UCF STIG Viewer Logo

Firewall Security Technical Implementation Guide - Cisco



Findings (MAC II - Mission Support Sensitive)

Finding ID Severity Title
V-15294 High Teredo packets must be blocked inbound to the enclave and outbound from the enclave.
V-25037 High The IAO will ensure that the router or firewall software has been upgraded to mitigate the risk of DNS cache poisoning attack caused by a flawed PAT implementation using a predictable source port allocation method for DNS query traffic.
V-3210 High The network device must not use the default or well-known SNMP community strings public and private.
V-3175 High The network device must require authentication prior to establishing a management connection for administrative access.
V-15434 High The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.
V-4582 High The network device must require authentication for console access.
V-3012 High Network devices must be password protected.
V-3143 High Network devices must not have any default manufacturer passwords.
V-3062 High The network element must be configured to ensure passwords are not viewable when displaying configuration information.
V-3196 High The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.
V-3056 High Group accounts must not be configured for use on the network device.
V-3085 Medium The network element must have HTTP service for administrative access disabled.
V-14637 Medium Router advertisements must be suppressed on all external-facing IPv6-enabled interfaces.
V-3069 Medium Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.
V-14671 Medium The network element must authenticate all NTP messages received from NTP servers and peers.
V-3043 Medium The network device must use different SNMP community names or groups for various levels of read and write access.
V-3156 Medium The device must be configured to protect the network against denial of service attacks such as Ping of Death, TCP SYN floods, etc.
V-15296 Medium Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic.
V-17814 Medium Gateway configuration at the remote VPN end-point is a not a mirror of the local gateway
V-17830 Medium A firewall located behind the premise router must be configured to block all outbound management traffic.
V-18815 Medium IPv6 Jumbo Payload hop by hop header must be blocked.
V-5611 Medium The network devices must only allow management connections for administrative access from hosts residing in the management network.
V-3014 Medium The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.
V-3057 Medium Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.
V-14644 Medium The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address.
V-17754 Medium Management traffic is not restricted to only the authorized management packets based on destination and source IP address.
V-14643 Medium The SA must configure the firewall for the minimum content and protocol inspection requirements.
V-15432 Medium Network devices must use two or more authentication servers for the purpose of granting administrative access.
V-3013 Medium Network devices must display the DoD-approved logon banner warning.
V-5646 Medium The network device must drop half-open TCP connections through filtering thresholds or timeout periods.
V-14649 Medium The ISSO must ensure the message is displayed at the remote console if an administrator is already logged in, or when an administrator logs in if the alarm message has not been acknowledged.
V-14648 Medium Critical alerts must be generated and notifications sent to authorized personnel regardless if the person is logged in.
V-3058 Medium Unauthorized accounts must not be configured for access to the network device.
V-3969 Medium The network device must only allow SNMP read-only access.
V-28784 Medium A service or feature that calls home to the vendor must be disabled.
V-18522 Medium Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.
V-14717 Medium The network device must not allow SSH Version 1 to be used for administrative access.
V-3967 Medium The network devices must time out access to the console port at 10 minutes or less of inactivity.
V-4619 Medium The FA will ensure that if the firewall product operates on an OS platform, the host must be STIG compliant prior to the installation of the firewall product.
V-3966 Medium In the event the authentication server is unavailable, the network device must have a single local account of last resort defined.
V-17821 Medium The network element’s OOBM interface must be configured with an OOBM network address.
V-17822 Medium The network elements management interface must be configured with both an ingress and egress ACL.
V-5731 Medium The SA will utilize ingress and egress ACLs to restrict traffic destined to the enclave perimeter in accordance with the guidelines contained in DoD Instruction 8551.1 for all ports and protocols required for operational commitments.
V-30638 Medium The IAO must ensure firewalls deployed in an IPv6 enclave meet the requirements defined by DITO and NSA milestone objective 3 guidance.
V-3054 Medium The firewall must not utilize any services or capabilities that are not necessary for the administration of the firewall.
V-14693 Medium The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF.
V-3982 Medium L2TP must not pass into the private network of an enclave.
V-72879 Medium The firewall must not be listening for telnet service.
V-18608 Medium IPv6 6-to-4 addresses with a prefix of 2002::/16 must be filtered at the perimeter.
V-17835 Medium Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address.
V-18525 Medium The IAO will ensure the Server Farm VLANs are protected by severely restricting the actions the hosts can perform on the servers by firewall content filtering.
V-3176 Medium The network devices must be configured to alert the administrator of a potential attack or system failure.
V-3021 Medium The network element must only allow SNMP access from addresses belonging to the management network.
V-5613 Medium The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface.
V-5612 Medium The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.
V-18523 Medium The IAO will ensure the Server Farm infrastructure is secured by ACLs on VLAN interfaces that restrict data originating from one server farm segment destined to another server farm segment.
V-3160 Medium Network devices must be running a current and supported operating system with all IAVMs addressed.
V-3008 Medium The IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network.
V-23747 Low The network element must use two or more NTP servers to synchronize time.
V-3020 Low The network element must have DNS servers defined if it is configured as a client resolver.
V-14647 Low The network device must dump logs when they reach 75% capacity to a syslog server.
V-14646 Low Alerts must be automatically generated to notify the administrator when log storage reaches seventy-five percent or more of its maximum capacity.
V-14655 Low The ISSO must ensure an alert will remain written on the consoles until acknowledged by an administrator.
V-14667 Low Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration of 180 days or less.
V-17823 Low The network element’s management interface is not configured as passive for the IGP instance deployed in the managed network.
V-14653 Low The ISSO must ensure the alarm message identifying the potential security violation makes accessible the audit record contents associated with the event(s).
V-3178 Low Administrator logons, changes to the administrator group, and account lockouts must be logged.
V-3000 Low The network device must log all interface access control lists (ACL) deny statements.
V-14656 Low The ISSO must ensure an acknowledgement message identifying a reference to the potential security violation is logged and it contains a notice that it has been acknowledged, the time of the acknowledgement and the user identifier that acknowledged the alarm, at the remote administrator session that received the alarm.
V-7011 Low The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.
V-25890 Low Network device logs must be timestamped.
V-25891 Low Network device logs must include source IP, destination IP, port, protocol used and action taken.
V-3070 Low Network devices must log all attempts to establish a management connection for administrative access.