What changed in Cisco IOS XR Router RTR STIG V3R3V3R3 changes

Cisco IOS XR Router RTR STIG V3R3 (2025-10-01) replaced V3R2 (2024-10-24): 5 checks updated. It has 96 checks, against 96 in V3R2.

V3R3 checklistV3R2 checklist Compare V3R2 and V3R3 in STIG Compare

  • 0 added
  • 0 removed
  • 5 updated

Updated fields: Check text 5Fix text 5

Updated in V3R3 (5)

V-230147CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop header with invalid option type values.Check text, Fix text

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration to determine if it is compliant with this requirement. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface interface gigabitethernet 0/2/0/2 ipv6 address 2001::1:0:22/64 ipv6 access-group FILTER_IPV6 ingress Step 2: Verify that the ACL drops IPv6 packets containing a Hop-by-Hop header with optiondestination typeoptions values of 0x04 (Tunnel Encapsulation Limit), 0xC9 (Home Address Destination), or 0xC3 (NSAP Address) as shown in the example below. ipv6 access-list FILTER_IPV6 10 deny hbh any any dest-option-type 4 log 20 denypermit hbhipv6 any… any… dest-option-type… 195 log… 3090 deny hbhipv6 any any log Note: Cisco has deprecated the dest-option-type home-addresscommand logused to 40filter permitby ipv6option … type … within … the … Hop-by-Hop 90header. denyTherefore, ipv6all anypackets anywith logthe Hop-by-Hop header option types must be dropped. If the router is not configured to drop IPv6 packets containing a Hop-by-Hop header with invaliddestination option type valuesoptions, this is a finding.

Fix text

Drop IPv6 packets containing a Hop-by-Hop header as shown in the example below. RP/0/0/CPU0:R3(config)# ipv6 access-list FILTER_IPV6 RP/0/0/CPU0:R3(config-ipv6-acl)# deny hbh any any dest-option-type 4 log RP/0/0/CPU0:R3(config-ipv6-acl)# deny hbh any any dest-option-type 195 log RP/0/0/CPU0:R3(config-ipv6-acl)# deny hbh any any dest-option-type home-address log RP/0/0/CPU0:R3(config-ipv6-acl)# permit ipv6 … … … … RP/0/0/CPU0:R3(config-ipv6-acl)# deny ipv6 any any log RP/0/0/CPU0:R3(config-ipv6-acl)# exit RP/0/0/CPU0:R3(config)# interface gigabitethernet 0/2/0/2 RP/0/0/CPU0:R3(config-if)# ipv6 access-group FILTER_IPV6 ingress RP/0/0/CPU0:R3(config-if)# end

V-230147 in V3R3

V-230151CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing a Destination Option header with invalid option type values.Check text, Fix text

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration to determine if it is compliant with this requirement. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface interface gigabitethernet 0/2/0/2 ipv6 address 2001::1:0:22/64 ipv6 access-group FILTER_IPV6 ingress Step 2: Verify that the ACL drops IPv6 packets containing a Destination Option header with option type values of 0x05 (Router Alert) or 0xC2 (Jumbo Payload) as shown in the example below. ipv6 access-list FILTER_IPV6 10 deny 60 any any dest-option-type 5 log 20 deny 60 any any dest-option-type 194 log 30 permit ipv6 … … … … 90 deny ipv6 any any log IfNote: theCisco routerhas isdeprecated notthe configureddest-option-type command used to dropfilter IPv6by packetsoption containingtype awithin the Destination Option header. Therefore, all packets with optionthe typeDestination valuesOption ofheader 0x05must (Routerbe Alert)dropped. If orthe 0xC2router (Jumbois Payload)not configured to drop IPv6 packets containing a Destination Option header, this is a finding.

