STIGQter: STIG Summary: Cisco IOS XR Router RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Cisco out-of-band management (OOBM) gateway router must be configured to not redistribute routes between the management network routing domain and the managed network routing domain.

DISA Rule

SV-216771r531087_rule

Vulnerability Number

V-216771

Group Title

SRG-NET-000019-RTR-000012

Rule Version

CISC-RT-000430

Severity

CAT II

CCI(s)

• CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Remove the configuration that imports routes from the managed network into the management network or vice versa as shown in the example below.

RP/0/0/CPU0:R2(config)#vrf MGMT
RP/0/0/CPU0:R2(config-vrf)#address-family ipv4 unicast
RP/0/0/CPU0:R2(config-vrf-af)#no import route-target 8:8
RP/0/0/CPU0:R2(config-vrf-af)#end

Check Contents

This requirement is not applicable for the DODIN Backbone.

Verify the Interior Gateway Protocol (IGP) instance used for the managed network does not redistribute routes into the IGP instance used for the management network, and vice versa. The example below imports OSPF routes from the production route table (VRF PROD) into the management route table (VRF MGMT) using BGP.

vrf MGMT
address-family ipv4 unicast
import route-target
4:4
8:8
!
export route-target
4:4
!
!
!
vrf PROD
address-family ipv4 unicast
import route-target
8:8
!
export route-target
8:8
!
!
!
…
…
…
router ospf 2
vrf MGMT
redistribute bgp 64512
area 0
interface GigabitEthernet0/0/0/0.2
!
!
!
!
router ospf 3
vrf PROD
area 0
interface GigabitEthernet0/0/0/0.3
!
!
!
!
router bgp 64512
address-family ipv4 unicast
!
address-family vpnv4 unicast
!
vrf MGMT
rd 4:4
address-family ipv4 unicast
redistribute ospf 2
!
!
vrf PROD
rd 8:8
address-family ipv4 unicast
redistribute ospf 3
!
!
!

If the IGP instance used for the managed network redistributes routes into the IGP instance used for the management network, or vice versa, this is a finding.

Vulnerability Number

V-216771

Documentable

False

Rule Version

CISC-RT-000430

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Verify the Interior Gateway Protocol (IGP) instance used for the managed network does not redistribute routes into the IGP instance used for the management network, and vice versa. The example below imports OSPF routes from the production route table (VRF PROD) into the management route table (VRF MGMT) using BGP.

vrf MGMT
address-family ipv4 unicast
import route-target
4:4
8:8
!
export route-target
4:4
!
!
!
vrf PROD
address-family ipv4 unicast
import route-target
8:8
!
export route-target
8:8
!
!
!
…
…
…
router ospf 2
vrf MGMT
redistribute bgp 64512
area 0
interface GigabitEthernet0/0/0/0.2
!
!
!
!
router ospf 3
vrf PROD
area 0
interface GigabitEthernet0/0/0/0.3
!
!
!
!
router bgp 64512
address-family ipv4 unicast
!
address-family vpnv4 unicast
!
vrf MGMT
rd 4:4
address-family ipv4 unicast
redistribute ospf 2
!
!
vrf PROD
rd 8:8
address-family ipv4 unicast
redistribute ospf 3
!
!
!

If the IGP instance used for the managed network redistributes routes into the IGP instance used for the management network, or vice versa, this is a finding.

Check Content Reference

M

Target Key

4029

Comments