Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The Cisco ACI must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
Description
Discussion Text
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable unused or unnecessary physical and logical ports/protocols on information systems.
By default, Cisco ACI only exposes two ports from the outside:
- HTTPS (TCP 443) for GUI access and REST API access, on both the APIC and switches.
- SSH (TCP 22) for CLI access, on both the APIC and switches.
Cisco ACI enables Link Layer Discovery Protocol (LLDP) by default to support zero-touch fabric provisioning. DOD sites may keep LLDP enabled on trusted interfaces for loop prevention and VMM integration. Sites must disable LLDP on interfaces facing untrusted networks.
Cisco ACI is designed not to run nonrequired services by default, as well as to limit remote management services or protocols that are active by default. Hence, there is no action required from an administrator standpoint to disable them. If any other protocol is required, such as SNMP, administrators must explicitly configure it.
By default, Cisco ACI only exposes two ports from the outside:
- HTTPS (TCP 443) for GUI access and REST API access, on both the APIC and switches.
- SSH (TCP 22) for CLI access, on both the APIC and switches.
Cisco ACI enables Link Layer Discovery Protocol (LLDP) by default to support zero-touch fabric provisioning. DOD sites may keep LLDP enabled on trusted interfaces for loop prevention and VMM integration. Sites must disable LLDP on interfaces facing untrusted networks.
Cisco ACI is designed not to run nonrequired services by default, as well as to limit remote management services or protocols that are active by default. Hence, there is no action required from an administrator standpoint to disable them. If any other protocol is required, such as SNMP, administrators must explicitly configure it.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.