OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco PE switch providing MPLS Layer 2 Virtual Private Network (L2VPN) services must be configured to authenticate targeted Label Distribution Protocol (LDP) sessions used to exchange virtual circuit (VC) information using a FIPS-approved message authentication code algorithm.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-221120CISC-RT-000660SV-221120r999729_ruleCCI-001958medium
Description
LDP provides the signaling required for setting up and tearing down pseudowires (virtual circuits used to transport Layer 2 frames) across an MPLS IP core network. Using a targeted LDP session, each PE switch advertises a virtual circuit label mapping that is used as part of the label stack imposed on the frames by the ingress PE switch during packet forwarding. Authentication provides protection against spoofed TCP segments that can be introduced into the LDP sessions.
STIGDate
Cisco NX OS Switch RTR Security Technical Implementation Guide2026-03-04

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-01.2Authenticate, Authorize and Audit (AAA)
1.00
IAC-02Identification & Authentication for Organizational Users
1.00
IAC-03Identification & Authentication for Non-Organizational Users
1.00
IAC-04Identification & Authentication for Devices
1.00
IAC-05Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (31) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-7Unsuccessful Logon Attempts
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
CM-7(9)Prohibiting The Use of Unauthorized Hardware
1.00
IA-11Re-authentication
1.00

+21 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.5.1
1.00
3.5.2
1.00
CCI1 mapping
CCI-001958
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
1.00
PR.AA-03
1.00
PR.AA-05
0.50

Who does this work

7 NICE work roles and 5 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-221120r999729_chk)

The Cisco switch is not compliant with this requirement; hence, it is a finding. However, the severity level can be downgraded to a category 3 if the switch is configured to authenticate targeted LDP sessions using MD5 as shown in the configuration example below: Step 1: Verify that LDP neighbors are authenticating session, advertisement, and notification messages as shown in the example below: mpls ldp configurations password required for LDP_NBR1 password option 1 for LDP_NBR1 key-chain LDP_KEY password required for LDP_NBR2 password option 1 for LDP_NBR2 key-chain LDP_KEY Step 2: Verify that the neighbors identified in step 1 have the correct prefix. ip prefix-list LDP_NBR1 permit 10.1.22.2/32 ip prefix-list LDP_NBR2 permit 10.1.12.4/32 If the switch is not configured to authenticate targeted LDP sessions using MD5, this is a finding. The finding will remain as a CAT II.

Fix Text (F-22824r409850_fix)

The severity level can be downgraded to a category 3 if the switch is configured to authenticate targeted LDP sessions using MD5 as shown in the example below: Step 1: Configure a key chain for LDP sessions. SW1(config)# key chain LDP_KEY SW1(config-keychain)# key 1 SW1(config-keychain-key)# key-string xxxxxxxxxxxx SW1(config-keychain-key)# send-lifetime 00:00:00 Oct 1 2019 23:59:59 Dec 31 2019 SW1(config-keychain-key)# accept-lifetime 00:00:00 Oct 1 2019 01:05:00 Jan 1 2020 SW1(config-keychain-key)# exit SW1(config-keychain)# exit Step 2: Configure a prefix lists to identify LDP neighbors. SW1(config)# ip prefix-list LDP_NBR1 permit 10.1.22.2/32 SW1(config)# ip prefix-list LDP_NBR2 permit 10.1.12.4/32 Step 3: Apply the key chain to the LDP neighbors. SW1 (config)# mpls ldp configurations SW1 (config-ldp)# password required for LDP_NBR1 SW1 (config-ldp)# password option 1 for LDP_NBR1 key-chain LDP_KEY SW1 (config-ldp)# password required for LDP_NBR2 SW1 (config-ldp)# password option 1 for LDP_NBR2 key-chain LDP_KEY SW1 (config-ldp)# end