The Compliance (and\or) doesn't seem to make sense to me. Help me understand

jdbrande, when removing the router conditions and just have session-limit 2 in there and test it against the devices do they show as a violation? here you are defining the string you are looking for, at the policy creation is where you define the nodes it'll be checked against so you don't need to add any of that scoping logic to the rule 

Router 1 2 and 3 show in violation because they don't support that specific command.  However There are 23 other stigs that I run in the same Policy that needs to check all 4 Routers

jdbrande, the rule is not where you exclude/include logic for checking/not checking a device. The rule is where you define the data you want it to look for. All that other logic is done in the policy section. Trying to add that logic into the rule section is more headache than its worth

I would recommend this workflow

- create the rule and validate it works correctly (device that has it shows as not violated and device that doesnt have it shows as violated

-when creating the policy define that router 1, 2, 3 should not be looked at for this rule. but the 23 other stigs 

-reports can contain multiple policies and policies can contain multiple rules. I'm sure if you break this up you can find a fit that checks every appropriate rule against every appropriate device.