[ Applies to ] StorageGuard / Cisco MDS / Storage Network
This article lists the recommended baseline checks for Cisco MDS. It is also applicable for Dell Connectrix, HPE Storage Networking, IBM Storage Networking and Lenovo ThinkSystem Fibre Channel Switches. Core6 updates the list periodically as new StorageGuard checks become available.
In this article
Overview
Cisco MDS 9000 multilayer directors and fabric switches connect servers and storage in a Storage Area Network (SAN), running NX-OS.
Why hardening Cisco MDS matters
The SAN fabric controls which hosts can reach which storage. Hardening management access, AAA, zoning, port security and fabric binding prevents unauthorized access and fabric disruption.
Recommended baseline checks
The baseline below contains 177 checks, listed alphabetically.
| ID | Configuration check | Component |
|---|---|---|
| SG-M2191T037V01 | AAA configuration | MDS (NX-OS) |
| SG-C0867T037V01 | AAA fallback to local on error | MDS (NX-OS) |
| SG-C0207T037V01 | Absolute session timeout | MDS (NX-OS) |
| SG-C0391T037V01 | Account lockout duration enforcement | MDS (NX-OS) |
| SG-C0168T037V01 | Account lockout is enforced | MDS (NX-OS) |
| SG-C0393T037V01 | Account lockout threshold | MDS (NX-OS) |
| SG-M8241T037V01 | Account lockout threshold enforcement | MDS (NX-OS) |
| SG-M4688T037V01 | Approved admin users / groups | MDS (NX-OS) |
| SG-C0864T037V01 | Approved DNS domain | MDS (NX-OS) |
| SG-C0449T037V01 | Approved DNS servers | MDS (NX-OS) |
| SG-C0866T037V01 | Approved enabled SNMP traps | MDS (NX-OS) |
| SG-M5040T037V01 | Approved Identity provider (LDAP) servers | MDS (NX-OS) |
| SG-C0437T037V01 | Approved identity provider servers | MDS (NX-OS) |
| SG-C0437T037V03 | Approved identity provider servers - RADIUS | MDS (NX-OS) |
| SG-C0437T037V02 | Approved identity provider servers - TACACS+ | MDS (NX-OS) |
| SG-C0435T037V01 | Approved LDAP servers | MDS (NX-OS) |
| SG-C0013T037V01 | Approved NTP servers | MDS (NX-OS) |
| SG-M7683T037V01 | Approved OS release installed | MDS (NX-OS) |
| SG-C0851T037V01 | Approved SNMP contact | MDS (NX-OS) |
| SG-C0852T037V01 | Approved SNMP location | MDS (NX-OS) |
| SG-C0015T037V01 | Approved Syslog servers | MDS (NX-OS) |
| SG-C0001T037V01 | Audit logging status | MDS (NX-OS) |
| SG-C0031T037V01 | Authentication server configuration | MDS (NX-OS) |
| SG-C0024T037V01 | Authentication server redundancy | MDS (NX-OS) |
| SG-C0879T037V01 | Authentication server response timeout | MDS (NX-OS) |
| SG-C0880T037V01 | Authentication server retransmit count | MDS (NX-OS) |
| SG-M4927T037V01 | Banner (motd) status | MDS (NX-OS) |
| SG-M5129T037V01 | Central Certificate Authority (CA) status | MDS (NX-OS) |
| SG-C0030T037V01 | Centralized authentication service status | MDS (NX-OS) |
| SG-C0029T037V01 | Centralized log server | MDS (NX-OS) |
| SG-C0233T037V01 | Centralized log server redundancy | MDS (NX-OS) |
| SG-M7071T037V01 | Certificate issuer | MDS (NX-OS) |
| SG-M1207T037V01 | Certificate signature algorithm | MDS (NX-OS) |
| SG-M1527T037V01 | Certificate validity | MDS (NX-OS) |
