STIGQter: STIG Summary: Cisco IOS XE Router RTR Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Cisco out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the Network Operations Center (NOC).

DISA Rule

SV-216682r531086_rule

Vulnerability Number

V-216682

Group Title

SRG-NET-000205-RTR-000011

Rule Version

CISC-RT-000440

Severity

CAT II

CCI(s)

• CCI-001097 - The information system monitors and controls communications at the external boundary of the information system and at key internal boundaries within the system.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

Step 1: Configure the ACL to only allow traffic to the route processor from the OOBM backbone and the NOC.

R4(config)#ip access-list extended TRAFFIC_FROM_NOC
R4(config-ext-nacl)#permit ip 10.11.1.0 0.255.255.255 host 10.11.1.8
R4(config-ext-nacl)#permit ip 10.12.1.0 0.255.255.255 host 10.11.1.8
R4(config-ext-nacl)#permit ip 10.11.1.0 0.255.255.255 host 10.13.1.1
R4(config-ext-nacl)#permit ip 10.12.1.0 0.255.255.255 host 10.13.1.1
R4(config-ext-nacl)#deny ip any host 10.11.1.8 log-input
R4(config-ext-nacl)#deny ip any host 10.13.1.1 log-input
R4(config-ext-nacl)#permit ip 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0.255
R4(config-ext-nacl)#permit ip 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0.255
R4(config-ext-nacl)#deny ip any any log-input

Step 2: Configure the ACL to only allow traffic to the route processor from the OOBM LAN.

R4(config)#ip access-list extended TRAFFIC_TO_NOC
R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 host 10.13.1.1
R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 host 10.11.1.8
R4(config-ext-nacl)#deny ip any host 10.13.1.1 log-input
R4(config-ext-nacl)#deny ip any host 10.11.1.8 log-input
R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 10.11.1.0 0.0.0.255
R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 10.12.1.0 0.0.0.255
R4(config-ext-nacl)#deny ip any any log-input
R4(config-ext-nacl)#exit

Step 3: Apply the ACLs configured above to the appropriate OOBM interfaces as shown in the example below:

R4(config)#int g0/2
R4(config-if)#ip access-group TRAFFIC_FROM_NOC in
R4(config)#int g0/3
R4(config-if)#ip access-group TRAFFIC_TO_NOC in
R4(config-if)#end

Check Contents

This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

Verify that traffic destined to itself is only sourced by the OOBM or the NOC. In the example below, the OOBM backbone network is 10.11.1.0/24, the NOC address spaces is 10.12.1.0/24, and the OOBM LAN address space at remote site connecting to the managed network is 10.13.1.0/24.

Step 1: Note the inbound ACL applied to the OOBM interfaces.

interface GigabitEthernet0/2
description OOB link to NOC
ip address 10.11.1.8 255.255.255.0
ip access-group TRAFFIC_FROM_NOC in
!
interface GigabitEthernet0/3
description link to OOBM LAN access switch
ip address 10.13.1.1 255.255.255.0
ip access-group TRAFFIC_TO_NOC in

If the ACL is not configured to only allow traffic to the route processor from the OOBM backbone and the NOC, this is a finding.

Step 2: Review the inbound ACL bound to any OOB interface connecting to the OOBM backbone and verify traffic destined to itself is only from the OOBM or NOC address space.

ip access-list extended TRAFFIC_FROM_NOC
permit ip 10.11.1.0 0.255.255.255 host 10.11.1.8
permit ip 10.12.1.0 0.255.255.255 host 10.11.1.8
permit ip 10.11.1.0 0.255.255.255 host 10.13.1.1
permit ip 10.12.1.0 0.255.255.255 host 10.13.1.1
deny ip any host 10.11.1.8 log-input
deny ip any host 10.13.1.1 log-input
permit ip 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0.255
permit ip 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0.255
deny ip any any log-input

Step 3: Review the inbound ACL bound to any OOBM LAN interfaces and verify traffic destined to itself is from the OOBM LAN address space.

ip access-list extended TRAFFIC_TO_NOC
permit ip 10.13.1.0 0.255.255.255 host 10.13.1.1
permit ip 10.13.1.0 0.255.255.255 host 10.11.1.8
deny ip any host 10.13.1.1 log-input
deny ip any host 10.11.1.8 log-input
permit ip 10.13.1.0 0.255.255.255 10.11.1.0 0.0.0.255
permit ip 10.13.1.0 0.255.255.255 10.12.1.0 0.0.0.255
deny ip any any log-input

If the ACL is not configured to only allow traffic to the route processor from the OOBM LAN, this is a finding.

Vulnerability Number

V-216682

Documentable

False

Rule Version

CISC-RT-000440

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

Verify that traffic destined to itself is only sourced by the OOBM or the NOC. In the example below, the OOBM backbone network is 10.11.1.0/24, the NOC address spaces is 10.12.1.0/24, and the OOBM LAN address space at remote site connecting to the managed network is 10.13.1.0/24.

Step 1: Note the inbound ACL applied to the OOBM interfaces.

interface GigabitEthernet0/2
description OOB link to NOC
ip address 10.11.1.8 255.255.255.0
ip access-group TRAFFIC_FROM_NOC in
!
interface GigabitEthernet0/3
description link to OOBM LAN access switch
ip address 10.13.1.1 255.255.255.0
ip access-group TRAFFIC_TO_NOC in

If the ACL is not configured to only allow traffic to the route processor from the OOBM backbone and the NOC, this is a finding.

Step 2: Review the inbound ACL bound to any OOB interface connecting to the OOBM backbone and verify traffic destined to itself is only from the OOBM or NOC address space.

ip access-list extended TRAFFIC_FROM_NOC
permit ip 10.11.1.0 0.255.255.255 host 10.11.1.8
permit ip 10.12.1.0 0.255.255.255 host 10.11.1.8
permit ip 10.11.1.0 0.255.255.255 host 10.13.1.1
permit ip 10.12.1.0 0.255.255.255 host 10.13.1.1
deny ip any host 10.11.1.8 log-input
deny ip any host 10.13.1.1 log-input
permit ip 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0.255
permit ip 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0.255
deny ip any any log-input

Step 3: Review the inbound ACL bound to any OOBM LAN interfaces and verify traffic destined to itself is from the OOBM LAN address space.

ip access-list extended TRAFFIC_TO_NOC
permit ip 10.13.1.0 0.255.255.255 host 10.13.1.1
permit ip 10.13.1.0 0.255.255.255 host 10.11.1.8
deny ip any host 10.13.1.1 log-input
deny ip any host 10.11.1.8 log-input
permit ip 10.13.1.0 0.255.255.255 10.11.1.0 0.0.0.255
permit ip 10.13.1.0 0.255.255.255 10.12.1.0 0.0.0.255
deny ip any any log-input

If the ACL is not configured to only allow traffic to the route processor from the OOBM LAN, this is a finding.

Check Content Reference

M

Target Key

4028

Comments