Fix text

Configure the router to drop IPv6 packets containing a Destination Option header with option type values of 0x05 (Router Alert) or 0xC2 (Jumbo Payload) as shown in the example below. RP/0/0/CPU0:R3(config)# ipv6 access-list FILTER_IPV6 RP/0/0/CPU0:R3(config-ipv6-acl)# deny 60 any any dest-option-type 5 log RP/0/0/CPU0:R3(config-ipv6-acl)# deny 60 any any dest-option-type 194 log RP/0/0/CPU0:R3(config-ipv6-acl)# permit ipv6 … … … … RP/0/0/CPU0:R3(config-ipv6-acl)# deny ipv6 any any log RP/0/0/CPU0:R3(config-ipv6-acl)# exit RP/0/0/CPU0:R3(config)# interface gigabitethernet 0/2/0/2 RP/0/0/CPU0:R3(config-if)# ipv6 access-group FILTER_IPV6 ingress RP/0/0/CPU0:R3(config-if)# end

V-230151 in V3R3

V-230154CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing an extension header with the Endpoint Identification option.Check text, Fix text

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration to determine if it is compliant with this requirement. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface interface gigabitethernet 0/2/0/2 ipv6 address 2001::1:0:22/64 ipv6 access-group FILTER_IPV6 ingress Step 2: Verify that the ACL drops IPv6 packets containing ana extensionDestination Option header with the Endpoint Identification option as shown in the example below. ipv6 access-list FILTER_IPV6 10 deny 60 any any dest-option-type 138 log 20 permit ipv6 … … … … 90 deny ipv6 any any log Note: Cisco has deprecated the dest-option-type command used to filter by option type within the Destination Option header. Therefore, all packets with the Destination Option header must be dropped. If the router is not configured to drop IPv6 packets containing ana extensionDestination headerOption with the Endpoint Identification optionheader, this is a finding.

Fix text

Configure the router to drop IPv6 packets containing an option type valuesvalue of 0x8A (Endpoint Identification) regardless of whether it appears in a Hop-by-Hop or Destination Option header as shown in the example below. RP/0/0/CPU0:R3(config)# ipv6 access-list FILTER_IPV6 RP/0/0/CPU0:R3(config-ipv6-acl)# deny 60 any any dest-option log RP/0/0/CPU0:R3(config-typeipv6-acl)# 138deny hbh any any dest-option log RP/0/0/CPU0:R3(config-ipv6-acl)# permit ipv6 … … … … RP/0/0/CPU0:R3(config-ipv6-acl)# deny ipv6 any any log RP/0/0/CPU0:R3(config-ipv6-acl)# exit RP/0/0/CPU0:R3(config)# interface gigabitethernet 0/2/0/2 RP/0/0/CPU0:R3(config-if)# ipv6 access-group FILTER_IPV6 ingress RP/0/0/CPU0:R3(config-if)# end

V-230154 in V3R3

V-230157CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing the NSAP address option within Destination Option header.Check text, Fix text

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration andto determine if filtersit areis boundcompliant towith thethis applicable interfaces to drop IPv6 packets containing the NSAP address option within Destination Option headerrequirement. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface interface gigabitethernet 0/2/0/2 ipv6 address 2001::1:0:22/64 ipv6 access-group FILTER_IPV6 ingress Step 2: Verify that the ACL drops IPv6 packets containing thea NSAP address option within Destination Option header as shown in the example below. ipv6 access-list FILTER_IPV6 10 deny 60 any any dest-option-type 195 log 20 permit ipv6 … … … … 90 deny ipv6 any any log Note: Cisco has deprecated the dest-option-type command used to filter by option type within the Destination Option header. Therefore, all packets with the Destination Option header must be dropped. If the router is not configured to drop IPv6 packets containing thea NSAP address option within Destination Option header, this is a finding.

