IOS XE router must be configured so inactive interfaces are disabled.
An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use. If an interface is no longer used, the configuration must be deleted and the interface disabled. For sub-interfaces, delete sub-interfaces that are on inactive interfaces and delete sub-interfaces that are themselves inactive. If the sub-interface is no longer necessary for authorized communications, then it must be deleted.
Configure the Cisco
IOS XE router so that all inactive sub-interfaces are deleted, and disable and delete the configuration of any inactive ports on the router. To shut down an interface see the following commands:
ISR4000(config) #Interface GigabitEthernet 0/0/1
To clear the configuration of an inactive interface, use the following command:
ISR4000 (config) #default interface GigabitEthernet 0/0/1
View the configuration of the Cisco
IOS XE router. The configuration should look similar to the example below:
no ip address
If an interface is not being used, but is configured or enabled, this is a finding.