Cisco IOS XE Router STIG Checklist

24 items · Security · Medium difficulty · 4 hours

Harden Cisco IOS XE routers with the DISA STIG: download, apply, scan, and document.

• Download STIG and SCAP content

  Get DISA XCCDF/SCAP and STIG packages for IOS XE from official sources.

• Download SCAP 1.3 content (NDM and RTR)

  Grab SCAP 1.3 benchmarks for NDM and RTR from DISA.

• Download standalone XCCDF and Ansible STIG resources

  Collect XCCDF and Ansible playbooks or scripts for automation.

• Download automated SCC content for supported platforms

  Download SCC packs if using automated scanning platforms.

• Read the STIG checklist summary and role

  Confirm scope: RTR and NDM components and intended router role.

• Inventory IOS XE devices and record software versions

  List device models, serials, and current IOS XE image versions.

• Backup current device configurations

  Save full running and startup configs and store off-device.

• Verify and update IOS XE images to a supported release

  Ensure images are supported and patched for known vulnerabilities.

• Review applicable CVEs and documented known issues

  Check DISA/NIST CVE listings for your IOS XE versions.

• Disable unused services and interfaces

  Shut down interfaces and services not required for operations.

• Disable HTTP and Telnet; enable HTTPS/SSH

  Remove insecure management protocols from device configs.

• Disable CDP and other unused discovery protocols

  Turn off CDP/LLDP if they expose unnecessary info.

• Configure secure management access (SSH v2, HTTPS)

  Enforce SSH v2, strong ciphers, and TLS for HTTPS management.

• Enable SSH v2 and generate host keys

  Create RSA/ECDSA keys and disable SSH v1.

• Disable legacy crypto and weak ciphers

  Remove weak algorithms and prefer modern cipher suites.

• Enable AAA and enforce password policies

  Configure TACACS+/RADIUS, role-based access, and password complexity.

• Configure logging, NTP, and time synchronization

  Point NTP to trusted servers and forward logs to a syslog server.

• Harden SNMP and restrict community strings; apply management ACLs

  Use SNMPv3 or restrict SNMP access and limit management IPs via ACLs.

• Apply configuration changes and verify functionality

  Commit changes, test management access and data plane behavior.

• Run SCAP compliance scan and review results

  Execute SCAP/XCCDF scan against the device and analyze findings.

• Remediate scan findings and retest

  Address high-severity findings, document fixes, and rescan.

• Document changes and retain STIG artifacts

  Store configs, scan reports, and change tickets for auditing.

• Submit comments or change requests to DISA if needed

  Email proposed revisions or questions to the DISA contact address.

• Schedule periodic STIG reviews and automated scans

  Set recurring reviews and scans to maintain compliance.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.