V-273585

Discussion

Enclaves with alternate gateway connections must take additional steps to ensure there is no compromise on the enclave network or NIPRNet. Without verifying the destination address of traffic coming from the site's alternate gateway, the perimeter router could be routing transit data from the internet into the NIPRNet. This could also make the perimeter router vulnerable to a denial-of-service (DoS) attack as well as provide a back door into the NIPRNet. The DOD enclave must ensure the ingress filter applied to external interfaces on a perimeter router connecting to an Approved Gateway is secure through filters permitting packets with a destination address belonging to the DOD enclave's address block.

Check Content

This requirement is not applicable for the DODIN Backbone.

Review the configuration of each router interface connecting to an alternate gateway.

1. Verify an ACL exists to allow only desired traffic (example includes SSL hosts).
ip access-list extended FILTER_ISP
 sequence 10 permit tcp any any established
 sequence 20 permit icmp host x.12.1.16 host x.12.1.17 echo
 sequence 30 permit icmp host x.12.1.16 host x.12.1.17 echo-reply
 sequence 40 permit tcp any host x.12.1.22 eq ssl
 sequence 50 permit tcp any host x.12.1.23 eq ssl
 sequence 60 permit esp any host x.12.1.24
 sequence 70 permit ahp any host x.12.1.24
 sequence 80 deny ip any any log
!

2. Check that ACL is applied to alternative gateway interface.
interface ethernet 1/1/10
 ip address x.12.1.10 255.255.255.0
 ip access-group FILTER_ISP in
!

If the alternative gateway interface is not configured with an ACL permitting only the destination addresses in the sites address space, this is a finding.