF}} >> Operational >> Client Endpoints

Check Contents

Review the router configuration to ensure FEC0::/10 IP addresses are not defined.

Tenants >> {{your_Tenant}} >> Networking >> VRF >> {{your_VRF}} >> Operational >> Route Table >> IPV6 Routes

and

Tenants >> {{your_Tenant}} >> Networking >> VRF >> {{your_VRF}} >> Operational >> Client Endpoints


This will display all IPV6 address in this VRF and on which leaf they reside.

If the CLI is preferred, the command is as follows when run from the APIC:
fabric {{node_ID}} show ipv6 interface brief

or from each node:
show ipv6 interface brief

If IPv6 site local unicast addresses are defined, this is a finding.

Vulnerability Number

V-272101

Documentable

False

Rule Version

CACI-RT-000041

Severity Override Guidance

Review the router configuration to ensure FEC0::/10 IP addresses are not defined.

Tenants >> {{your_Tenant}} >> Networking >> VRF >> {{your_VRF}} >> Operational >> Route Table >> IPV6 Routes

and

Tenants >> {{your_Tenant}} >> Networking >> VRF >> {{your_VRF}} >> Operational >> Client Endpoints


This will display all IPV6 address in this VRF and on which leaf they reside.

If the CLI is preferred, the command is as follows when run from the APIC:
fabric {{node_ID}} show ipv6 interface brief

or from each node:
show ipv6 interface brief

If IPv6 site local unicast addresses are defined, this is a finding.

Check Content Reference

M

Target Key

5684