Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The Cisco ACI must use DOD-approved Network Time Protocol (NTP) sources that use authentication that is cryptographically based.
Description
Discussion Text
If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to Cisco ACIs, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source.
Time synchronization plays a critical role in the ACI fabric. From validating certificates, to keeping log files across devices consistent, it is strongly encouraged to sync the ACI fabric to redundant time sources. Simply creating an NTP policy does not apply it to the fabric. This policy will need to be updated to a "Pod Policy".
Do not enable the NTP server option that allows the leaf switches to serve time requests to downstream endpoints. Using a Bridge Domain SVI (Subnet IP) as an NTP Source for downstream clients is not recommended. When a leaf switch is enabled as NTP server, it will respond on any interface. Issues can arise when attempting to use the SVI address of a leaf, rather than the management IP.
Time synchronization plays a critical role in the ACI fabric. From validating certificates, to keeping log files across devices consistent, it is strongly encouraged to sync the ACI fabric to redundant time sources. Simply creating an NTP policy does not apply it to the fabric. This policy will need to be updated to a "Pod Policy".
Do not enable the NTP server option that allows the leaf switches to serve time requests to downstream endpoints. Using a Bridge Domain SVI (Subnet IP) as an NTP Source for downstream clients is not recommended. When a leaf switch is enabled as NTP server, it will respond on any interface. Issues can arise when attempting to use the SVI address of a leaf, rather than the management IP.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.