Cisco IOS stock definitions

Cisco IOS stock definitions

Stock definitions for Cisco IOS and IOS XE, from the cisco/ folder. They check the running configuration as returned by show running-config. This page documents release v1.4.0. See importing a stock template to load one into rConfig.

For tested worked examples of IOS-XE rules, with passing and failing configs, see the Cisco IOS-XE platform pages.

Hardening definitions

Cisco IOS management access

ios-management-access.policy · 6 rules · minimum rConfig 8.3.0 · Lab tested

SSH version 2, no Telnet on any line, an exec-timeout of 1 to 10 minutes on the console and every VTY line, and MOTD and login banners.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Known limitations

• The Telnet rule uses a regex because must_not_match_single_string compares whole lines, so transport input telnet would not catch transport input telnet ssh.
• exec-timeout 10 0 is the IOS default and is not printed, so a line block with no exec-timeout line passes.
• A seconds value of 60 or more fails, even when the total is 10 minutes or less (for example exec-timeout 0 300).

Cisco IOS AAA and local credentials

ios-aaa.policy · 4 rules · minimum rConfig 8.0.2 · Lab tested

AAA enabled, a hashed enable secret, password encryption and no plaintext local passwords.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Known limitations

• No rule checks login authentication default on the console or VTY lines. It is the default method list, so IOS does not print it, and a rule that required it failed on compliant configs. Release v1.2.0 removed those two rules.

Cisco IOS SNMP

ios-snmp.policy · 2 rules · minimum rConfig 8.0.2 · Lab tested

No SNMPv1 or SNMPv2c communities, and an SNMPv3 authPriv group.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Known limitations

• SNMPv3 users (snmp-server user) are not shown in the running config, so no rule checks them.

Cisco IOS logging

ios-logging.policy · 5 rules · minimum rConfig 8.0.2 · Lab tested

Remote syslog host, millisecond log timestamps (with or without localtime, show-timezone or year), no console logging, buffered logging and a trap severity level.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Cisco IOS interface and L2 security

ios-l2-security.policy · 2 rules · minimum rConfig 8.3.0 · Lab tested

Proxy ARP disabled on every interface with an IP address, and every interface shut down or described.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Known limitations

• Proxy ARP is checked only on interfaces with an IP address, and an interface with a description counts as in use.

Cisco IOS routing protocol authentication

ios-routing-authentication.policy · 2 rules · minimum rConfig 8.3.0 · Lab tested

OSPF message-digest area authentication on every OSPF process, and a BGP neighbor password.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Known limitations

• A scoped rule fails when no config block matches its scope, so a config with no OSPF process fails the OSPF rule.

Cisco IOS services

ios-services.policy · 11 rules · minimum rConfig 8.0.2 · Lab tested

HTTP and HTTPS servers, finger (service finger or ip finger), TCP and UDP small servers, identd and directed broadcast are not enabled; BOOTP, source routing, CDP and PAD are disabled with their no lines.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Known limitations

• IOS does not print a setting that is at its default. BOOTP, source routing, CDP and PAD are on by default, so those rules require the no line. Directed broadcast is off by default, so that rule fails only when an ip directed-broadcast line is present.

Framework files

Framework files are generated from the hardening files above. Each one collects every hardening rule that lists a reference for one framework, copied unchanged, with the control reference added to the start of its description (for example NIST AC-17: ...). The rule tables, references and known limitations are in the topic sections linked below.

No Cisco hardening rule lists a NIST CSF 1.1 reference, so there is no Cisco file for it.

A framework file lists checks relevant to that framework. It is not a certification or a full assessment, and a device that passes it is not certified against the framework.

Operational standards

Cisco IOS baseline standard

ios-baseline.policy · 11 rules · minimum rConfig 8.3.0 · Synthetic tested

A baseline standard for Cisco IOS and IOS XE: edit the values to match your own. One block per section, each named Cisco <Section> Standard, so the report shows a result per section. The IOS-XE baseline standard page walks through each section with passing and failing configs and how to adapt the values.

References

Published references recorded in the sidecar, for reading only. The framework files collect hardening files, so these rules are not in them. A rule provides evidence towards a control; it does not make a device compliant with it.

Known limitations

• Array blocks match each line as text anywhere in the config, so ntp server 192.0.2.10 also matches ntp server 192.0.2.100, and lines with extra options, such as prefer, still pass.
• Each name server must be on its own ip name-server line. A device that shows both on one line fails the DNS block.
• A config with no line vty block fails the VTY block.

Cisco IOS operational standards

ios-operational-standards.policy · 7 rules · minimum rConfig 8.3.0 · Synthetic tested

Checks drift from your own operational standard, not a hardening baseline: standard NTP, syslog and DNS servers, a login banner, a description on every interface that is not shut down, a hostname naming pattern and an SNMP location. Replace the example values (RFC 5737 addresses such as 192.0.2.10, and the hostname pattern) with your own before use.

Known limitations

• The NTP, syslog and DNS rules check that each standard server is configured, not that no other server is.
• Each address is matched as a whole, so 192.0.2.10 does not match 192.0.2.100.
• The server rules are regular expressions: escape the dots when you replace an address, for example 192\.0\.2\.10.

Build templates

Cisco IOS build template

ios-build-template.policy · 10 rules · minimum rConfig 8.0.0 · Lab tested

Starting template for a new IOS build, not a compliance check: hostname, timezone, SSH and line access, LAN interface, DHCP, DNS, NAT, ACL, NTP and logging. Replace the example values (for example hostname MyCiscoRouter and 192.168.88.0/24) with your own before use.

Every rule uses example values, so the rules fail against the samples until they are edited.

Each line of a must_match_all_from_array body is checked on its own, as text anywhere in the config. The method does not check order or which section a line sits in.