Free DISA STIG and SRG Library | Vaulted

V-220513

The Cisco switch must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.

Finding ID
CISC-ND-001370
Rule ID
SV-220513r604141_rule
Severity
Cat I
CCE
(None)
Group Title
SRG-APP-000516-NDM-000336
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Centralized management of user accounts and authentication increases the administrative access to the switch. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrator account access to the organization's network devices can be more readily analyzed for trends and anomalies. The alternative method of defining administrator accounts on each device exposes the device configuration to remote access authentication attacks and system administrators with multiple authenticators for each network device.

Fix Text

Configure the Cisco switch to use an authentication server as shown in the following example: Step 1: Define the authentication server. SW1(config)# radius-server host 10.1.48.10 key xxxxxx Step 2: Configure the AAA group. SW1(config)# aaa group server radius RADIUS_SERVERS SW1(config-radius)# server 10.1.48.10 Step 3: Use the AAA server for login authentication for both in-band and console access methods. SW1(config)# aaa authentication login default group RADIUS_SERVERS SW1(config)# aaa authentication login console group RADIUS_SERVERS

Check Content

Review the Cisco switch configuration to verify that the device is configured to use an authentication server as primary source for authentication. Step 1: Verify that an AAA server group is configured for login authentication for both in-band and console access methods. aaa authentication login default group RADIUS_SERVERS aaa authentication login console group RADIUS_SERVERS Step 2: Verify that an AAA server has been defined for the server group as shown in the example below: radius-server host 10.1.48.10 key 7 "xxxxxx" authentication accounting aaa group server radius RADIUS_SERVERS server 10.1.48.10 If the Cisco switch is not configured to use an authentication server for the purpose of authenticating users prior to granting administrative access, this is a finding.