V-216767

Discussion

For in-band management, the management network must have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the perimeter of the managed network.

Check Content

This requirement is not applicable for the DODIN Backbone.

The perimeter router of the managed network must be configured with an outbound ACL on the egress interface to block all management traffic as shown in the example below.

Step 1: Verify that all external interfaces has been configured with an outbound ACL as shown in the example below.

interface GigabitEthernet0/0/0/2
 ipv4 address 10.1.35.3 255.255.255.0
 ipv4 access-group EXTERNAL_ACL_OUTBOUND egress

Step 2: Verify that the outbound ACL discards management traffic as shown in the example below.

ipv4 access-list EXTERNAL_ACL_OUTBOUND
 10 deny tcp any any eq tacacs log-input
 20 deny tcp any any eq ssh log-input
 30 deny udp any any eq snmp log-input
 40 deny udp any any eq snmptrap log-input
 50 deny udp any any eq syslog log-input
 60 permit tcp any any eq www log-input
 70 deny ipv4 any any log-input

If management traffic is not blocked at the perimeter, this is a finding.