V-74105
The Cisco IOSISR XE4000 Series router must be configured so inactive interfaces are disabled.
Discussion
An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use. If an interface is no longer used, the configuration must be deleted and the interface disabled. For sub-interfaces, delete sub-interfaces that are on inactive interfaces and delete sub-interfaces that are themselves inactive. If the sub-interface is no longer necessary for authorized communications, then it must be deleted.
Fix Text
Configure the Cisco IOSISR XE4000 Series router so that all inactive sub-interfaces are deleted, and disable and delete the configuration of any inactive ports on the router. To shut down an interface see the following commands:
ISR4000 (config) #Interface GigabitEthernet 0/0/1
ISR4000(config-if) #shutdown
To clear the configuration of an inactive interface, use the following command:
ISR4000 (config) #default interface GigabitEthernet 0/0/1
Check Content
View the configuration of the Cisco IOSISR XE4000 Series router. The configuration should look similar to the example below:
interface GigabitEthernet0/0/0
no ip address
shutdown
If an interface is not being used, but is configured or enabled, this is a finding.