What changed in Cisco ACI NDM STIG V1R2V1R2 changes

Check text

1. Navigate to System >> System SettingSettings. 2. In the Navigation pane, click "Date and Time". 3. Verify UTC is selected. If the Cisco ACI is not configured to use the UTC time zone, this is a finding.

Fix text

Configure NTP servers to provide UTC time. 1. Navigate to System >> System SettingSettings. 2. In the Navigation pane, click "Date and Time". 3. In the Work pane, choose "Display Format, then click "UTC". 4. Click "Update".

V-271916 in V1R2

Check text

1. OnNavigate theto APIC menu bar, choose System >> System Settings. 2. In the Navigation pane, click "System Alias and Banners". 32. In the "Work" pane, click the verify the Controller CLI Banner, and Switch CLI Banner, and GUI Banner (URL) are configured to display the text below. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the banner is not presented when the system administrators log in, this is a finding.

Fix text

The CLI banner is a simple text string to be printed at the terminal before the password prompt. A banner can be defined for the APIC CLI and a separate banner for the switch CLI. The GUI banner displays at the APIC URL before user login authentication. The GUI banner is defined as a URL of a site hosting the desired HTML. 1. In the GUI menu bar, navigate to System >> System Settings >> APIC Identification Preferences. 2. In the Navigation pane, select "System Alias and Banners". 32. In the "Work" pane, copy and paste the banner below in the exact format for each banner type, and then click "Submit". 4. To configure an APIC GUI banner, type the URL of a site hosting the desired HTML into the GUI Banner (URL) textbox. The URL site owner must allow the site to be placed in an iFrame to display the informational banner. If the owner of the site sets the x-frame-optiontodenyorsameorigin, the site the URL points to will not appear. Refer to the vendor guide for more details. 5. Click "Submit". The banner must read exactly as follows: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

V-271918 in V1R2

Check text

1. On the GUI menu bar, choose Admin >> AAA. 2. In the Navigation pane, choose "Security". 3. In the Work pane, choose the ManagementDefault Settings >> Policy tab. 4. Under Properties, verify the fields as follows: - For "Lockout User after multiple failed login attempts", choose "Enable". - For "Number of failed attempts before user is locked out", enter "3". - For "Time period in which consecutive attempts were failed (m)", enter "15" or an organization-defined value. - For "Duration of lockout (m)", enter "15". If the Cisco ACI fabric is not configured to enforce the limit of three consecutive invalid logon attempts and lock out users for 15 minutes, this is a finding.

Fix text

1. On the GUI menu bar, choose Admin >> AAA. 2. In the Navigation pane, choose "Security". 3. In the Work pane, choose ManagementDefault Settings >> Policy tab.Edit 4. Under Properties, fillcomplete out the fields as follows: - For "Lockout User after multiple failed login attempts", choose "Enable". - For "Number of failed attempts before user is locked out", enter "3". - For "Time period in which consecutive attempts were failed (m)", enter "15" (or an organization-defined value). - For "Duration of lockout (m)", enter "15". 5. Click "Submit".

V-271919 in V1R2

Check text

From the APIC GUI: 1. Navigate to Fabric >> Fabric Policies >> Policies >> Pod >> Management Access. 2. FabricNavigate to Tenants >> Fabricmgmt Policies >> PodNode PoliciesManagement EPGs >> ManagementOut-Of-Band AccessEPG - Default. Verify insecure or unnecessary ports/protocols, services, and ciphers are disabled. This is the default. If the Cisco ACI is configured to listen or run unnecessary and/or nonsecure functions, ports, protocols, and/or services, this is a finding.

Fix text

From the APIC GUI: 1. Navigate to Fabric >> Fabric Policies >> Policies >> Pod >> Management Access. This will limit the ports the management plane is listening on. 2 Add an OOB contract to limit the mgmt interfaces to only accept the required port traffic. Navigate Fabricto Tenants >> Fabricmgmt Policies >> PodNode PoliciesManagement EPGs >> ManagementOut-Of-Band AccessEPG - Default. Disable insecure or unnecessary ports/protocols, services, and ciphers that have been enabled, such as HTTP, FTP, unauthorized TLS versions, and TELNET.

V-271920 in V1R2

Check text

From the GUI menu bar: 1. Navigate to Admin >> AAA >> Security >> Public Key Management >> Certificate Authorities. 2. Verify the Issuer is an approved CA. If the Cisco ACI does not obtain its public key certificates from an appropriateapproved certificate policy through an approved service provider, this is a finding.

