What changed in Cisco IOS XE Switch NDM STIG V3R6V3R6 changes

Fix text

Configure the switch to log account creation using the following commands: SW4(config)#archive SW4(config-archive)#log config SW4(config-archive-log-cfg)#logging enable SW4(config-archive-log-cfg)#logging size 1000 SW4(config-archive-log-cfg)#notify syslog contenttype plaintext SW4(config-archive-log-cfg)#hidekeys SW4(config-archive-log-cfg)#end

V-220519 in V3R6

Fix text

Configure the switch to log account modification using the following commands: SW4(config)#archive SW4(config-archive)#log config SW4(config-archive-log-cfg)#logging enable SW4(config-archive-log-cfg)#logging size 1000 SW4(config-archive-log-cfg)#notify syslog contenttype plaintext SW4(config-archive-log-cfg)#hidekeys SW4(config-archive-log-cfg)#end

V-220520 in V3R6

Fix text

Configure the switch to log account disabling using the following commands: SW4(config)#archive SW4(config-archive)#log config SW4(config-archive-log-cfg)#logging enable SW4(config-archive-log-cfg)#logging size 1000 SW4(config-archive-log-cfg)#notify syslog contenttype plaintext SW4(config-archive-log-cfg)#hidekeys SW4(config-archive-log-cfg)#end

V-220521 in V3R6

Fix text

Configure the switch to log account removal using the following commands: SW4(config)#archive SW4(config-archive)#log config SW4(config-archive-log-cfg)#logging enable SW4(config-archive-log-cfg)#logging size 1000 SW4(config-archive-log-cfg)#notify syslog contenttype plaintext SW4(config-archive-log-cfg)#hidekeys SW4(config-archive-log-cfg)#end

V-220522 in V3R6

Fix text

Configure the switch to log administrator activity as shown in the example below: SW1(config)#logging userinfo SW1(config)#archive SW1(config-archive)#log config SW1(config-archive-log-cfg)#logging enable SW1(config-archive-log-cfg)#logging size 1000 SW1(config-archive-log-cfg)#notify syslog contenttype plaintext SW1(config-archive-log-cfg)#hidekeys SW1(config-archive-log-cfg)#end

V-220526 in V3R6

Fix text

Configure the Cisco switch to log all configuration changes as shown in the example below: SW4(config)#archive SW4(config-archive)#log config SW4(config-archive-log-cfg)#logging enable SW4(config-archive-log-cfg)#logging size 1000 SW4(config-archive-log-cfg)#notify syslog contenttype plaintext SW4(config-archive-log-cfg)#hidekeys SW4(config-archive-log-cfg)#end

V-220530 in V3R6

Fix text

Configure the switch to log account enabling using the following commands: SW4(config)#archive SW4(config-archive)#log config SW4(config-archive-log-cfg)#logging enable SW4(config-archive-log-cfg)#logging size 1000 SW4(config-archive-log-cfg)#notify syslog contenttype plaintext SW4(config-archive-log-cfg)#hidekeys SW4(config-archive-log-cfg)#end

V-220545 in V3R6

Fix text

Configure the Cisco switch to generate log records when administrator privileges are deleted as shown in the example below: SW4(config)#archive SW4(config-archive)#log config SW4(config-archive-log-cfg)#logging enable SW4(config-archive-log-cfg)#logging size 1000 SW4(config-archive-log-cfg)#notify syslog contenttype plaintext SW4(config-archive-log-cfg)#hidekeys SW4(config-archive-log-cfg)#end

V-220559 in V3R6

Fix text

Configure the Cisco switch to generate log records for privileged activities as shown in the example below: SW4(config)#archive SW4(config-archive)#log config SW4(config-archive-log-cfg)#logging enable SW4(config-archive-log-cfg)#logging size 1000 SW4(config-archive-log-cfg)#notify syslog contenttype plaintext SW4(config-archive-log-cfg)#hidekeys SW4(config-archive-log-cfg)#end

