V-256025

Discussion

The OOBM access router will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic, thereby providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.

Check Content

Step 1: To verify the Arista router managed interface has an inbound and outbound ACL configured, execute "show run int Eth YY".

router#show interface Ethernet 3
interface ethernet 3
 ip access-group FILTER_INBOUND in
 ip access-group FILTER_OUTBOUND out

Step 2: To verify the ingress filter only allows management, IGP, and ICMP traffic, execute "show ip access-list".

router#show ip access-list
ip access-list FILTER_INBOUND
   10 permit ospf any any
   20 permit icmp any any echo
   30 permit icmp any any echo-reply
   40 permit ip 10.10.10.0/24 any
   50 deny ip any any log
!
ip access-list FILTER_OUTBOUND
   10 permit ospf any any
   20 permit icmp any any echo
   30 permit icmp any any echo-reply
   40 permit ip any 10.10.10.0/24
   50 deny ip any any log
!

Note: If the management interface is a true OOBM interface, this requirement is not applicable.

If the Arista router does not restrict traffic that ingresses and egresses the management interface, this is a finding.