Fix text

From the GUI menu bar: 1. Navigate to Admin >> AAA >> Security >> Public Key Management >> Certificate Authorities. 2. FillComplete in the form, includingto theconfigure trusted CA root certificate and CA intermediate certificate. Click "Submit". 3. Navigate to Admin >> AAA >> Security >> Public Key Management >> Key Rings. Fill out the form and click "Submit". 4. Navigate to Admin >> AAA >> Security >> Public Key Management >> Key Rings. Fill out the form and click "Submit". 5. Get the CSR and send it to the CA Organization. 6. On the menu bar, navigate to Admin >> AAA >> Security >> Public Key Management >> Key Rings. 7. Double-click the create Key Ring name and find the Request option. The content in the Request is the CSR. Click "Submit". 8. Update the Signing Certificate on the Web. On the menu bar, navigate to Fabric >> Fabric Policies >> Policies >> Pod >> Management Access >> Default. 9. In the Admin KeyRing drop-down list, choose the desired KeyRing. Click "Submit". After clicking submit, an error occurs due to certificate reasons. Refresh with the new certificate.

V-271922 in V1R2

Title

The Cisco Application Policy Infrastructure Controller (APIC) must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

Check text

Review the AAA configuration: 1. In the GUI, on the menu bar, choose Admin >> AAA. 2. In the Navigation pane, click "Authentication" and then click the "RADIUS" tab. 3. Review the configuration for the configured AAA serverproviders. 4. Review the configuration of the Login Domain(s) used by the site. Note: The above configuration is an example using the RADIUS protocol. However, DOD sites may configure the options for LDAP, RADIUS, or TACACS+. Roles and user attributes such as limiting concurrent logins to 1 for remote system admins are also needed, but this configuration is done on the remote AAA server. If the Cisco ACI is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Fix text

In the APIC, configure redundant RADIUS providers. 1. On the menu bar, choose Admin >> AAA. 2. In the Navigation pane, clickchoose "Authentication", and then click the "RADIUS" tab. 3. In the Work pane, choose "Providers", and then click Actions >> Create RADIUS Provider. 4. SpecifyIn the RADIUSCreate hostProvider namescreen, (orenter the Hostname/IP address)Address, portDescription, protocol, and managementchoose endpointa group. 5.RADIUS Inor theTACACS+ Navigationas pane,the chooserealm Systemfrom >>the Systemdrop-down Settings >> APIC Connectivity Preferenceslist. 6.Provide In the Workconfiguration pane, select "ooband"details. 75. Repeat the above steps for at least one other AAA server. Create the login domain for RADIUS: 1. In the Navigation pane, choose AAA Authentication >> Login Domains. 2. In the Work pane, choose Actions >> Create Login Domain. 3. Specify the login domain name, description, realm, and provider group as appropriate. Note: The above configuration is an example using the RADIUS protocol.; Howeverhowever, DOD sites may configure the options for LDAP, RADIUS, or TACACS+.

Discussion

Centralized management of authentication settings increases the security of remote and nonlocal access methods. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrator account access to the organization's Cisco ACIs can be more readily analyzed for trends and anomalies. The alternative method of defining administrator accounts on each device exposes the device configuration to remote access authentication attacks and system administrators with multiple authenticators for each Cisco ACI. APIC policies manage the authentication, authorization, and accounting (AAA) functions of the Cisco ACI fabric. The combination of user privileges, roles, and domains with access rights inheritance enables administrators to configure AAA functions at the managed object level in a granular fashion. Creating a user and assigning a role to that user does not enable access rights. It is necessary to also assign the user to one or more security domains. By default, the ACI fabric includes two special precreatedpre-created domains: - "All" allows access to the entire MIT. - "Infra" allows access to fabric infrastructure objects/subtrees, such as fabric access policies. Satisfies: SRG-APP-000149-NDM-000247, SRG-APP-000001-NDM-000200

V-271924 in V1R2

Check text

To view the current firmware versions installed on the controllers and switches, type the following command from configuration mode:. apic1#Navigate configure apic1(config)# firmware apic1(config-firmware)# show version Alternatively, in the GUI navigate to Admin >> Firmware. Refer to the Cisco APIC Upgrade/Downgrade Support Matrix for Cisco APIC upgrade and downgrade paths. If the Cisco ACI fabric, leaf switches, or APIC components have an operating system release that is not currently supported by the vendor, this is a finding.

