Free DISA STIG and SRG Library | Vaulted

V-74105

The Cisco IOSISR XE4000 Series router must be configured so inactive interfaces are disabled.

Finding ID
CISR-RT-000005
Rule ID
SV-88779r2_rule88779r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000019-RTR-000007
CCI
CCI-001414
Target Key
(None)
Documentable
No
Discussion

An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use. If an interface is no longer used, the configuration must be deleted and the interface disabled. For sub-interfaces, delete sub-interfaces that are on inactive interfaces and delete sub-interfaces that are themselves inactive. If the sub-interface is no longer necessary for authorized communications, then it must be deleted.

Fix Text

Configure the Cisco IOSISR XE4000 Series router so that all inactive sub-interfaces are deleted, and disable and delete the configuration of any inactive ports on the router. To shut down an interface see the following commands: ISR4000 (config) #Interface GigabitEthernet 0/0/1 ISR4000(config-if) #shutdown To clear the configuration of an inactive interface, use the following command: ISR4000 (config) #default interface GigabitEthernet 0/0/1

Check Content

View the configuration of the Cisco IOSISR XE4000 Series router. The configuration should look similar to the example below: interface GigabitEthernet0/0/0 no ip address shutdown If an interface is not being used, but is configured or enabled, this is a finding.