The Cisco ACI layer 2 switch must establish organization-defined alternate communication paths for system operations organizational command and control.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-272047 | CACI-L2-000019 | SV-272047r1113953_rule | Medium |
| Description |
| An incident, whether adversarial- or nonadversarial-based, can disrupt established communication paths used for system operations and organizational command and control. Alternate communication paths reduce the risk of all communication paths being affected by the same incident. To compound the problem, the inability of organizational officials to obtain timely information about disruptions or to provide timely direction to operational elements after a communication path incident, can impact the ability of the organization to respond to such incidents in a timely manner. Establishing alternate communication paths for command and control purposes, including designating alternative decision makers if primary decision makers are unavailable and establishing the extent and limitations of their actions, can greatly facilitate the organization's ability to continue to operate and take appropriate actions during an incident. To establish alternate communication paths for system operations and organizational command and control within a Cisco ACI cluster using the CLI, configure a multi-pod ACI architecture with separate APIC clusters, ensuring redundancy across pods by using external IP-routed networks (Inter-Pod Network) to maintain connectivity even if one pod experiences a failure. This effectively creates diverse communication pathways for management and control functions. |
| STIG | Date |
| Cisco ACI Layer 2 Switch Security Technical Implementation Guide | 2025-06-13 |
Details
| Check Text (C-76097r1064154_chk) |
| If the connection type is remotely attached through a layer 3 network, this is not applicable. Verify the cluster status. apic1# cluster_health If the status of the clustered nodes is not "OK", this is a finding. |
| Fix Text (F-76004r1064155_fix) |
| Configure a multi-pod ACI architecture with separate APIC clusters with redundancy across pods using external IP-routed networks (Interpod Network) to connect them, allowing management access even if one pod experiences a failure. Deploy at least two separate APIC clusters (pods). apic1# conf t apic1(config)# pod <pod_name> apic1(config)# ip address <management_ip> <subnet_mask> apic1(config)# ip route <destination_network> <next_hop_ip> |