Fix text

Refer to the Cisco APIC Upgrade/Downgrade Support Matrix for Cisco APIC upgrade and downgrade paths. Install a Cisco APIC Software Maintenance Upgrade Patch Using the GUI.3t Use the following procedure to install a software maintenance upgrade (SMU) patch on a Cisco APIC: 1. Add the firmware image that corresponds to the SMU patch to the Cisco APIC. The patch will be listed along with any other firmware images (SMU patches and otherwise). 2. Set up a controller firmware update. On the Version Selection screen, for the Update Type, choose "Software Maintenance Upgrade (Install)", then choose the SMU patch in the Select Firmware section. Installing a Switch Software Maintenance Upgrade Patch Using the GUI:. SMU patch installation or uninstallation uses the same update group as a regular firmware upgrade. Because one node can belong to only one update group, when an SMU patch is applied to a specific node, remove that node from the existing group and create a new group that is dedicated to the node so that other nodes are not impacted. When performing a regular firmware upgrade for the entire fabric, delete the dedicated update group used for the SMU patch installation and add the node back to one of the original groups. If all the nodes in the existing group need the SMU patch, reuse the same update group without creating a new update group. 1. Add the firmware image that corresponds to the SMU patch to the Cisco APIC. The Cisco APIC lists the patch along with any other firmware images (SMU patches and otherwise). 2. Set up a node firmware update. On the Version Selection screen, for the Update Type, choose "Software Maintenance Upgrade (Install)", then choose the SMU patch in the Select Firmware section. Click "Begin Download" in the Confirmation screen to download the patch to the selected switches. The Firmware Updates tab in the Work pane displays. 3. In the Firmware Upgrade Work pane, click the upgrade group that was created. The Node Firmware Update dialog displays with information for the upgrade group. 4. When the status for the switches is "Ready to Install", click "Actions". Install and Reload: The switches reboot after the SMU patch gets installed. Choose this action to install only one SMU patch, or if installing the final patch of multiple patches. Install and Skip Reload: The switches do not reboot after the SMU patch gets installed. Choose this action to install multiple SMU patches and if this patch is not the final patch. In this case, repeat this entire procedure for each additional patch and continue to choose Install and Skip Reload until the final patch is installed. For the final patch, choose Install and Reload. Optionally, choose "Install and Skip Reload" and manually reboot the switch after the patch gets installed.

V-271926 in V1R2

Check text

Verify users are assigned roles based on the SSP. This requirement does not apply to the account of last resort. From the GUI, navigate to Admin >> AAA >> Security Management >> Roles or have the site demonstrate the method used for role and privilege separation. Verify that the roles are associated with the users in compliance with the SSP required roles and privileges. Read and write access rights must match the level of granularity required by the SSP. If any user/group or service account are assigned to roles with privileges that are beyond those required and authorized by the organization, this is a finding.

Fix text

View the SSP to determine the required organization-defined roles and the least privilege policies required for each role. For example, audit administrator, crypto administrator, system administrator, etc. Assign remote users to roles based on SSP and least privileges. Carefully assign capabilities to each role based on SSP role assignments. Remote authentication server is required, but roles can be created, deleted, or associated access privileges to nodes and resources update in the APIC. To create a new role with reduced permissions, do the following: To create or modify roles: 1. From the GUI, navigate to Admin >> AAA >> Security Management >> Roles. 2. Create custom roles with appropriate privileges (e.g., read-write access to specific objects). 3. Associate users with these roles, allowing them to perform specific tasks within the ACI fabric. Note: This procedure may use preconfigured rules and privileges. Security Domains, Rules, and Custom Roles may also be used depending on the desired architecture and complexity of the implementation. Refer to the vendor documentation to create custom rules, privileges combinations, Rules, and Security domains. These roles are assigned to the remote users in the external authentication server.

