STIGQter: STIG Summary: HP FlexFabric Switch RTR Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jul 2020:

The HP FlexFabric Switch must not redistribute static routes to alternate gateway service provider into an Exterior Gateway Protocol or Interior Gateway Protocol to the NIPRNet or to other Autonomous System.

DISA Rule

SV-80589r1_rule

Vulnerability Number

V-66099

Group Title

SRG-NET-000019-RTR-000011

Rule Version

HFFS-RT-000002

Severity

CAT II

CCI(s)

• CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

By default the HP FlexFabric switches do not redistribute static routes via External/Internak gateway protocols. If Static routes redistribution has been configure, use the command bellow to disable it.

[HP] ospf 1
[HP-ospf-1] undo import-route static

Check Contents

Review the External/internal gateway protocol database on the HP FlexFabric Switch to ensure no static routes are being redistributed via these protocols.

If there are static routes being re-distributed, this is a finding.

[HP] display ospf lsdb

OSPF Process 1 with HP FlexFabric Switch ID 5.9.2.0
Link State Database


Area: 0.0.0.1
Type LinkState ID AdvHP FlexFabric Switch Age Len Sequence Metric
HP FlexFabric Switch 1.1.1.1 1.1.1.1 1644 48 80000155 0
HP FlexFabric Switch 5.9.2.0 5.9.2.0 233 48 8000013E 0
HP FlexFabric Switch 2.2.2.2 2.2.2.2 294 72 8000014F 0

AS External Database
Type LinkState ID AdvHP FlexFabric Switch Age Len Sequence Metric
External 16.0.0.0 5.9.2.0 233 36 80000001 1
External 15.252.0.0 5.9.2.0 233 36 80000001 1

Note: In the example above we see two external entries with the advertising HP FlexFabric Switch as the HP FlexFabric Switch. This exists when the HP FlexFabric Switch is configured to redistribute static route.

Vulnerability Number

V-66099

Documentable

False

Rule Version

HFFS-RT-000002

Severity Override Guidance

Review the External/internal gateway protocol database on the HP FlexFabric Switch to ensure no static routes are being redistributed via these protocols.

If there are static routes being re-distributed, this is a finding.

[HP] display ospf lsdb

OSPF Process 1 with HP FlexFabric Switch ID 5.9.2.0
Link State Database


Area: 0.0.0.1
Type LinkState ID AdvHP FlexFabric Switch Age Len Sequence Metric
HP FlexFabric Switch 1.1.1.1 1.1.1.1 1644 48 80000155 0
HP FlexFabric Switch 5.9.2.0 5.9.2.0 233 48 8000013E 0
HP FlexFabric Switch 2.2.2.2 2.2.2.2 294 72 8000014F 0

AS External Database
Type LinkState ID AdvHP FlexFabric Switch Age Len Sequence Metric
External 16.0.0.0 5.9.2.0 233 36 80000001 1
External 15.252.0.0 5.9.2.0 233 36 80000001 1

Note: In the example above we see two external entries with the advertising HP FlexFabric Switch as the HP FlexFabric Switch. This exists when the HP FlexFabric Switch is configured to redistribute static route.

Check Content Reference

M

Target Key

2979

Comments