What changed in Cisco IOS XE Router RTR STIG V3R5V3R5 changes

Cisco IOS XE Router RTR STIG V3R5 (2025-10-01) replaced V3R4 (2025-07-02): 5 checks updated. It has 97 checks, against 97 in V3R4.

V3R5 checklistV3R4 checklist Compare V3R4 and V3R5 in STIG Compare

  • 0 added
  • 0 removed
  • 5 updated

Updated fields: Check text 5Fix text 5Discussion 5

Updated in V3R5 (5)

V-230146CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop header with invalid option type values.Check text, Fix text, Discussion

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration to determine if it is compliant with this requirement. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface gigabitethernet1/0 ipv6 address 2001::1:0:22/64 ipv6 traffic-filter FILTER_IPV6 in Step 2: Verify that the ACL drops IPv6 packets containing a Hop-by-Hop header with optiondestination typeoptions values of 0x04 (Tunnel Encapsulation Limit), 0xC9 (Home Address Destination), or 0xC3 (NSAP Address) as shown in the example below. ipv6 access-list FILTER_IPV6 deny hbh any any dest-option-type 4 log permit ipv6 … … … … deny hbhipv6 any any log Note: Cisco has deprecated the dest-option-type 195command log used denyto hbhfilter anyby any dest-option- type homewithin the Hop-addressby-Hop logheader. Therefore, permitall ipv6packets … with … the … Hop-by-Hop … header denyoption ipv6types anymust anybe logdropped. If the router is not configured to drop IPv6 packets containing a Hop-by-Hop header with invaliddestination option type valuesoptions, this is a finding.

Fix text

Drop IPv6 packets containing a Hop-by-Hop header as shown in the example below. R1(config)#ipv6 access-list FILTER_IPV6 R1(config-ipv6-acl)#deny hbh any any dest-option-type 4 log R1(config-ipv6-acl)#deny hbh any any dest-option-type 195 log R1(config-ipv6-acl)#deny hbh any any dest-option-type home-address log R1(config-ipv6-acl)# permit ipv6 … … … … R1(config-ipv6-acl)#deny ipv6 any any log R1(config-ipv6-acl)#exit R1(config)#int g1/0 R1(config-if)#ipv6 traffic-filter FILTER_IPV6 R1(config-if)#end

Discussion

These options are intended to be for the Destination Options header only. The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize and hence could cause a Denial-denial of-Service service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large.

V-230146 in V3R5

V-230150CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing a Destination Option header with invalid option type values.Check text, Fix text, Discussion

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration to determine if it is compliant with this requirement. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface gigabitethernet1/0 ipv6 address 2001::1:0:22/64 ipv6 traffic-filter FILTER_IPV6 in Step 2: Verify that the ACL drops IPv6 packets containing a Destination Option header with option type values of 0x05 (Router Alert) or 0xC2 (Jumbo Payload) as shown in the example below. ipv6 access-list FILTER_IPV6 deny 60 any any dest-option-type 5 log deny 60 any any dest-option-type 194 log permit ipv6 … … … … deny ipv6 any any log IfNote: theCisco routerhas isdeprecated notthe configureddest-option-type command used to dropfilter IPv6by packetsoption containingtype awithin the Destination Option header. Therefore, all packets with optionthe typeDestination valuesOption ofheader 0x05must (Routerbe Alert)dropped. If orthe 0xC2router (Jumbois Payload)not configured to drop IPv6 packets containing a Destination Option header, this is a finding.

Fix text

Configure the router to drop IPv6 packets containing a Destination Option header with option type values of 0x05 (Router Alert) or 0xC2 (Jumbo Payload) as shown in the example below. R1(config)#ipv6 access-list FILTER_IPV6 R1(config-ipv6-acl)#deny 60 any any dest-option-type 5 log R1(config-ipv6-acl)#deny 60 any any dest-option-type 194 log R1(config-ipv6-acl)#permit … … … … R1(config-ipv6-acl)#deny ipv6 any any log R1(config-ipv6-acl)#exit R1(config)#int g1/0 R1(config-if)#ipv6 traffic-filter FILTER_IPV6 R1(config-if)#end

Discussion

These options are intended to be for the Hop-by-Hop header only. The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize. Hence, this could cause a Denial-denial of-Service service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large.

V-230150 in V3R5

V-230153CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing an extension header with the Endpoint Identification option.Check text, Fix text, Discussion

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration to determine if it is compliant with this requirement. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface gigabitethernet1/0 ipv6 address 2001::1:0:22/64 ipv6 traffic-filter FILTER_IPV6 in Step 2: Verify that the ACL drops IPv6 packets containing ana extensionDestination Option header with the Endpoint Identification option as shown in the example below. ipv6 access-list FILTER_IPV6 deny 60 any any dest-option-type 138 log permit ipv6 … … … … deny ipv6 any any log Note: Cisco has deprecated the dest-option-type command used to filter by option type within the Destination Option header. Therefore, all packets with the Destination Option header must be dropped. If the router is not configured to drop IPv6 packets containing ana extensionDestination headerOption with the Endpoint Identification optionheader, this is a finding.

Fix text

Configure the router to drop IPv6 packets containing an option type valuesvalue of 0x8A (Endpoint Identification) regardless of whether it appears in a Hop-by-Hop or Destination Option header as shown in the example below. R1(config)#ipv6 access-list FILTER_IPV6 R1(config-ipv6-acl)#deny 60 any any dest-option log R1(config-typeipv6-acl)#deny 138hbh any any dest-option log R1(config-ipv6-acl)#permit ipv6 … … … … R1(config-ipv6-acl)# deny ipv6 any any log R1(config-ipv6-acl)#exit R1(config)#int g1/0 R1(config-if)#ipv6 traffic-filter FILTER_IPV6 R1(config-if)#end

Discussion

The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize, and hence could cause a Denial-denial of-Service service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large. This option type is associated with the Nimrod Routing system and has no defining RFC document.