Discussion

Successful identification and authentication must not automatically give an entity full access to a Cisco ACI or security domain. The lack of authorization-based access control could result in the immediate compromise of, and unauthorized access to, sensitive information. All DOD systems must be properly configured to incorporate access control methods that do not rely solely on authentication for authorized access. SecurityThere domainsare allowmultiple fabricways administrators to expose resources selectively to a set of users and provide thosethis usersfunction withso the requiredsite levelshould of permissions to read and modify those resources. By using security domains, multiple sets of users can share the underlying infrastructure while having separated management access to their resources. Although out of scope for this STIG, the authentication server will also need to be configuredprepared with the security groups or access levels available on the Cisco ACIs and convey that information to thedemonstrate AAAin operator of the Cisco"Users" ACI.section Once the AAA broker identifies the user persona on the centralized directory service, the user's security group memberships can be retrieved. The AAA operator will then create a mapping that linksdifferent targetaccounts securityhave groupsdifferent fromAV the directory service to the appropriate security groups or access levels on the Cisco ACI. Once these mappings are configuredpairs, authorizations can happen dynamicallydomains, basedor on each user's directory service group membershiproles. Satisfies: SRG-APP-000033-NDM-000212, SRG-APP-000329-NDM-000287, SRG-APP-000177-NDM-000263, SRG-APP-000910-NDM-000300

V-271927 in V1R2

Check text

Verify the ACI Fabric is configured to send event messages to syslog servers. ExampleNavigate configuration: loggingto server-groupAdmin SYSLOG_SERVER_GROUP apic1(config)#>> serverExternal 10.0.0.10Data portCollectors 514>> severityMonitoring informational apic1(config)#Destinations server>> 10Syslog.0.0.20 port 514 severity informational . . . apic1(config)# syslog monitoring source MyEventSource apic1(config)# syslog monitoring source MyEventSource destination SYSLOG_SERVER_GROUP If the Cisco ACI is not configured to send audit records to at least one central syslog server, this is a finding.

Fix text

Configure the Cisco switch to send log records to a syslog servers. 1:Navigate Createto aAdmin logging server group. logging server-group &ltgroup_name> server &ltserver_ip> portExternal &ltport_number>Data severityCollectors &ltseverity_level> 2: Configure monitoring sources. Define which types of events (audit, event, fault, session) to log to the remote servers. Associate the monitoring source with the server group. syslog monitoring source &ltsource_name> syslogMonitoring monitoringDestinations source &ltsource_name> destination &ltlogging_server_group_name> Syslog. ExampleProvide the configuration: apic1(config)# logginginformation server-groupto SYSLOG_SERVER_GROUP apic1(config)#create servera 10.0.0.10log port 514 severity informational apic1(config)# server 10.0.0.20 port 514 severity informational apic1(config)# syslog monitoring source MyEventSource apic1(config)# syslog monitoring source MyEventSource destination SYSLOG_SERVER_GROUP

V-271931 in V1R2

Check text

Configure locally required events for auditing in compliance with the SSP: 1. Navigate to the "Contracts" section within the tenant. 2. WithinView the filterexisting directives,contracts: selectTenants "Log">> to{{your_tenant}} enable>> loggingContracts for>> permit{{your_contract}} orto denyverify actionsthat onlog thatis enabled for each filter. If locallylog requiredis events that require auditing are not setenabled tofor logeach filter, this is a finding.

Fix text

Configure locally required events for auditing in compliance with the SSP: 1. Navigate to the "Contracts" section within the tenant. 2. WithinView the filterexisting directives,contracts: verifyTenants the>> "Log"{{your_tenant}} is>> enabledContracts for>> permit{{your_contract}}. 3. orCheck denythe actionsdirective onto thatenable log is for each filter.

V-271944 in V1R2

Check text

1. Navigate to Admin >> AAA >> Security. 2. ClickIn the "ManagementWork pane, choose Default Settings" tab>> Edit. 3. In the Properties Sectionsection, ensureverify "Password Strength Check" is checked. If the Cisco ACI fabric is not configured to allow user selection of long passwords and passphrases, including spaces and all printable characters for password-based authentication, this is a finding.

Fix text

1. Navigate to Admin >> AAA >> Security. 2. ClickIn the "ManagementWork pane, choose Default Settings" tab>> Edit. 3. In the Properties Sectionsection, ensureverify "Password Strength Check" is checked.

V-271958 in V1R2

Check text

1. Navigate to Admin >> AAA >> Security. 2. ClickIn the "ManagementWork pane, choose Default Settings" tab>> Edit. 3. In the Properties section, ensureverify "Password Strength Check" is checked. If the Cisco ACI fabric is not configured to enforce a minimum 15-character password length, this is a finding.

