STIGQter STIGQter: STIG Summary: Infrastructure Router Security Technical Implementation Guide

Version: 8

Release: 29 Benchmark Date: 25 Jan 2019

CheckedNameTitle
SV-3000r4_ruleThe network device must log all interface access control lists (ACL) deny statements.
SV-3008r1_ruleThe IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network.
SV-3012r4_ruleNetwork devices must be password protected.
SV-3013r5_ruleNetwork devices must display the DoD-approved logon banner warning.
SV-3014r4_ruleThe network devices must timeout management connections for administrative access after 10 minutes or less of inactivity.
SV-3020r3_ruleNetwork devices must have DNS servers defined if it is configured as a client resolver.
SV-3021r3_ruleNetwork devices must only allow SNMP access from addresses belonging to the management network.
SV-3034r3_ruleNetwork devices must authenticate all IGP peers.
SV-3043r4_ruleThe network device must use different SNMP community names or groups for various levels of read and write access.
SV-3056r7_ruleGroup accounts must not be configured for use on the network device.
SV-3057r6_ruleAuthorized accounts must be assigned the least privilege level necessary to perform assigned duties.
SV-3058r5_ruleUnauthorized accounts must not be configured for access to the network device.
SV-3062r4_ruleNetwork devices must be configured to ensure passwords are not viewable when displaying configuration information.
SV-3069r5_ruleManagement connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.
SV-3070r4_ruleNetwork devices must log all attempts to establish a management connection for administrative access.
SV-3072r3_ruleThe running configuration must be synchronized with the startup configuration after changes have been made and implemented.
SV-3079r3_ruleNetwork devices must have the Finger service disabled.
SV-3081r3_ruleIP source routing must be disabled.
SV-3085r4_ruleNetwork devices must have HTTP service for administrative access disabled.
SV-3143r4_ruleNetwork devices must not have any default manufacturer passwords.
SV-3160r4_ruleNetwork devices must be running a current and supported operating system with all IAVMs addressed.
SV-3175r5_ruleThe network device must require authentication prior to establishing a management connection for administrative access.
SV-3196r4_ruleThe network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.
SV-3210r4_ruleThe network device must not use the default or well-known SNMP community strings public and private.
SV-3966r6_ruleIn the event the authentication server is unavailable, the network device must have a single local account of last resort defined.
SV-3967r4_ruleThe network devices must time out access to the console port at 10 minutes or less of inactivity.
SV-3969r5_ruleNetwork devices must only allow SNMP read-only access.
SV-4582r5_ruleThe network device must require authentication for console access.
SV-4584r3_ruleThe network device must log all messages except debugging and send all log data to a syslog server.
SV-5611r5_ruleThe network devices must only allow management connections for administrative access from hosts residing in the management network.
SV-5612r4_ruleThe network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.
SV-5613r4_ruleThe network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface.
SV-5646r5_ruleThe network device must drop half-open TCP connections through filtering thresholds or timeout periods.
SV-7365r4_ruleThe auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.
SV-15301r4_ruleNetwork devices must be configured with rotating keys used for authenticating IGP peers that have a duration of 180 days or less.
SV-15310r2_ruleFTP servers on the device must be disabled.
SV-15313r3_ruleNetwork devices must have BSDr commands disabled.
SV-15327r6_ruleNetwork devices must authenticate all NTP messages received from NTP servers and peers.
SV-15336r3_ruleThe network device must use its loopback or OOB management interface address as the source address when originating authentication services traffic.
SV-15339r3_ruleThe network device must use its loopback or OOB management interface address as the source address when originating syslog traffic.
SV-15342r3_ruleThe network device must use its loopback or OOB management interface address as the source address when originating NTP traffic.
SV-15345r3_ruleThe network device must use its loopback or OOB management interface address as the source address when originating SNMP traffic.
SV-15348r3_ruleThe network device must use its loopback or OOB management interface address as the source address when originating IP Flow/NetFlow traffic.
SV-15351r4_ruleThe network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.
SV-15357r3_ruleThe network device must use its loopback interface address as the source address for all iBGP peering sessions.
SV-15397r2_ruleThe network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF.
SV-15427r1_ruleThe network element must be configured from accepting any outbound IP packet that contains an illegitimate address in the source address field via egress ACL or by enabling Unicast Reverse Path Forwarding in an IPv6 enclave.
SV-15459r4_ruleThe network device must not allow SSH Version 1 to be used for administrative access.
SV-16067r2_ruleISATAP tunnels must terminate at an interior router.
SV-16259r4_ruleNetwork devices must use two or more authentication servers for the purpose of granting administrative access.
SV-16261r5_ruleThe emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.
SV-18945r2_ruleIPSec tunnels used to transit management traffic must be restricted to only the authorized management packets based on destination and source IP address.
SV-19063r1_ruleGateway configuration at the remote VPN end-point is a not a mirror of the local gateway
SV-19068r1_ruleIGP instances configured on the OOBM gateway router do not peer only with their appropriate routing domain.
SV-19069r1_ruleThe routes from the two IGP domains are redistributed to each other.
SV-19071r2_ruleTraffic from the managed network is able to access the OOBM gateway router
SV-19072r1_ruleTraffic from the managed network will leak into the management network via the gateway router interface connected to the OOBM backbone.
SV-19073r2_ruleManagement network traffic must not leak onto the managed network.
SV-19075r4_ruleThe network devices OOBM interface must be configured with an OOBM network address.
SV-19076r4_ruleThe network devices management interface must be configured with both an ingress and egress ACL.
SV-19077r3_ruleThe management interface must be configured as passive for the IGP instance deployed in the managed network.
SV-19092r1_ruleAn inbound ACL is not configured for the management network sub-interface of the trunk link to block non-management traffic.
SV-19094r1_ruleTraffic entering the tunnels is not restricted to only the authorized management packets based on destination address.
SV-19097r1_ruleManagement traffic is not classified and marked at the nearest upstream MLS or router when management traffic must traverse several nodes to reach the management network.
SV-19098r1_ruleThe core router within the managed network has not been configured to provide preferred treatment for management traffic that must traverse several nodes to reach the management network.
SV-20061r3_ruleServer VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.
SV-20504r2_ruleDefault routes must not be directed to the tunnel entry point.
SV-21027r3_ruleThe network device must have control plane protection enabled.
SV-21028r1_ruleThe administrator must ensure that multicast routers are configured to establish boundaries for Admin-local or Site-local scope multicast traffic.
SV-28651r4_ruleNetwork devices must use at least two NTP servers to synchronize time.
SV-36774r5_ruleA service or feature that calls home to the vendor must be disabled.
SV-40311r1_ruleThe administrator must ensure that Protocol Independent Multicast (PIM) is disabled on all interfaces that are not required to support multicast routing.
SV-40314r1_ruleThe administrator must ensure that a PIM neighbor filter is bound to all interfaces that have PIM enabled.
SV-40388r2_ruleNetwork devices must have a maximum hop limit of at least 32.
SV-40452r1_ruleThe administrator must ensure the 6-to-4 router is configured to drop any IPv4 packets with protocol 41 received from the internal network.
SV-40537r1_ruleThe administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.
SV-40554r2_ruleL2TPv3 sessions must be authenticated prior to transporting traffic.
SV-41553r3_ruleNetwork devices must authenticate all BGP peers within the same or between autonomous systems (AS).