V-230153 in V3R5

V-230156CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing the NSAP address option within Destination Option header.Check text, Fix text, Discussion

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration andto determine if filtersit areis boundcompliant to the applicable interfaces to drop IPv6 packets containing a Destination Option header with optionthis type value of 0xC3 (NSAP address)requirement. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface gigabitethernet1/0 ipv6 address 2001::1:0:22/64 ipv6 traffic-filter FILTER_IPV6 in Step 2: Verify that the ACL drops IPv6 packets containing thea NSAP address option within Destination Option header as shown in the example below. ipv6 access-list FILTER_IPV6 deny 60 any any dest-option-type 195 log permit ipv6 … … … … deny ipv6 any any log Note: Cisco has deprecated the dest-option-type command used to filter by option type within the Destination Option header. Therefore, all packets with the Destination Option header must be dropped. If the router is not configured to drop IPv6 packets containing thea NSAP address option within Destination Option header, this is a finding.

Fix text

Configure the router to to drop IPv6 packets containing thea NSAP address option within Destination Option header as shown in the example below. R1(config)#ipv6 access-list FILTER_IPV6 R1(config-ipv6-acl)#deny 60 any any dest-option-type 195 log R1(config-ipv6-acl)#permit … … … … R1(config-ipv6-acl)# deny ipv6 any any log R1(config-ipv6-acl)#exit R1(config)#int g1/0 R1(config-if)#ipv6 traffic-filter FILTER_IPV6 R1(config-if)#end

Discussion

The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize, and hence could cause a Denial-denial of-Service service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large. This option type from RFC 1888 (OSI NSAPs and IPv6) has been deprecated by RFC 4048.

V-230156 in V3R5

V-230159CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type.Check text, Fix text, Discussion

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration andto determine if filtersit areis boundcompliant towith thethis applicable interfaces to drop all inbound IPv6 packets containing an undefined option type value regardless of whether they appear in a Hop-by-Hop or Destination Option headerrequirement. Undefined values are 0x02, 0x03, 0x06, 0x9 – 0xE, 0x10 – 0x22, 0x24, 0x25, 0x27 – 0x2F, and 0x31 – 0xFF. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface gigabitethernet1/0 ipv6 address 2001::1:0:22/64 ipv6 traffic-filter FILTER_IPV6 in Step 2: Verify that the ACL drops IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type as shown in the example below. ipv6 access-list FILTER_IPV6 deny any60 any dest-option-type 2 deny any any dest-option-type 3log deny anyhbh any dest-option-type 6 deny any any dest-option-type 9log denypermit anyipv6 any dest-option-type 10… deny any any dest-option-type 11… deny any any dest-option-type 12… deny any any dest-option-type 13… deny anyipv6 any dest-option-type 14 deny any any dest-option-type 16log … Note: denyCisco anyhas anydeprecated dest-option-typethe 34 deny any any dest-option-type 36 command denyused anyto anyfilter dest-option-typeby 37 deny any any dest-option-type 39 … deny any any dest-option-type 47 within denythe anyDestination anyOption dest-option-typeand 49 … deny any any destHop-option-type 255 permit … … … … deny ipv6 any any log Note: Because hop-by-hopHop and destination options have the same exact header. formatTherefore, theyall canpackets bewith combined under the dest-option-typeDestination keyword.Option Sinceheader and Hop-by-Hop andoptions Destinationmust Optionbe headers have non-overlapping types, you can use dest-option-type to match eitherdropped. If the router is not configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type, this is a finding.

Fix text

Configure the router to drop all inbound IPv6 packets containing andestination undefined option type valuevalues regardless of whether they appear in a Hop-by-Hop or Destination Option header as shown in the example below. R1(config)#ipv6 access-list FILTER_IPV6 R1(config-ipv6-acl)#deny any60 any dest-option-type 2 R1(config-ipv6-acl)#deny any any dest-option-type 3log R1(config-ipv6-acl)#deny anyhbh any dest-option-type 6 R1(config-ipv6-acl)#deny any any dest-option-type 9log R1(config-ipv6-acl)#deny any any dest-option-type 10 R1(config-ipv6-acl)#deny any any dest-option-type 11 R1(config-ipv6-acl)#deny any any dest-option-type 12 R1(config-ipv6-acl)#deny any any dest-option-type 13 R1(config-ipv6-acl)#deny any any dest-option-type 14 R1(config-ipv6-acl)#deny any any dest-option-type 16 … R1(config-ipv6-acl)#deny any any dest-option-type 34 R1(config-ipv6-acl)#deny any any dest-option-type 36 R1(config-ipv6-acl)#deny any any dest-option-type 37 R1(config-ipv6-acl)#deny any any dest-option-type 39 … R1(config-ipv6-acl)#deny any any dest-option-type 47 R1(config-ipv6-acl)#deny any any dest-option-type 49 … R1(config-ipv6-acl)#deny any any dest-option-type 255 R1(config-ipv6-acl)#permit … … … … R1(config-ipv6-acl)#deny ipv6 any any log R1(config-ipv6-acl)#exit R1(config)#int g1/0 R1(config-if)#ipv6 traffic-filter FILTER_IPV6 R1(config-if)#end

Discussion

The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize, and hence could cause a Denial-denial of-Service service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large.

V-230159 in V3R5

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R5 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.