← Back to Network WLAN AP-IG Management Security Technical Implementation Guide

V-243151

CAT II (Medium)

The network device must be configured with both an ingress and egress ACL.

Rule ID

SV-243151r879887_rule

STIG

Network WLAN AP-IG Management Security Technical Implementation Guide

Version

V7R2

CCIs

CCI-000345, CCI-000366

Discussion

Changes to the hardware or software components of the network device can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should be allowed administrative access to the network device for implementing any changes or upgrades. This requirement applies to updates of the application files, configuration, ACLs, and policy filters.

Check Content

1. Verify the managed interface has an inbound and outbound ACL or filter.

2. Verify the ingress ACL blocks all transit traffic (any traffic not destined to the router itself). In addition, traffic accessing the managed elements should be originated at the NOC.

3. Verify the egress ACL blocks any traffic not originated by the managed element.

If the management interface does not have an ingress and egress filter configured and applied, this is a finding.

Fix Text

If the management interface is a routed interface, configure it with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.