CIS Cisco NX-OS Benchmark

This recommendation verifies that NX-OS is running the latest recommended version on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check NX-OS version:
show version | include 'NXOS\|system:'

# Verify running image:
show boot

# Upgrade NX-OS:
copy scp://admin@server/nxos.10.4.3.F.bin bootflash:
install all nxos bootflash:nxos.10.4.3.F.bin

This recommendation verifies that local user accounts have strong passwords and roles on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check local user accounts and roles:
show user-account
show role

# Check password strength policy:
show password strength-check

# Enable password strength checking:
password strength-check

# Configure user with role:
username admin password 0 $tr0ngP@ss! role network-admin
username operator password 0 $tr0ngP@ss! role network-operator

This recommendation verifies that AAA authentication is configured on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check AAA configuration:
show aaa authentication
show tacacs-server
show radius-server

# Check AAA groups:
show aaa group

# Configure TACACS+ AAA:
tacacs-server host 10.1.1.100 key 7 <encrypted-key>
tacacs-server host 10.1.1.101 key 7 <encrypted-key>

aaa group server tacacs+ TACACS_GROUP
  server 10.1.1.100
  server 10.1.1.101
  use-vrf management

aaa authentication login default group TACACS_GROUP local
aaa authorization commands default group TACACS_GROUP local
aaa accounting default group TACACS_GROUP

This recommendation verifies that session timeout is configured for console and VTY on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check console and VTY timeout:
show running-config | section 'line con\|line vty'

# Check exec-timeout:
show running-config | include exec-timeout

# Set session timeouts:
line console
  exec-timeout 5

line vty
  exec-timeout 5
  session-limit 5

This recommendation verifies that a login banner is configured on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check MOTD and login banners:
show banner motd
show banner exec

# Verify in config:
show running-config | section banner

# Configure authorized-use banner:
banner motd @
***********************************************
* AUTHORIZED PERSONNEL ONLY                   *
* All access is logged and monitored.          *
***********************************************
@

banner exec @
Authorized access only. Disconnect immediately if you are not authorized.
@

This recommendation verifies that SSH is enabled and Telnet is disabled on the Cisco NX-OS network operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Cisco NX-OS network operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check SSH configuration:
show ssh server
show ssh key

# Check SSH version:
show running-config | include 'ssh\|feature ssh'

# Enable SSH and disable Telnet:
feature ssh

ssh key rsa 2048
ssh login-attempts 3
ssh login-gracetime 30

no feature telnet

This setting ensures that management access is restricted by ACL on the Cisco NX-OS network operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Cisco NX-OS network operating system is essential for defense in depth.

# Check management access ACLs:
show running-config | section 'ssh\|line vty'

# Check IP ACLs applied to VTY:
show running-config | include 'access-class'

# Restrict SSH access by IP:
ip access-list MGMT-ACCESS
  10 permit ip 10.0.0.0/8 any
  20 deny ip any any log

line vty
  access-class MGMT-ACCESS in

This recommendation verifies that NX-API uses HTTPS only on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check HTTPS management:
show nxapi
show running-config | include 'nxapi\|http'

# Check certificate:
show nxapi certificate

# Enable HTTPS and disable HTTP for NX-API:
feature nxapi

nxapi https port 443
nxapi certificate httpscert keyfile httpspkey
no nxapi http

This recommendation verifies that CoPP is configured on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check CoPP policy:
show policy-map interface control-plane
show copp status

# Check CoPP profile:
show running-config | section 'copp'

# Apply strict CoPP profile:
copp profile strict

# Customize CoPP policy:
policy-map type control-plane copp-system-p-policy-strict
  class copp-system-p-class-critical
    police cir 36000 kbps bc 1280000 bytes conform transmit violate drop

This recommendation verifies that routing protocol authentication is configured on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check routing protocol authentication:
show running-config ospf | include 'authentication\|message-digest'
show running-config bgp | include 'password'

# Check EIGRP auth:
show running-config eigrp | include 'authentication'

# Configure OSPF authentication:
router ospf 1
  area 0 authentication message-digest

interface Ethernet1/1
  ip ospf message-digest-key 1 md5 0 <key>

# Configure BGP authentication:
router bgp 65001
  neighbor 10.1.1.1 password 3 <encrypted-password>

This recommendation verifies that remote syslog servers are configured on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check syslog configuration:
show logging
show logging server

# Check logging level:
show running-config | include logging

# Configure remote syslog:
logging server 10.1.1.200 5 use-vrf management
logging server 10.1.1.201 5 use-vrf management
logging level local7 5
logging source-interface mgmt0
logging timestamp milliseconds

This recommendation verifies that appropriate logging levels are configured on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging buffer and console:
show logging info
show running-config | include 'logging monitor\|logging console'

# Configure logging levels:
logging monitor 6
logging console 3
logging logfile messages 6 size 4194304
logging event link-status default
logging event trunk-status default

This recommendation verifies that NTP is configured with authentication on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check NTP configuration:
show ntp peers
show ntp status
show running-config | section ntp

# Configure NTP with authentication:
feature ntp

ntp server 10.1.1.50 use-vrf management key 1
ntp server 10.1.1.51 use-vrf management key 1
ntp authentication-key 1 md5 <ntp-key>
ntp trusted-key 1
ntp authenticate
ntp source-interface mgmt0

This recommendation verifies that SNMPv3 is used with strong authentication on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SNMP configuration:
show snmp
show snmp community
show snmp user

# Check SNMP versions enabled:
show running-config | section snmp

# Configure SNMPv3 and disable v1/v2c:
no snmp-server community public
no snmp-server community private

snmp-server user snmpAdmin auth_group auth sha-256 $tr0ngAuth! priv aes-128 $tr0ngPriv!
snmp-server host 10.1.1.200 use-vrf management version 3 auth snmpAdmin

snmp-server contact admin@company.com
snmp-server location DataCenter1

This recommendation verifies that unused interfaces are administratively shut down on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check unused interfaces:
show interface status | include 'disabled\|notconnect'

# Check VLAN assignment of unused ports:
show interface status | include notconnect

# Shutdown unused interfaces:
interface range Ethernet1/40-48
  shutdown
  switchport access vlan 999
  description UNUSED
  spanning-tree bpduguard enable

This recommendation verifies that port security and DHCP snooping are enabled on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check port security:
show port-security
show port-security address

# Check DHCP snooping:
show ip dhcp snooping

# Enable port security:
interface Ethernet1/1
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation restrict
  switchport port-security mac-address sticky

# Enable DHCP snooping:
feature dhcp
ip dhcp snooping
ip dhcp snooping vlan 10,20,30

This recommendation verifies that ACLs are applied to external-facing interfaces on the Cisco NX-OS network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco NX-OS network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check ACL configuration:
show access-lists summary
show access-lists

# Check ACLs applied to interfaces:
show running-config | include 'access-group'

# Apply ACLs to interfaces:
ip access-list EDGE-INBOUND
  10 permit tcp any any eq 443
  20 permit tcp any any eq 80
  30 deny ip any any log

interface Ethernet1/1
  ip access-group EDGE-INBOUND in