V-220561 in V3R6

Check text

Review the Cisco switch configuration to verify the device is configured to use at least two authentication servers as the primary source for authentication as shown in the following example: aaa new-model ! aaa group server radius RADIUS_GROUP server name RADIUS1 server name RADIUS2 ! aaa authentication login CONSOLE group radiusRADIUS_GROUP local aaa authentication login LOGIN_AUTHENTICATION group radiusRADIUS_GROUP local … … … ip http authentication aaa login-authentication LOGIN_AUTHENTICATION ip http secure-server … … … radius- server hostRADIUS1 address ipv4 x.x.x.x auth-port 1812 acct-port 1813 key xxxxxxx ! radius- server hostRADIUS2 address ipv4 x.x.x.x auth-port 1812 acct-port 1813 key xxxxxxx … … … line con 0 exec-timeout 5 0 login authentication CONSOLE line vty 0 1 exec-timeout 5 0 login authentication LOGIN_AUTHENTICATION If the Cisco switch is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Fix text

Step 1: Configure the Cisco switch to use at least two authentication servers as shown in the following example: R4(config)#radius hostserver 10RADIUS1 R4(config-radius-server)#address ipv4 x.1x.48x.2x auth-port 1812 acct-port 1813 R4(config-radius-server)#key xxxxxxxxxxxxx R4(config-radius-server)#radius hostserver 10RADIUS2 R4(config-radius-server)#address ipv4 x.1x.48x.3x auth-port 1812 acct-port 1813 R4(config-radius-server)#key xxxxxxxxxxxxx Step 2: Configure the authentication order to use the authentication servers as the primary source for authentication as shown in the following example: R4(config)#aaa group server radius RADIUS_GROUP R4(config)#server name RADIUS1 R4(config)#server name RADIUS2 R4(config)#aaa authentication login CONSOLE group radiusRADIUS_GROUP local R4(config)#aaa authentication login LOGIN_AUTHENTICATION group radiusRADIUS_GROUP local Step 3: Configure all network connections associated with a device management to use the authentication servers for the purpose of login authentication. R4(config)#line vty 0 1 R4(config-line)#login authentication LOGIN_AUTHENTICATION R4(config-line)#exit R4(config)#line con 0 R4(config-line)#login authentication CONSOLE R4(config-line)#exit R4(config)#ip http authentication aaa login-authentication LOGIN_AUTHENTICATION

V-220565 in V3R6

Check text

Review the Cisco switch configuration to verify that it is compliantconfigured withto thisautomatically requirementback up its running configuration to a remote server when a change is made. The example configuration below will send the configuration to a SCP server when a configuration change occurs. eventVerify managerthat an Embedded Event Manager (EEM) applet BACKUP_CONFIG is eventconfigured to trigger on the syslog patternmessage "%SYS-5-CONFIG_I". Verify actionthe 1EEM infoapplet typecontains switchname an action 2to clicopy commandthe "enable" running actionconfiguration 3to clia secure server (e.g., SCP). Verify the command "copyauthorization runbypass scp"is patternpresent "remotewithin host" the actionapplet 4to cliensure commandit "xexecutes correctly under AAA.x.x.x" Verify patternthe "filename"global command file prompt quiet is configured to prevent the applet from timing out. Verify actionthe 5authentication climethod used for the file transfer: The command "copy running-config scp://&ltusername>@&ltx.x.x.x>/&ltpath_on_server>/$_info_switchname_info_routername-running-config". Note: actionThe 6absence syslogof prioritya informationalpassword msgindicates "Configurationthe backupuse wasof executed"secure public/private key authentication. If the Cisco switch is not configured to conduct automated backups of the configuration when changes occur, or if it does so using an insecure method like a cleartext password, this is a finding.

Fix text

Configure the Cisco switch to send the configuration to aan SCP server when a configuration change occurs. asThe shownrecommended inand themost examplesecure below:method is to use public/private key authentication. SW4(config)# ip scp server enable SW4(config)# file prompt quiet SW4(config)# event manager applet BACKUP_CONFIG SW4(config-applet)# event syslog pattern "%SYS-5-CONFIG_I" SW4(config-applet)# action 1 cli command "enable" SW4(config-applet)# action 2 info type switchnameroutername SW4(config-applet)# action 3 cli command "copy run scp" pattern "remote host" SW4(configrunning-applet)#actionconfig 4 cli command "xscp://&ltusername>@&ltx.x.x.x" pattern "filename" SW4(config-applet)#action 5 cli command ">/&ltpath_on_server>/$_info_switchname_info_routername-running-config" SW4(config-applet)# action 64 syslog priority informational msg "Configuration backup was executed for $_info_routername" SW4(config-applet)# authorization bypass SW4(config-applet)# end

V-220566 in V3R6