STIGQter: STIG Summary: Cisco IOS Router RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Cisco out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the Network Operations Center (NOC).

DISA Rule

SV-216592r531085_rule

Vulnerability Number

V-216592

Group Title

SRG-NET-000205-RTR-000011

Rule Version

CISC-RT-000440

Severity

CAT II

CCI(s)

CCI-001097 - The information system monitors and controls communications at the external boundary of the information system and at key internal boundaries within the system.

Weight

Fix Recommendation

This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

Step 1: Configure the ACL to only allow traffic to the route processor from the OOBM backbone and the NOC.

R4(config)#ip access-list extended TRAFFIC_FROM_NOC
R4(config-ext-nacl)#permit ip 10.11.1.0 0.255.255.255 host 10.11.1.8
R4(config-ext-nacl)#permit ip 10.12.1.0 0.255.255.255 host 10.11.1.8
R4(config-ext-nacl)#permit ip 10.11.1.0 0.255.255.255 host 10.13.1.1
R4(config-ext-nacl)#permit ip 10.12.1.0 0.255.255.255 host 10.13.1.1
R4(config-ext-nacl)#deny ip any host 10.11.1.8 log-input
R4(config-ext-nacl)#deny ip any host 10.13.1.1 log-input
R4(config-ext-nacl)#permit ip 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0.255
R4(config-ext-nacl)#permit ip 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0.255
R4(config-ext-nacl)#deny ip any any log-input

Step 2: Configure the ACL to only allow traffic to the route processor from the OOBM LAN.

R4(config)#ip access-list extended TRAFFIC_TO_NOC
R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 host 10.13.1.1
R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 host 10.11.1.8
R4(config-ext-nacl)#deny ip any host 10.13.1.1 log-input
R4(config-ext-nacl)#deny ip any host 10.11.1.8 log-input
R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 10.11.1.0 0.0.0.255
R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 10.12.1.0 0.0.0.255
R4(config-ext-nacl)#deny ip any any log-input
R4(config-ext-nacl)#exit

Step 3: Apply the ACLs configured above to the appropriate OOBM interfaces as shown in the example below.

R4(config)#int g0/2
R4(config-if)#ip access-group TRAFFIC_FROM_NOC in
R4(config)#int g0/3
R4(config-if)#ip access-group TRAFFIC_TO_NOC in
R4(config-if)#end

Check Contents

This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

Verify that traffic destined to itself is only sourced by the OOBM or the NOC. In the example below, the OOBM backbone network is 10.11.1.0/24, the NOC address spaces is 10.12.1.0/24, and the OOBM LAN address space at remote site connecting to the managed network is 10.13.1.0/24.

Step 1: Note the inbound ACL applied to the OOBM interfaces.

interface GigabitEthernet0/2
description OOB link to NOC
ip address 10.11.1.8 255.255.255.0
ip access-group TRAFFIC_FROM_NOC in
!
interface GigabitEthernet0/3
description link to OOBM LAN access switch
ip address 10.13.1.1 255.255.255.0
ip access-group TRAFFIC_TO_NOC in

Step 2: Review the inbound ACL bound to any OOB interface connecting to the OOBM backbone and verify traffic destined to itself is only from the OOBM or NOC address space.

ip access-list extended TRAFFIC_FROM_NOC
permit ip 10.11.1.0 0.255.255.255 host 10.11.1.8
permit ip 10.12.1.0 0.255.255.255 host 10.11.1.8
permit ip 10.11.1.0 0.255.255.255 host 10.13.1.1
permit ip 10.12.1.0 0.255.255.255 host 10.13.1.1
deny ip any host 10.11.1.8 log-input
deny ip any host 10.13.1.1 log-input
permit ip 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0.255
permit ip 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0.255
deny ip any any log-input

Step 3: Review the inbound ACL bound to any OOBM LAN interfaces and verify traffic destined to itself is from the OOBM LAN address space.

ip access-list extended TRAFFIC_TO_NOC
permit ip 10.13.1.0 0.255.255.255 host 10.13.1.1
permit ip 10.13.1.0 0.255.255.255 host 10.11.1.8
deny ip any host 10.13.1.1 log-input
deny ip any host 10.11.1.8 log-input
permit ip 10.13.1.0 0.255.255.255 10.11.1.0 0.0.0.255
permit ip 10.13.1.0 0.255.255.255 10.12.1.0 0.0.0.255
deny ip any any log-input

If the router does not block any traffic destined to itself that is not sourced from the OOBM network or the NOC, this is a finding.

The Cisco out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the Network Operations Center (NOC).

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments