IOS-XE baseline standard
IOS-XE baseline standard
Section titled “IOS-XE baseline standard”A baseline standard is the set of values every device of one type should have: the same DNS and NTP servers, the same admin account, the same management access. This page walks through the stock baseline standard, ios-baseline.policy, one section at a time. Import it with Import Templates (see importing a stock template), then edit the values to match your own.
The definition has eleven blocks, one per section. Each block is one rule, so the compliance report shows a result per section. The definition needs rConfig 8.3.0 or later, because the VTY section uses evaluate_block.
How the sections match
Section titled “How the sections match”- Array sections (
must_match_all_from_array) pass when every listed line appears somewhere in the config. Each line is matched as text, not as a whole line:ntp server 192.0.2.10also matchesntp server 192.0.2.10 prefer, and alsontp server 192.0.2.100. The order of the lines and the section they sit in do not matter. - Wildcard sections (
wildcard_match_single_string) treat*as any run of characters on that line, so the section passes whatever the hash or next hop is. - The VTY section (
evaluate_blockwithscope: ^line vty) checks eachline vtyblock on its own. Every block must pass.
Results on the stock samples
Section titled “Results on the stock samples”These are the results recorded with rConfig Pro’s evaluator in the repository’s expected results. The snippets on this page come from the first two samples.
| Section | Hardened Catalyst 9500 (synthetic) | Cisco 1921 (lab, unhardened) | Catalyst 9500 (synthetic) | Operational standards (synthetic) |
|---|---|---|---|---|
| Services | pass | pass | fail | fail |
| DNS | pass | fail | fail | fail |
| NTP | pass | fail | fail | pass |
| Other | pass | pass | fail | fail |
| Creds | pass | fail | fail | fail |
| Creds: no plaintext passwords | pass | fail | pass | pass |
| HTTP | pass | fail | fail | fail |
| Routing | pass | pass | pass | pass |
| SSH | pass | pass | pass | pass |
| SNMP | pass | fail | fail | fail |
| VTY | pass | fail | pass | pass |
The lab router passes Services, Other, Routing and SSH because it has those lines. Every sample has a default route and ip ssh version 2, so the failing configs for those two sections are the hardened sample with that one line removed. In the repository checks, removing or changing one line per section in the hardened sample fails that section and no other.
Services
Section titled “Services”What it enforces
Section titled “What it enforces”Debug and log messages carry millisecond timestamps, and the DHCP server and relay are off. service dhcp is on by default, so IOS prints only no service dhcp when it is off.
Definition
Section titled “Definition”// Cisco Services Standard#[must_match_all_from_array]service timestamps debug datetime msecservice timestamps log datetime msecno service dhcpPassing config
Section titled “Passing config”From the hardened Catalyst 9500 sample. The localtime show-timezone options still pass, because each line is matched as text.
service timestamps debug datetime msec localtime show-timezoneservice timestamps log datetime msecservice password-encryptionservice call-homeno service dhcpFailing config
Section titled “Failing config”From the Catalyst 9500 sample. There is no no service dhcp line.
service timestamps debug datetime msec localtime show-timezoneservice timestamps log datetime msec localtime show-timezoneservice password-encryptionservice call-homeAdapting it
Section titled “Adapting it”Remove no service dhcp if the device serves or relays DHCP. Add any other service lines your standard requires, one per line.
What it enforces
Section titled “What it enforces”DNS lookup of mistyped commands is off, the domain name is set, and both standard name servers are configured.
Definition
Section titled “Definition”// Cisco DNS Standard#[must_match_all_from_array]no ip domain lookupip domain name example.comip name-server 192.0.2.53ip name-server 198.51.100.53Passing config
Section titled “Passing config”From the hardened Catalyst 9500 sample.
no ip domain lookupip domain name example.comip name-server 192.0.2.53ip name-server 198.51.100.53Failing config
Section titled “Failing config”From the Cisco 1921 lab sample. The name servers are not the standard ones.
no ip domain lookupip domain name example.comip name-server 192.0.2.8ip name-server 192.0.2.1ip name-server 192.0.2.3ip name-server 192.0.2.4Adapting it
Section titled “Adapting it”Replace example.com and the two addresses. Each name server needs its own ip name-server line in the config: a device that shows both on one line (ip name-server 192.0.2.53 198.51.100.53) fails, because the second line of the block is not in the config. Older IOS releases print ip domain-name and no ip domain-lookup; use the form your devices print.
What it enforces
Section titled “What it enforces”Both standard NTP servers are configured.