| SG-M7907T037V01 | Configuration backup | MDS (NX-OS) |
| SG-C0854T037V01 | Console logging status | MDS (NX-OS) |
| SG-C0857T037V01 | Console login authentication method | MDS (NX-OS) |
| SG-C0139T037V01 | Default F port mode | MDS (NX-OS) |
| SG-M4887T037V01 | Default FC port mode | MDS (NX-OS) |
| SG-C0056T037V01 | Default passwords | MDS (NX-OS) |
| SG-M9540T037V01 | Default port state | MDS (NX-OS) |
| SG-C0336T037V01 | Default role configuration | MDS (NX-OS) |
| SG-C0868T037V01 | Default trunk mode | MDS (NX-OS) |
| SG-C0872T037V01 | Default zone distribution | MDS (NX-OS) |
| SG-C0858T037V01 | Default zone mode | MDS (NX-OS) |
| SG-C0176T037V01 | Default zone policy | MDS (NX-OS) |
| SG-C0865T037V01 | Device-alias database mode | MDS (NX-OS) |
| SG-C0874T037V01 | Device-alias fabric-wide synchronization enabled | MDS (NX-OS) |
| SG-M1548T037V01 | DHCHAP authentication timeout | MDS (NX-OS) |
| SG-M6419T037V01 | DHCHAP DH group | MDS (NX-OS) |
| SG-M3160T037V01 | DHCHAP hash algorithm | MDS (NX-OS) |
| SG-M4646T037V01 | DHCHAP mode | MDS (NX-OS) |
| SG-C0137T037V01 | Disable inactive users - Grace time | MDS (NX-OS) |
| SG-C0060T037V01 | DNS server redundancy | MDS (NX-OS) |
| SG-C0244T037V01 | DNS service status | MDS (NX-OS) |
| SG-C0601T037V01 | End of security updates | MDS (NX-OS) |
| SG-C0601T236V01 | End of security updates | NDFC |
| SG-C0600T037V01 | End of support | MDS (NX-OS) |
| SG-C0600T236V01 | End of support | NDFC |
| SG-M7204T037V01 | ENTERPRISE_PKG license | MDS (NX-OS) |
| SG-M8078T037V01 | ESP mode | MDS (NX-OS) |
| SG-M4912T037V01 | ESP status | MDS (NX-OS) |
| SG-C0175T037V01 | Event types enabled for audit logging | MDS (NX-OS) |
| SG-C0856T037V01 | Expected SCP status | MDS (NX-OS) |
| SG-C0855T037V01 | Expected SFTP status | MDS (NX-OS) |
| SG-C0162T037V01 | Expired SSL certificate | MDS (NX-OS) |
| SG-M9140T037V01 | External syslog server redundancy | MDS (NX-OS) |
| SG-M1119T037V01 | Fabric binding state | MDS (NX-OS) |
| SG-C0869T037V01 | Fabric port congestion-drop timeout | MDS (NX-OS) |
| SG-C0870T037V01 | Fabric port no-credit recovery timeout | MDS (NX-OS) |
| SG-C0871T037V01 | Fabric port slow-drain monitoring | MDS (NX-OS) |
| SG-M6501T037V01 | Fabric-binding activated | MDS (NX-OS) |
| SG-C0882T037V01 | Failed login attempt window | MDS (NX-OS) |
| SG-C0184T037V01 | FC-CT management status | MDS (NX-OS) |
| SG-M7150T037V01 | FCSP (DHCHAP) status | MDS (NX-OS) |
| SG-C0177T037V01 | FIPS mode status | MDS (NX-OS) |
| SG-C0601T037V02 | Future end of security updates | MDS (NX-OS) |
| SG-C0601T236V02 | Future end of security updates | NDFC |
| SG-C0600T037V02 | Future end of support | MDS (NX-OS) |
| SG-C0600T236V02 | Future end of support | NDFC |
| SG-C0381T037V01 | HTTP service status | MDS (NX-OS) |
| SG-C0209T037V02 | Idle session timeout | MDS (NX-OS) |
| SG-C0209T037V01 | Idle session timeout - ISCSI initiator | MDS (NX-OS) |
| SG-M2242T037V01 | Ike status | MDS (NX-OS) |
| SG-M6435T037V01 | Ike version | MDS (NX-OS) |
| SG-M9845T037V01 | IP ACL configuration | MDS (NX-OS) |
