Cisco IOS stock definitions

Stock definitions for Cisco IOS and IOS XE, from the cisco/ folder. They check the running configuration as returned by show running-config. This page documents release v1.2.0. See importing a stock template to load one into rConfig.

For tested worked examples of IOS-XE rules, with passing and failing configs, see the Cisco IOS-XE platform pages.

Hardening definitions

Cisco IOS management access

ios-management-access.policy · 6 rules · minimum rConfig 8.3.0 · Lab tested

SSH version 2, no Telnet on any line, an exec-timeout of 1 to 10 minutes on the console and every VTY line, and MOTD and login banners.

Rule	Method	What it checks
SSH version 2 is enabled (ip ssh version 2)	must_match_single_string	A line reads exactly ip ssh version 2.
No transport input line permits Telnet (telnet or all)	must_not_match_regex	No transport input line, on any line block, includes telnet or all. transport input telnet ssh and transport input all both fail.
No VTY line block sets an exec-timeout outside 1 to 10 minutes (no line means the 10 0 default)	evaluate_block	Each line vty block is checked on its own. A block passes with an exec-timeout of 1 to 9 minutes and 0 to 59 seconds, or exactly 10 0, and with no exec-timeout line, because 10 minutes is the default and IOS does not print it. 0 0 (no timeout), any other value under one minute and anything over 10 minutes fail.
The console line does not set an exec-timeout outside 1 to 10 minutes (no line means the 10 0 default)	evaluate_block	The same check for the line con block.
A MOTD banner is configured (banner motd)	must_match_regex	A line starts with banner motd followed by banner text.
A login banner is configured (banner login)	must_match_regex	A line starts with banner login followed by banner text.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)
SSH version 2 is enabled (ip ssh version 2)	AC-17	164.312(a)(1)
No transport input line permits Telnet (telnet or all)	AC-17	164.312(a)(1)
No VTY line block sets an exec-timeout outside 1 to 10 minutes (no line means the 10 0 default)	AC-3	None
The console line does not set an exec-timeout outside 1 to 10 minutes (no line means the 10 0 default)	AC-3	None

Known limitations

• The Telnet rule uses a regex because must_not_match_single_string compares whole lines, so transport input telnet would not catch transport input telnet ssh.
• exec-timeout 10 0 is the IOS default and is not printed, so a line block with no exec-timeout line passes.
• A seconds value of 60 or more fails, even when the total is 10 minutes or less (for example exec-timeout 0 300).

Cisco IOS AAA and local credentials

ios-aaa.policy · 4 rules · minimum rConfig 8.0.2 · Lab tested

AAA enabled, a hashed enable secret, password encryption and no plaintext local passwords.

Rule	Method	What it checks
AAA is enabled (aaa new-model)	must_match_single_string	A line reads exactly aaa new-model.
The enable secret is set with a hash type (enable secret <type> …)	must_match_regex	A line starts with enable secret, then a numeric hash type, then the hash.
Password encryption is enabled (service password-encryption)	must_match_single_string	A line reads exactly service password-encryption.
No local user has a type 0 plaintext password (username … password 0)	must_not_match_regex	No username line stores its password as password 0, which is plaintext.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)
AAA is enabled (aaa new-model)	AC-2	164.312(a)(1)
The enable secret is set with a hash type (enable secret <type> …)	IA-5	None
Password encryption is enabled (service password-encryption)	CM-6	None
No local user has a type 0 plaintext password (username … password 0)	IA-5	None

Known limitations

• No rule checks login authentication default on the console or VTY lines. It is the default method list, so IOS does not print it, and a rule that required it failed on compliant configs. Release v1.2.0 removed those two rules.

Cisco IOS SNMP

ios-snmp.policy · 2 rules · minimum rConfig 8.0.2 · Lab tested

No SNMPv1 or SNMPv2c communities, and an SNMPv3 authPriv group.

Rule	Method	What it checks
No SNMPv1 or SNMPv2c community is configured (line snmp-server community is absent)	must_not_match_regex	No line starts with snmp-server community.
An SNMPv3 group uses authPriv (snmp-server group … v3 priv)	must_match_regex	An snmp-server group line uses v3 priv, which is authentication with encryption.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)
No SNMPv1 or SNMPv2c community is configured (line snmp-server community is absent)	SC-12	164.312(e)(1)
An SNMPv3 group uses authPriv (snmp-server group … v3 priv)	SC-12	164.312(e)(1)

Known limitations

• SNMPv3 users (snmp-server user) are not shown in the running config, so no rule checks them.

Cisco IOS logging

ios-logging.policy · 5 rules · minimum rConfig 8.0.2 · Lab tested

Remote syslog host, millisecond log timestamps (with or without localtime, show-timezone or year), no console logging, buffered logging and a trap severity level.

