OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco APIC must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-271924CACI-ND-000009SV-271924r1168362_ruleCCI-000370high
Description
Centralized management of authentication settings increases the security of remote and nonlocal access methods. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrator account access to the organization's Cisco ACIs can be more readily analyzed for trends and anomalies. The alternative method of defining administrator accounts on each device exposes the device configuration to remote access authentication attacks and system administrators with multiple authenticators for each Cisco ACI. APIC policies manage the authentication, authorization, and accounting (AAA) functions of the Cisco ACI fabric. The combination of user privileges, roles, and domains with access rights inheritance enables administrators to configure AAA functions at the managed object level in a granular fashion. Creating a user and assigning a role to that user does not enable access rights. It is necessary to also assign the user to one or more security domains. By default, the ACI fabric includes two special pre-created domains: - "All" allows access to the entire MIT. - "Infra" allows access to fabric infrastructure objects/subtrees, such as fabric access policies. Satisfies: SRG-APP-000149-NDM-000247, SRG-APP-000001-NDM-000200
STIGDate
Cisco ACI NDM Security Technical Implementation Guide2025-12-11

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-02.2Automated Central Management & Verification
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (28) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(3)Disable Accounts
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-9Protection of Audit Information
1.00

+18 more (top 10 by confidence shown)

CCI1 mapping
CCI-000370
1.00

Details

Check Text (C-271924r1168362_chk)

Review the AAA configuration: 1. In the GUI, on the menu bar, choose Admin >> AAA. 2. In the Navigation pane, click "Authentication". 3. Review the configuration for the configured AAA providers. 4. Review the configuration of the Login Domain(s) used by the site. If the Cisco ACI is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Fix Text (F-75881r1168361_fix)

In the APIC, configure redundant RADIUS providers. 1. On the menu bar, choose Admin >> AAA. 2. In the Navigation pane, choose "Authentication". 3. In the Work pane, choose "Providers", and then click Actions >> Create Provider. 4. In the Create Provider screen, enter the Hostname/IP Address, Description, and choose a RADIUS or TACACS+ as the realm from the drop-down list. Provide the configuration details. 5. Repeat the above steps for at least one other AAA server. Create the login domain for RADIUS: 1. In the Navigation pane, choose AAA Authentication >> Login Domains. 2. In the Work pane, choose Actions >> Create Login Domain. 3. Specify the login domain name, description, realm, and provider group as appropriate. Note: The above configuration is an example using the RADIUS protocol; however, DOD sites may configure the options for RADIUS or TACACS+.