| SG-M8481T037V01 | IPSec authentication method | MDS (NX-OS) |
| SG-M1847T037V01 | IPsec configuration | MDS (NX-OS) |
| SG-M3504T037V01 | IPSec hash algorithm | MDS (NX-OS) |
| SG-M4136T037V01 | IPSec keepalive | MDS (NX-OS) |
| SG-M1208T037V01 | IPSec lifetime | MDS (NX-OS) |
| SG-M1857T037V01 | IPSec policy | MDS (NX-OS) |
| SG-M3152T037V01 | iSCSI initiator idle-timeout | MDS (NX-OS) |
| SG-C0254T037V01 | Key exchange algorithms | MDS (NX-OS) |
| SG-M1256T037V01 | Key type | MDS (NX-OS) |
| SG-C0025T037V01 | LDAP server redundancy | MDS (NX-OS) |
| SG-C0881T037V01 | Maximum passphrase length | MDS (NX-OS) |
| SG-C0234T037V01 | Maximum password age | MDS (NX-OS) |
| SG-M7678T037V01 | Maximum password lifetime | MDS (NX-OS) |
| SG-C0392T037V01 | Minimum account lockout duration | MDS (NX-OS) |
| SG-C0264T037V01 | Minimum password length | MDS (NX-OS) |
| SG-C0428T037V01 | MOTD message | MDS (NX-OS) |
| SG-C0423T037V01 | MOTD status | MDS (NX-OS) |
| SG-C0231T037V01 | Non-default local users | MDS (NX-OS) |
| SG-C0275T037V01 | Non-expired users | MDS (NX-OS) |
| SG-C0875T037V01 | NPIV feature status | MDS (NX-OS) |
| SG-C0171T037V01 | NTP server configuration | MDS (NX-OS) |
| SG-C0432T037V01 | NTP server redundancy | MDS (NX-OS) |
| SG-M9697T037V01 | NTP service status | MDS (NX-OS) |
| SG-M6805T037V01 | Password change grace time | MDS (NX-OS) |
| SG-C0283T037V01 | Password change security | MDS (NX-OS) |
| SG-C0417T037V01 | Password hash strength | MDS (NX-OS) |
| SG-C0278T037V01 | Password strength enforcement | MDS (NX-OS) |
| SG-M6441T037V01 | Persistent port security configuration | MDS (NX-OS) |
| SG-C0142T037V01 | Persistent ports state | MDS (NX-OS) |
| SG-M5818T037V01 | Port security activated for VSAN | MDS (NX-OS) |
| SG-M4822T037V01 | Port security distribution | MDS (NX-OS) |
| SG-C0248T037V01 | Port security feature status | MDS (NX-OS) |
| SG-C0286T037V01 | Power supply mode | MDS (NX-OS) |
| SG-C0414T037V01 | Public key algorithm | MDS (NX-OS) |
| SG-C0878T037V01 | Radius server key encryption | MDS (NX-OS) |
| SG-M7771T037V01 | Remote support configuration | MDS (NX-OS) |
| SG-C0138T037V01 | Remote support status | MDS (NX-OS) |
| SG-C0877T037V01 | Remote syslog forwarding status | MDS (NX-OS) |
| SG-C0450T037V01 | Required DNS servers | MDS (NX-OS) |
| SG-M5485T037V01 | Required Identity provider (LDAP) servers | MDS (NX-OS) |
| SG-C0441T037V03 | Required identity provider servers | MDS (NX-OS) |
| SG-C0441T037V02 | Required identity provider servers - RADIUS | MDS (NX-OS) |
| SG-C0441T037V01 | Required identity provider servers - TACACS+ | MDS (NX-OS) |
| SG-C0439T037V01 | Required LDAP servers | MDS (NX-OS) |
| SG-C0014T037V01 | Required NTP servers | MDS (NX-OS) |
| SG-C0016T037V01 | Required Syslog servers | MDS (NX-OS) |
| SG-C0387T037V01 | SAN Fabric - Zone member identification | MDS (NX-OS) |
| SG-M8185T037V01 | SCP status | MDS (NX-OS) |
| SG-C0447T037V01 | Self-signed certificate | MDS (NX-OS) |
| SG-M4853T037V01 | SFTP status | MDS (NX-OS) |