Definition
Section titled “Definition”// Cisco NTP Standard#[must_match_all_from_array]ntp server 192.0.2.10ntp server 192.0.2.11Passing config
Section titled “Passing config”From the hardened Catalyst 9500 sample. prefer after the address still passes.
ntp source Vlan99ntp server 192.0.2.10 preferntp server 192.0.2.11Failing config
Section titled “Failing config”From the Catalyst 9500 sample. Neither standard server is configured.
ntp source Vlan99ntp server 192.0.2.1 preferntp server 192.0.2.2Adapting it
Section titled “Adapting it”Replace the two addresses. Because each line is matched as text, ntp server 192.0.2.10 also passes on ntp server 192.0.2.100. If that matters, use the regex rule in ios-operational-standards.policy, which matches each address as a whole and accepts ntp server vrf <name>.
What it enforces
Section titled “What it enforces”AAA is enabled and IPv6 unicast routing is on.
Definition
Section titled “Definition”// Cisco Other Standard#[must_match_all_from_array]aaa new-modelipv6 unicast-routingPassing config
Section titled “Passing config”Excerpts from the hardened Catalyst 9500 sample. The two lines are in different parts of the config.
aaa new-model...ip name-server 198.51.100.53!ipv6 unicast-routingFailing config
Section titled “Failing config”Excerpts from the Catalyst 9500 sample. AAA is enabled, but there is no ipv6 unicast-routing line anywhere in the config.
aaa new-model...ip routing!no ip domain lookupip domain name dub.example.netAdapting it
Section titled “Adapting it”Remove ipv6 unicast-routing if your devices do not route IPv6. Add other global lines your standard requires.
What it enforces
Section titled “What it enforces”A local admin user exists with privilege 15 and a type 9 (scrypt) secret. The * matches any hash.
Definition
Section titled “Definition”// Cisco Creds Standard#[wildcard_match_single_string]username admin privilege 15 secret 9 *Passing config
Section titled “Passing config”From the hardened Catalyst 9500 sample. The hash is made up.
username admin privilege 15 secret 9 $9$EXAMPLEONLY001$EXAMPLEONLYFAKEHASHEXAMPLEONLYFAKEHASH12345username netops privilege 15 secret 9 $9$5J0T7SYCEJJ3F7$K508GSW4V4P8230Z3VK1FA20CJUKCT8R6UUQCCP6UY8Failing config
Section titled “Failing config”From the Cisco 1921 lab sample. There is no admin user, and the users have plaintext passwords.
username cisco privilege 15 password 0 ExamplePass1username labuser1 password 0 ExamplePass2Adapting it
Section titled “Adapting it”Replace admin with your local account name. To accept any secret type, change secret 9 * to secret *; that also accepts a type 5 (MD5) hash.
Creds: no plaintext passwords
Section titled “Creds: no plaintext passwords”What it enforces
Section titled “What it enforces”No line stores a password as type 0, which is plaintext: username ... password 0 ... or any other password 0 line.
Definition
Section titled “Definition”// Cisco Creds Standard: no plaintext passwords#[must_not_match_regex]/^.*\bpassword 0 \S/mPassing config
Section titled “Passing config”From the hardened Catalyst 9500 sample. Secrets are hashed and keys are type 7.
username admin privilege 15 secret 9 $9$EXAMPLEONLY001$EXAMPLEONLYFAKEHASHEXAMPLEONLYFAKEHASH12345username netops privilege 15 secret 9 $9$5J0T7SYCEJJ3F7$K508GSW4V4P8230Z3VK1FA20CJUKCT8R6UUQCCP6UY8Failing config
Section titled “Failing config”From the Cisco 1921 lab sample.
username cisco privilege 15 password 0 ExamplePass1username labuser1 password 0 ExamplePass2Adapting it
Section titled “Adapting it”Nothing to replace. IOS prints a line password without a type ( password example-vty), so this section does not catch it; the VTY section does.
What it enforces
Section titled “What it enforces”The HTTP and HTTPS servers are both off, and HTTP authentication uses the local user database if the server is turned on later.
Definition
Section titled “Definition”// Cisco HTTP Standard#[must_match_all_from_array]no ip http serverip http authentication localno ip http secure-serverPassing config
Section titled “Passing config”From the hardened Catalyst 9500 sample.
no ip http serverip http authentication localno ip http secure-serverFailing config
Section titled “Failing config”From the Cisco 1921 lab sample. The HTTPS server is on.
no ip http serverip http authentication localip http secure-serverip http secure-client-authAdapting it
Section titled “Adapting it”If your standard enables the HTTPS server for the web UI, do not simply change the last line to ip http secure-server: the line is matched as text, so it would also match no ip http secure-server. Put that line in an evaluate_block rule with equals:, which compares whole lines (see section-scoped checks). The stock Cisco IOS services hardening file also fails when the HTTPS server is on.
Routing
Section titled “Routing”What it enforces
Section titled “What it enforces”A static default route is configured. The * matches any next hop or interface.