Rule	Method	What it checks
A remote syslog host is configured (logging host)	must_match_regex	A line starts with logging host followed by a host.
Log timestamps use datetime msec, with or without other options (service timestamps log datetime msec …)	must_match_regex	A service timestamps log datetime line includes msec, with or without other options such as localtime show-timezone or year. A datetime line without msec, or uptime, fails.
Console logging is off (no logging console line at any level)	must_not_match_regex	No line starts with logging console, at any severity level. no logging console still passes.
Buffered logging is configured (logging buffered)	must_match_regex	A line starts with logging buffered followed by a size or level.
The logging trap severity level is set (logging trap <level>)	must_match_regex	A logging trap line names one of the severity keywords, from emergencies to informational. debugging is not accepted.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)
A remote syslog host is configured (logging host)	AU-2	164.312(b)
Log timestamps use datetime msec, with or without other options (service timestamps log datetime msec …)	AU-3	164.312(b)
Console logging is off (no logging console line at any level)	AU-6	164.312(b)
Buffered logging is configured (logging buffered)	AU-2	None
The logging trap severity level is set (logging trap <level>)	AU-3	None

Cisco IOS interface and L2 security

ios-l2-security.policy · 2 rules · minimum rConfig 8.3.0 · Lab tested

Proxy ARP disabled on every interface with an IP address, and every interface shut down or described.

Rule	Method	What it checks
Every interface with an IP address has proxy ARP disabled (no ip proxy-arp)	evaluate_block	Each interface block is checked on its own. A block with an ip address line must also contain no ip proxy-arp. Interfaces without an IP address, such as switch ports, pass.
Every interface is shut down or has a description	evaluate_block	Each interface block must contain a shutdown line or a description. An interface with neither, which is likely unused, fails. no shutdown does not count as shut down.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53
Every interface with an IP address has proxy ARP disabled (no ip proxy-arp)	SC-7
Every interface is shut down or has a description	SI-4

Known limitations

• Proxy ARP is checked only on interfaces with an IP address, and an interface with a description counts as in use.

Cisco IOS routing protocol authentication

ios-routing-authentication.policy · 2 rules · minimum rConfig 8.3.0 · Lab tested

OSPF message-digest area authentication on every OSPF process, and a BGP neighbor password.

Rule	Method	What it checks
Every OSPF process enables message-digest authentication for an area (area … authentication message-digest)	evaluate_block	Each router ospf block must contain an area ... authentication message-digest line.
At least one BGP neighbor has a password (neighbor … password)	must_match_regex	At least one neighbor line sets a password. Other neighbors without a password are not checked.

Known limitations

• A scoped rule fails when no config block matches its scope, so a config with no OSPF process fails the OSPF rule.

Cisco IOS services

ios-services.policy · 11 rules · minimum rConfig 8.0.2 · Lab tested

HTTP and HTTPS servers, finger (service finger or ip finger), TCP and UDP small servers, identd and directed broadcast are not enabled; BOOTP, source routing, CDP and PAD are disabled with their no lines.

Rule	Method	What it checks
The HTTP server is not enabled (line ip http server is absent)	must_not_match_single_string	No line reads ip http server.
The HTTPS server is not enabled (line ip http secure-server is absent)	must_not_match_single_string	No line reads ip http secure-server.
The finger service is not enabled (fails on a service finger or ip finger line)	must_not_match_regex	No line starts with service finger or ip finger. IOS 12.1 and later use ip finger.
The BOOTP server is disabled (no ip bootp server)	must_match_single_string	A line reads exactly no ip bootp server. BOOTP is on by default, so the config shows only the no form when it is disabled.
TCP small servers are not enabled (line service tcp-small-servers is absent)	must_not_match_single_string	No line reads service tcp-small-servers.
UDP small servers are not enabled (line service udp-small-servers is absent)	must_not_match_single_string	No line reads service udp-small-servers.
The PAD service is disabled (no service pad)	must_match_single_string	A line reads exactly no service pad. PAD is on by default, so the config shows only the no form when it is disabled.
IP source routing is disabled (no ip source-route)	must_match_single_string	A line reads exactly no ip source-route. Source routing is on by default, so the config shows only the no form when it is disabled.
The identd service is not enabled (line ip identd is absent)	must_not_match_single_string	No line reads ip identd.
CDP is disabled globally (no cdp run)	must_match_single_string	A line reads exactly no cdp run. CDP is on by default, so the config shows only the no form when it is disabled.
Directed broadcast is not enabled on any interface (fails on any ip directed-broadcast line)	must_not_match_regex	No interface has an ip directed-broadcast line, with or without an access list. Directed broadcast is off by default and no ip directed-broadcast is not printed, so a config without the line passes.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)
The HTTP server is not enabled (line ip http server is absent)	CM-7	None
The HTTPS server is not enabled (line ip http secure-server is absent)	CM-7	None
The finger service is not enabled (fails on a service finger or ip finger line)	CM-7	164.312(c)(1)
The BOOTP server is disabled (no ip bootp server)	CM-7	164.312(c)(1)
TCP small servers are not enabled (line service tcp-small-servers is absent)	CM-7	164.312(c)(1)
UDP small servers are not enabled (line service udp-small-servers is absent)	CM-7	None
IP source routing is disabled (no ip source-route)	SC-5	None
CDP is disabled globally (no cdp run)	CM-7	None
Directed broadcast is not enabled on any interface (fails on any ip directed-broadcast line)	SC-7	None

Known limitations

• IOS does not print a setting that is at its default. BOOTP, source routing, CDP and PAD are on by default, so those rules require the no line. Directed broadcast is off by default, so that rule fails only when an ip directed-broadcast line is present.

