Checklist Summary:

This document defines a set of benchmarks or standards for securing Cisco IOS routers. The benchmark is an industry consensus of current best practices. It lists actions to be taken as well as reasons for those actions. It is intended to provide step-by-step guidance to front line system and network administrators. It may be used manually by itself or in conjunction with automated scoring tools. It contains Level-I and Level-II benchmark settings/actions. Level-I benchmarks specify the prudent level of minimum due care, and are unlikely to cause an interruption of service to the operating system or the applications that run on it. Level-II benchmarks provide prudent security beyond the minimum level, and are of the greatest value to system administrators who have sufficient security knowledge to apply them with consideration to the operating systems and applications running in their particular environments.

Checklist Role:

• Router

Known Issues:

Sections 3.2 and 4.2 contain warnings and explanations of the possible effects of particular settings. Readers should study this information, as well as completing the Audit Checklist in section 2, before implementing any of the actions in sections 3.1 and 4.1. Many security actions can disable or otherwise interfere with the function or performance of software on your system, particularly applications. Note also that many of the actions in sections 3.1 and 4.1 are conditional. They only apply in certain situations.

Target Audience:

This benchmark assumes that the person applying the recommendations: o May or may not be an IOS/network expert. o Is able to log in to the router and enable. o Is able to enter basic IOS commands. o Understands the business critical functions of the routers being secured. o Understands local policies. o Is capable of evaluating the potential impact of recommended changes on both function and policy.

Target Operational Environment:

• Managed

Testing Information:

Not provided.

Regulatory Compliance:

Not provided.

Comments/Warnings/Miscellaneous:

The PDF file for this checklist is included in the Cisco Router Tools zip archive. The specific file name is cisco-ios-router-benchmark.pdf. This is a different checklist than the Cisco IOS Benchmark Version 2.2.

Disclaimer:

Proper use of the recommendations requires careful analysis and adaptation to specific user requirements. The recommendations are not in any way intended to be a quick fix for anyones information security needs. CIS makes no representations, warranties or covenants whatsoever as to (i) the positive or negative effect of the products or the recommendations on the operation or the security of any particular network, computer system, network device, software, hardware, or any component of any of the foregoing or (ii) the accuracy, reliability, timeliness or completeness of any product or recommendation. CIS is providing the products and the recommendations as is and as available without representations, warranties or covenants of any kind.

Product Support:

Not provided.

Point of Contact:

rat-feedback@cisecurity.org

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

11-07-2007-Version 2.2
10-31-2010-Version 2.3
11-25-2010-Version 2.3.1
12-09-2010-Version 2.3.2
12-15-2010-Version 2.3.3
12-31-2010-Version 2.4.0

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 03/23/2011