Definition
Section titled “Definition”// Cisco Routing Standard#[wildcard_match_single_string]ip route 0.0.0.0 0.0.0.0 *Passing config
Section titled “Passing config”From the hardened Catalyst 9500 sample.
ip ssh source-interface Vlan99ip tacacs source-interface Vlan99ip route 0.0.0.0 0.0.0.0 192.0.2.1Failing config
Section titled “Failing config”The hardened Catalyst 9500 sample with the default route removed.
ip ssh source-interface Vlan99ip tacacs source-interface Vlan99Adapting it
Section titled “Adapting it”To require one next hop, replace * with it, for example ip route 0.0.0.0 0.0.0.0 192.0.2.1. A default route in a VRF (ip route vrf ...) does not match.
What it enforces
Section titled “What it enforces”SSH version 2 is configured. A line must read exactly ip ssh version 2.
Definition
Section titled “Definition”// Cisco SSH Standard#[must_match_single_string]ip ssh version 2Passing config
Section titled “Passing config”From the hardened Catalyst 9500 sample.
ip ssh version 2ip ssh time-out 60ip ssh authentication-retries 3Failing config
Section titled “Failing config”The hardened Catalyst 9500 sample with ip ssh version 2 removed.
ip ssh time-out 60ip ssh authentication-retries 3Adapting it
Section titled “Adapting it”Nothing to replace. To add other SSH settings, such as ip ssh time-out 60, change the method to must_match_all_from_array and list them, one per line. An array method needs at least two lines.
What it enforces
Section titled “What it enforces”The standard SNMPv3 group uses authPriv (authentication and encryption), and traps go to the standard host with SNMPv3 authPriv.
Definition
Section titled “Definition”// Cisco SNMP Standard#[must_match_all_from_array]snmp-server group SNMPV3GROUP v3 privsnmp-server host 192.0.2.50 version 3 priv SNMPV3USERPassing config
Section titled “Passing config”Excerpts from the hardened Catalyst 9500 sample.
snmp-server group NMS-GROUP v3 privsnmp-server group SNMPV3GROUP v3 priv...snmp-server host 192.0.2.50 version 3 priv SNMPV3USERsnmp-server host 192.0.2.60 version 3 priv nms-pollerFailing config
Section titled “Failing config”From the Cisco 1921 lab sample. There is no SNMPv3 group, and the hosts use communities.
snmp-server community public ROsnmp-server host 192.0.2.1 TESTCOMMUNITYsnmp-server host 198.51.100.2 TESTCOMMUNITY12xxxxxAdapting it
Section titled “Adapting it”Replace SNMPV3GROUP, 192.0.2.50 and SNMPV3USER. SNMPv3 users (snmp-server user) are not shown in the running config, so the user itself cannot be checked.
What it enforces
Section titled “What it enforces”Every VTY line block accepts SSH only and has no line password, so logins use AAA or local users.
Definition
Section titled “Definition”// Cisco VTY Standard#[evaluate_block]scope: ^line vtyall: - equals: transport input ssh - not: regex: '/^\s*password\b/m'Passing config
Section titled “Passing config”From the hardened Catalyst 9500 sample. Both VTY blocks pass.
line vty 0 4 access-class MGMT-ACCESS in vrf-also exec-timeout 5 0 logging synchronous transport input sshline vty 5 15 access-class MGMT-ACCESS in vrf-also exec-timeout 5 0 transport input sshFailing config
Section titled “Failing config”From the Cisco 1921 lab sample. The block has a line password and allows Telnet.
line vty 0 4 password example-vty login local no activation-character international transport input telnet sshAdapting it
Section titled “Adapting it”equals: compares whole lines, so transport input ssh telnet fails. A config with no line vty block fails, because a scoped block fails when nothing matches its scope.
Framework mapping
Section titled “Framework mapping”The sidecar records these references. They are for reading only: the generated framework files collect hardening files, not this baseline. A section provides evidence towards a control; it does not make a device compliant with it.
| Section | NIST SP 800-53 | HIPAA (45 CFR) | ISO/IEC 27001:2022 |
|---|---|---|---|
| NTP | AU-8 | None | A.8.17 |
| Creds | IA-5 | None | A.5.17 |
| Creds: no plaintext passwords | IA-5 | None | A.5.17 |
| HTTP | CM-7 | None | A.8.9 |
| SSH | AC-17 | 164.312(a)(1) | A.8.24 |
| SNMP | SC-12 | 164.312(e)(1) | A.8.5, A.8.24 |
| VTY | AC-17 | 164.312(a)(1) | A.8.5 |
Services, DNS, Other and Routing have no references.
Tested with
Section titled “Tested with”| Item | Detail |
|---|---|
| Tested OS version | IOS XE 17.9 (synthetic samples built from rConfig Pro’s IOS-XE demo generator) and IOS 15.7 (sanitised lab sample). The passing configs were not captured from a device. |
| Minimum rConfig version | 8.3.0 (evaluate_block) |
| Editions | Pro, Vector, Enterprise |
| Source | cisco/ios-baseline.policy and its samples in rconfig/pro-policy-definitions v1.4.0. Results are recorded with rConfig Pro’s evaluator, not asserted by a Pro test. |