Operational standards

Caution

Operational standards files are templates to edit with your own values, not hardening checks. The server and hostname rules use example values (RFC 5737 addresses such as 192.0.2.10, and an example hostname pattern), so expect them to fail until you replace those values with your own standard.

Cisco IOS operational standards

ios-operational-standards.policy · 7 rules · minimum rConfig 8.3.0 · Synthetic tested

Checks drift from your own operational standard, not a hardening baseline: standard NTP, syslog and DNS servers, a login banner, a description on every interface that is not shut down, a hostname naming pattern and an SNMP location. Replace the example values (RFC 5737 addresses such as 192.0.2.10, and the hostname pattern) with your own before use.

Rule	Method	What it checks
NTP servers are set to your standard (replace 192.0.2.10 and 192.0.2.11)	evaluate_block	An ntp server line exists for each address, with or without vrf <name> before it or options such as prefer after it.
Syslog servers are set to your standard (replace 192.0.2.20 and 192.0.2.21)	evaluate_block	A logging host line exists for each address, with or without options after it.
DNS servers are set to your standard (replace 192.0.2.30 and 192.0.2.31)	evaluate_block	Each address appears on an ip name-server line, either on one line together or on separate lines.
A login banner is set (banner login, any text; nothing to replace)	must_match_regex	A banner login line is present.
Every interface that is not shut down has a description (nothing to replace)	evaluate_block	Every interface block has shutdown or a non-empty description line.
The hostname follows your naming pattern (replace the example pattern [a-z]{3}-(rtr|sw)[0-9]{2}, for example dub-rtr01)	must_match_regex	The hostname line matches the pattern exactly, in lower case. DUB-RTR01 and dub-rtr1 fail.
An SNMP location is set (snmp-server location, any text; nothing to replace)	must_match_regex	A snmp-server location line with a value is present.

Known limitations

• The NTP, syslog and DNS rules check that each standard server is configured, not that no other server is.
• Each address is matched as a whole, so 192.0.2.10 does not match 192.0.2.100.
• The server rules are regular expressions: escape the dots when you replace an address, for example 192\.0\.2\.10.

Build templates

Caution

Build templates are starting templates to edit, not compliance checks. The rules use example values (hostnames, addresses, servers), so expect them to fail until you replace those values with your own standard.

Cisco IOS build template

ios-build-template.policy · 10 rules · minimum rConfig 8.0.0 · Lab tested

Starting template for a new IOS build, not a compliance check: hostname, timezone, SSH and line access, LAN interface, DHCP, DNS, NAT, ACL, NTP and logging. Replace the example values (for example hostname MyCiscoRouter and 192.168.88.0/24) with your own before use.

Every rule uses example values, so the rules fail against the samples until they are edited.

Rule	Method	What it checks
Description: must_match_single_string Set Hostname	must_match_single_string	A line reads exactly hostname MyCiscoRouter.
Description: must_match_single_string Set Timezone	must_match_single_string	A line reads exactly clock timezone GMT 0.
Description: must_match_all_from_array Secure Access Settings	must_match_all_from_array	Each listed line appears somewhere in the config: line vty 0 4, login local, transport input ssh, logging synchronous, ip domain-name example.com and the ip ssh version, time-out and retry settings.
Description: must_match_all_from_array Configure LAN Interface	must_match_all_from_array	Each listed line appears somewhere in the config: interface GigabitEthernet0/0, its description, the address 192.168.88.1 255.255.255.0 and no shutdown.
Description: must_match_all_from_array DHCP Server Setup	must_match_all_from_array	Each listed line appears somewhere in the config: the excluded range, the DHCP_POOL pool, its network, default router and DNS servers.
Description: must_match_all_from_array DNS Setup	must_match_all_from_array	Both ip name-server lines (8.8.8.8 and 8.8.4.4) appear in the config.
Description: must_match_single_string Enable NAT	must_match_single_string	A line reads exactly ip nat inside source list 1 interface GigabitEthernet0/1 overload.
Description: must_match_all_from_array Basic Firewall Rules	must_match_all_from_array	Each access-list 101 entry appears somewhere in the config, as do line vty 0 4 and access-class 101 in.
Description: must_match_all_from_array Enable NTP Client	must_match_all_from_array	Both ntp server lines appear in the config.
Description: must_match_all_from_array Set Up Logging	must_match_all_from_array	Each listed line appears in the config: buffered, console and trap logging levels and logging host 192.168.88.2.

Each line of a must_match_all_from_array body is checked on its own, as text anywhere in the config. The method does not check order or which section a line sits in.