| SG-C0058T037V01 | SNMP community default string | MDS (NX-OS) |
| SG-C0420T037V01 | SNMP message privacy enforcement | MDS (NX-OS) |
| SG-M7288T037V01 | SNMP status | MDS (NX-OS) |
| SG-C0853T037V01 | SNMP TCP session authentication | MDS (NX-OS) |
| SG-M2626T037V01 | SNMP user authentication | MDS (NX-OS) |
| SG-M8496T037V01 | SNMP user privacy | MDS (NX-OS) |
| SG-C0123T037V01 | SNMP versions enabled | MDS (NX-OS) |
| SG-C0422T037V01 | SNMPv3 privacy encryption algorithm | MDS (NX-OS) |
| SG-C0419T037V01 | SNMPv3 user authentication protocol | MDS (NX-OS) |
| SG-C0258T037V01 | SSH cipher strength | MDS (NX-OS) |
| SG-C0860T037V01 | SSH ciphers permitted | MDS (NX-OS) |
| SG-C0859T037V01 | SSH ECDSA host key | MDS (NX-OS) |
| SG-C0863T037V01 | SSH host key types permitted | MDS (NX-OS) |
| SG-M6744T037V01 | SSH key bitcount | MDS (NX-OS) |
| SG-C0861T037V01 | SSH key exchange algorithms permitted | MDS (NX-OS) |
| SG-C0236T037V01 | SSH key size | MDS (NX-OS) |
| SG-M6012T037V01 | SSH login attempts | MDS (NX-OS) |
| SG-C0862T037V01 | SSH MAC algorithms permitted | MDS (NX-OS) |
| SG-C0255T037V01 | SSH MAC strength | MDS (NX-OS) |
| SG-C0124T037V01 | SSHv1 status | MDS (NX-OS) |
| SG-M8752T037V01 | SSL certificate status | MDS (NX-OS) |
| SG-M6713T037V01 | Strong dhchap secret | MDS (NX-OS) |
| SG-C0418T037V01 | Strong password encryption | MDS (NX-OS) |
| SG-M4940T037V01 | Target Cisco MDS software release | MDS (NX-OS) |
| SG-C0019T037V01 | Target OS version | MDS (NX-OS) |
| SG-C0385T037V01 | Telnet service status | MDS (NX-OS) |
| SG-M2199T037V01 | TFTP/FTP status | MDS (NX-OS) |
| SG-M3775T037V01 | TLS level check | MDS (NX-OS) |
| SG-C0448T037V01 | Trusted certificate-authority (CA) | MDS (NX-OS) |
| SG-C0116T037V01 | Unapproved admin users | MDS (NX-OS) |
| SG-M2879T037V01 | Unused zone members | MDS (NX-OS) |
| SG-M5394T037V01 | Unused zones | MDS (NX-OS) |
| SG-M6082T037V01 | User role association | MDS (NX-OS) |
| SG-C0341T037V01 | User role configuration | MDS (NX-OS) |
| SG-C0342T037V01 | Users are not assigned with roles | MDS (NX-OS) |
| SG-M3879T037V01 | VSAN security auto-learning | MDS (NX-OS) |
| SG-C0170T037V01 | Watch-for-login-attacks feature | MDS (NX-OS) |
| SG-M4844T037V01 | Weak key exchange algorithms are disabled | MDS (NX-OS) |
| SG-M8834T037V01 | Weak SSH ciphers are disabled | MDS (NX-OS) |
| SG-M5403T037V01 | Weak SSH MACs are disabled | MDS (NX-OS) |
| SG-C0873T037V01 | Zone activation overwrite control | MDS (NX-OS) |
Related components
A complete baseline also covers the components that manage, connect to or protect Cisco MDS. Review the configuration of:
- Cisco Nexus Dashboard Fabric Controller (NDFC)
- Cisco UCS Manager
- Cisco Nexus switches
Run checks with StorageGuard
Want automated validation? StorageGuard continuously scans Cisco MDS against a baseline and reports misconfigurations, with remediation guidance. Contact us to see it in your environment, or learn more about StorageGuard.
[ Still need help? ]
Our support team is here to help. Submit a request.
Comments
0 comments
Please sign in to leave a comment.