V-221099

Discussion

For in-band management, the management network must have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes, such as switches and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the perimeter of the managed network.

Check Content

The perimeter switch of the managed network must be configured with an outbound ACL on the egress interface to block all management traffic as shown in the example below:

Step 1: Verify that all external interfaces has been configured with an outbound ACL as shown in the example below:

interface Ethernet2/2
 description link to DISN
 no switchport
 ip access-group EXTERNAL_ACL_OUTBOUND out
 ip address x.11.1.2 255.255.255.254

Step 2: Verify that the outbound ACL discards management traffic as shown in the example below:

ip access-list EXTERNAL_ACL_OUTBOUND
 10 deny tcp any any eq tacacs log 
 20 deny tcp any any eq 22 log 
 30 deny udp any any eq snmp log 
 40 deny udp any any eq snmptrap log 
 50 deny udp any any eq syslog log 
 60 permit tcp any any eq www log 
 70 deny ip any any log

If management traffic is not blocked at the perimeter, this is a finding.