Fix text

Configure the router to drop IPv6 packets containing a Destination Option header with option type value of 0xC3 (NSAP address) as shown in the example below. RP/0/0/CPU0:R3(config)# ipv6 access-list FILTER_IPV6 RP/0/0/CPU0:R3(config-ipv6-acl)# deny 60 any any dest-option-type 195 log RP/0/0/CPU0:R3(config-ipv6-acl)# permit ipv6 … … … … RP/0/0/CPU0:R3(config-ipv6-acl)# deny ipv6 any any log RP/0/0/CPU0:R3(config-ipv6-acl)# exit RP/0/0/CPU0:R3(config)# interface gigabitethernet 0/2/0/2 RP/0/0/CPU0:R3(config-if)# ipv6 access-group FILTER_IPV6 ingress RP/0/0/CPU0:R3(config-if)# end

V-230157 in V3R3

V-230160CAT IIThe Cisco perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type.Check text, Fix text

Check text

This requirement is not applicable for the DODIN Backbone. Review the router configuration and determine if filters are bound to the applicable interfaces to drop all inbound IPv6 packets containing an undefined option type value regardless of whether they appear in a Hop-by-Hop or Destination Option header. Undefined values are 0x02, 0x03, 0x06, 0x9 – 0xE, 0x10 – 0x22, 0x24, 0x25, 0x27 – 0x2F, and 0x31 – 0xFF. Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface. interface interface gigabitethernet 0/2/0/2 ipv6 address 2001::1:0:22/64 ipv6 access-group FILTER_IPV6 ingress Step 2: Verify that the ACL drops IPv6 packets containing a Hop-by-Hop or Destination Option extension headerheaders with an undefined option type as shown in the example below. ipv6 access-list FILTER_IPV6 10 deny any any dest-option-type 2 20 deny any any dest-option-type 3 30 deny any any dest-option-type 6 40 deny any any dest-option-type 9 50 deny any any dest-option-type 10 60 deny any any dest-option-type 11log 7020 deny anyhbh any dest-option-type 12 80 deny any any dest-option-type 13log 9030 deny any any dest-option-type 14 100 deny any any dest-option-type 16 … 280 deny any any dest-option-type 34 290 deny any any dest-option-type 36 300 deny any any dest-option-type 37 310 deny any any dest-option-type 39 … 390 deny any any dest-option-type 47 400 deny any any dest-option-type 49 … nnn deny any any dest-option-type 255 nnn permit … … … … nnn90 deny ipv6 any any log Note: BecauseCisco hop-by-hophas anddeprecated destination options have the samedest-option-type exactcommand headerused format,to theyfilter canby beoption combinedtype underwithin the dest-option-typeDestination keyword.Option Sinceand Hop-by-Hop andheader. DestinationTherefore, Optionall headerspackets havewith non-overlappingthe types,Destination youOption canheader useand destHop-optionby-typeHop tooptions matchmust eitherbe dropped. If the router is not configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension headerheaders with andestination undefined option typeoptions, this is a finding.

Fix text

Configure the router to drop all inbound IPv6 packets containing an undefined option type valuevalues regardless of whether they appear in a Hop-by-Hop or Destination Option header as shown in the example below. RP/0/0/CPU0:R3(config)# ipv6 access-list FILTER_IPV6 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any60 any dest-option-type 2 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 3log RP/0/0/CPU0:R3(config-ipv6-acl)# deny anyhbh any dest-option-type 6 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 9log RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 10 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 11 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 12 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 13 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 14 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 16 … RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 34 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 36 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 37 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 39 … RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 47 RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 49 … RP/0/0/CPU0:R3(config-ipv6-acl)# deny any any dest-option-type 255 RP/0/0/CPU0:R3(config-ipv6-acl)# permit ipv6 … … … … RP/0/0/CPU0:R3(config-ipv6-acl)# deny ipv6 any any log RP/0/0/CPU0:R3(config-ipv6-acl)# exit RP/0/0/CPU0:R3(config)# interface gigabitethernet 0/2/0/2 RP/0/0/CPU0:R3(config-if)# ipv6 access-group FILTER_IPV6 ingress RP/0/0/CPU0:R3(config-if)# end

V-230160 in V3R3

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R3 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.