Fix text

1. Navigate to Admin >> AAA >> Security. 2. ClickIn the "ManagementWork pane, choose Default Settings" tab.>> Edit 3. In the Properties section, ensureverify "Password Strength Check'" is checked. 4. In the dialog box that opens, ensureverify "Password Minimum Length" is set to "15".

V-271960 in V1R2

Check text

Verify the maximum GUI idle duration before requiring login refresh is set to 300 seconds or less: show1. runing-configNavigate cryptoto webtokenAdmin >> AAA >> Security. 2. In the Work pane, choose Default Settings >> Edit. Note:3. IfIn the outputProperties section, verify "Web Token Timeout (s)" is emptyset to 300 or less. Note: If not set, then the default values are used, this is a finding. If ui-idle-timeout-seconds"Web andToken webtoken-timeout-secondsTimeout are(s)" is not set to 300 seconds or less, this is a finding.

Fix text

Set the GUI idle timeout, which affects SSH on both APIC and Switches: 1. Navigate to Admin >> AAA >> Security. 2. >>In Managementthe Work pane, choose Default Settings >> Edit. 23. In the Properties section, ensureset "Web Token Timeout (s)" is set to 300 or less.

V-271969 in V1R2

Check text

1. Navigate to Fabric >> Fabric Policies >> Fabric Security. 2. Expand "Policies". 3. Expand "Pod". 4. Expand "Date and Time". 5. Expand each "Date and Time Policy". 6. Verify at least two DOD-approved time sources are configured. Note: DOD-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DOD network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source. If Cisco ACI fabric does not use DOD-approved redundant NTP sources that use authentication that is cryptographically based, this is a finding.

Fix text

Create an NTP policy: 1. Navigate to Fabric >> Quickstart and click "Create an NTP Policy Link". 2. FillComplete out the form. - Provide a name for the policy. - Set the State to "Enabled". 3. Click "Next" to define the NTP Sources. 4. Define at least two DOD-approved time servers. Leave all the default options and click "OK". Refer to note below. 5. Navigate to Fabric >> Fabric Policies submenu >> Pods >> Policy Groups folder to add the NTP Policy to the appropriate Fabric Pod Policy or group to assign to one or more Pods in the fabric. 6. Right-click on the Policy Groups folder. Select an existing Pod Policy Group or create a new group. 7. Select the policy for NTP created in the previous step. 8. Navigate to Fabric >> Fabric Policies submenu >> Pods >> Profiles >> Pod Profile >> default. If needed, with the default Pod Selector selected in the navigation pane, change the Fabric Policy Group to the one created in the previous step. Note: DOD-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), USNO time servers, and/or GPS. The secondary time source must be located in a different geographic region than the primary time source.

V-271971 in V1R2

Check text

Review the AAA configuration: 1. In the GUI, on the menu bar, choose Admin >> AAA. 2. In the Navigation pane, click "Authentication" and then click the "RADIUS" tab. 3. Review the configuration for the configured AAA serverproviders. 4. Review the configuration of the Login Domain(s) used by the site. Note: The above configuration is an example using the RADIUS protocol. However, DOD sites may configure the options for LDAP, RADIUS, or TACACS+. Roles and user attributes such as limiting concurrent logins to 1 for remote system admins are also needed, but this configuration is done on the remote AAA server. If the Cisco ACI is not configured to use at leasta twoAAA authenticationprovider servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Fix text

In the APIC, configure redundant RADIUS providers:. 1. On the menu bar, choose Admin >> AAA. 2. In the Navigation pane, clickchoose "Authentication" and then click the "RADIUS" tab. 3. In the Work pane, choose Providers and click Actions >> Create RADIUS Provider. 4. SpecifyIn the RADIUSCreate hostProvider namescreen, (orenter the Hostname/IP address)Address, portDescription, protocol, and management endpoint group. 5. In the Navigation pane, choose Systema >>RADIUS Systemor SettingsTACACS+ >>as APICthe Connectivityrealm Preferences.from In the Workdrop-down pane, select "ooband"list. 6. RepeatProvide the aboveconfiguration steps for at least one other AAA serverdetails. Create the login domain for RADIUS: 1. In the Navigation pane, choose AAA Authentication >> Login Domains. 2. In the Work pane, choose Actions >> Create Login Domain. 3. Specify the login domain name, description, realm, and provider group as appropriate. Note: The above configuration is an example using the RADIUS protocol. However, DOD sites may configure the options for LDAP, RADIUS, or TACACS+.

V-271975 in V1R2