STIGQter: STIG Summary: Cisco IOS XE Router RTR Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Cisco out-of-band management (OOBM) gateway router must be configured to not redistribute routes between the management network routing domain and the managed network routing domain.

DISA Rule

SV-216681r531086_rule

Vulnerability Number

V-216681

Group Title

SRG-NET-000019-RTR-000012

Rule Version

CISC-RT-000430

Severity

CAT II

CCI(s)

• CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Remove the configuration that imports routes from the managed network into the management network or vice versa as shown in the example below:

R1(config)#ip vrf MGMT
R1(config-vrf)#no route-target import 8:8

Check Contents

This requirement is not applicable for the DODIN Backbone.

Verify the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network, and vice versa. The example below imports OSPF routes from the production route table (VRF PROD) into the management route table (VRF MGMT) using BGP.

ip vrf MGMT
rd 4:4
route-target export 4:4
route-target import 4:4
route-target import 8:8
!
ip vrf PROD
rd 8:8
route-target import 8:8
route-target export 8:8
…
…
…
router ospf 1 vrf MGMT
log-adjacency-changes
redistribute bgp 64512 subnets
network 0.0.0.0 255.255.255.255 area 0
!
router ospf 2 vrf PROD
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
!
router bgp 64512
no synchronization
bgp log-neighbor-changes
no auto-summary
!
address-family ipv4 vrf MGMT
no synchronization
redistribute ospf 1 vrf MGMT
exit-address-family
!
address-family ipv4 vrf PROD
no synchronization
redistribute ospf 2 vrf PROD
exit-address-family

If the IGP instance used for the managed network redistributes routes into the IGP instance used for the management network, or vice versa, this is a finding.

Vulnerability Number

V-216681

Documentable

False

Rule Version

CISC-RT-000430

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Verify the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network, and vice versa. The example below imports OSPF routes from the production route table (VRF PROD) into the management route table (VRF MGMT) using BGP.

ip vrf MGMT
rd 4:4
route-target export 4:4
route-target import 4:4
route-target import 8:8
!
ip vrf PROD
rd 8:8
route-target import 8:8
route-target export 8:8
…
…
…
router ospf 1 vrf MGMT
log-adjacency-changes
redistribute bgp 64512 subnets
network 0.0.0.0 255.255.255.255 area 0
!
router ospf 2 vrf PROD
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
!
router bgp 64512
no synchronization
bgp log-neighbor-changes
no auto-summary
!
address-family ipv4 vrf MGMT
no synchronization
redistribute ospf 1 vrf MGMT
exit-address-family
!
address-family ipv4 vrf PROD
no synchronization
redistribute ospf 2 vrf PROD
exit-address-family

If the IGP instance used for the managed network redistributes routes into the IGP instance used for the management network, or vice versa, this is a finding.

Check Content Reference

M

Target Key

4028

Comments