STIGQter: STIG Summary: Voice Video Services Policy Security Technical Implementation Guide Version: 3 Release: 17 Benchmark Date: 25 Oct 2019: STIGQter: STIG Summary: Voice Video Services Policy Security Technical Implementation Guide Version: 3 Release: 17 Benchmark Date: 25 Oct 2019:SV-8716r2_rule
V-8230
VLAN segregation for VVoIP
VVoIP 5500 (LAN)
CAT II
10
Deploy VVoIP systems and components on a dedicated VLAN structure that is separate from the data network VLAN structure. A minimum of one VLAN is required. More than one is highly recommended. Ensure the VVoIP system and the supporting LAN are designed and implemented using multiple VLAN/subnets to segregate the VVoIP core equipment and endpoints and services from all other hosts and services (such as data and dedicated VTC) running on the LAN such that the security, QoS, and reliability of the VVoIP system/service is enhanced thus allowing VVoIP system traffic and access control using router ACLs.
VLAN and subnets will be provided and equipment separated as follows:
> Hardware Endpoints: multiple VLAN/subnets generally in parallel with data LAN VLANs the number of which is dependent on the size of the LAN and as required for the reduction of broadcast domains per good LAN design. For small networks there will be a minimum of one.
> Software endpoints on workstations: multiples as with hardware endpoints. Voice and data traffic may coexist on the data VLAN when leaving the workstation. Based on the Unified Capabilities Requirements (UCR) requirement that the Unified Capabilities (UC) application tag its signaling and media traffic with the proper UCR defined Differentiated Service Code Point (DSCP), the LAN access switch port must route the UC traffic to the voice/video VLAN. If the LAN access switch is not capable, then routing upstream must perform this. A separate NIC is not required for UC VLANs.
> VVoIP system core control equipment containing the LSC, endpoint configuration server, and DHCP server if used, etc.
> Media gateways to the DSN and PSTN
> Signaling gateways (SG) to the DSN
> DoD WAN access VVoIP firewall (SBC or other)
> Voicemail / Unified Messaging Servers. These may need to be accessible from both the voice and data VLANs.
> UC servers such as those supporting IM/presence, web browser based conferencing, and directory services. These may need to be accessible from both the voice and data VLANs.
NOTE: These VLAN/subnets may be replaced by direct connections to the VVoIP core routing devices so that the ACLs may be implemented on the physical interface to the device. This requires that such direct physical connections be given a discrete subnet.
NOTE: The VLAN/subnets and associated ACLs need only to be assigned / applied for devices that exist in the VVoIP system. The VLAN / ACL design may change depending upon the location and physical makeup of the VVoIP core equipment. An example of this is if a MG and SG reside on the same platform and both use the same Ethernet LAN connections (and potentially the same or different IP address), then separate VLANs are not needed for the MG and SG but the ACL protecting them may need to be adjusted accordingly.
Interview the ISSO to confirm compliance with the following requirement:
Ensure the VVoIP system and the supporting LAN are designed and implemented using multiple VLANs to segregate the VVoIP core equipment and endpoints and services from all other hosts and services (such as data and dedicated VTC) running on the LAN such that the security, QoS, and reliability of the VVoIP system/service is enhanced thus allowing VVoIP system traffic and access control using router ACLs.
VLANs and subnets will be provided and equipment separated, for those devices that are implemented in the system, as follows:
> Hardware Endpoints: multiple VLANs generally in parallel with data LAN VLANs the number of which is dependent on the size of the LAN and as required for the reduction of broadcast domains per good LAN design. For small networks there will be a minimum of one.
> Software endpoints on workstations: multiples as with hardware endpoints. Voice and data traffic may coexist on the data VLAN when leaving the workstation. Based on the Unified Capabilities Requirements (UCR) requirement that the Unified Capabilities (UC) application tag its signaling and media traffic with the proper UCR defined Differentiated Service Code Point (DSCP), the LAN access switch port must route the UC traffic to the voice/video VLAN. If the LAN access switch is not capable, then routing upstream must perform this. A separate NIC is not required for UC VLANs.
> VVoIP system core control equipment containing the LSC, endpoint configuration server, and DHCP server if used, etc.
> Media gateways (MG) to the DSN and PSTN.
> Signaling gateways (SG) to the DSN.
> DoD WAN access VVoIP firewall (SBC or other).
> Voicemail / Unified Messaging Servers. These may need to be accessible from both the voice and data VLANs.
> UC servers such as those supporting unified messaging, IM/presence, “web” browser based conferencing, and directory services. These may need to be accessible from both the voice and data VLANs.
NOTE: Hardware based VTC endpoints that utilize LSC services for session control may reside in the VoIP endpoint VLANs. These may include desktop and “executive” or office based units. All other Hardware based VTC endpoints require their own dedicated network or VLAN.
NOTE: Separate VLANs work in conjunction with the dedicated address space discussed earlier to provide the required effect. Each VLAN is configured with a subset of addresses (valid IP subnet) from the designated VVoIP address space
NOTE: Per NI STIG requirements the NE’s default VLAN (VLAN 0 or 1) will not be used for any of the required VVoIP, data, or VTC VLANs.
NOTE: ACLs are required between the various VLANs that will filter traffic between them based on what protocols and IP addresses are permitted to access or control the devices residing in the VLAN. Therefore it is expected that the LAN / VVoIP system design will include one or more routers or layer-3 switches as the intersection of all of these VLANs to access and traffic flow between them. This routing device will be configured with ACLs to only permit the functionally necessary traffic to flow between the various VLANs and the equipment they contain.
NOTE: These VLANs may be replaced by direct connections to the VVoIP core routing devices so that the ACLs may be implemented on the physical interface to the device. This requires that such direct physical connections be given a discrete subnet.
NOTE: The VLAN/subnets and associated ACLs need only to be assigned / applied for devices that exist in the VVoIP system. The VLAN / ACL design may change depending upon the location and physical makeup of the VVoIP core equipment. An example of this is if a MG and SG reside on the same platform and both use the same Ethernet LAN connections (and potentially the same or different IP address), then separate VLANs are not needed for the MG and SG but the ACL protecting them may need to be adjusted accordingly.
This is a finding in the event the design or implementation of the VVoIP system and supporting LAN does not include the required VLANs and subnets based upon the equipment and services provided by or included in the VVoIP system. Size of the system or the number of users supported has no effect on the need for this segmentation. However under some circumstances such as in the case of a small deployable package the number of VLANs can be reduced based upon a benefit vs. risk assessment, AO approval, and package C&A.
NOTE: The existence of the required VLANs will be validated in subsequent computing checks. The purpose of this check is to determine if the system design and implementation plan includes consideration for VLAN segmentation.
V-8230
False
VVoIP 5500 (LAN)
Interview the ISSO to confirm compliance with the following requirement:
Ensure the VVoIP system and the supporting LAN are designed and implemented using multiple VLANs to segregate the VVoIP core equipment and endpoints and services from all other hosts and services (such as data and dedicated VTC) running on the LAN such that the security, QoS, and reliability of the VVoIP system/service is enhanced thus allowing VVoIP system traffic and access control using router ACLs.
VLANs and subnets will be provided and equipment separated, for those devices that are implemented in the system, as follows:
> Hardware Endpoints: multiple VLANs generally in parallel with data LAN VLANs the number of which is dependent on the size of the LAN and as required for the reduction of broadcast domains per good LAN design. For small networks there will be a minimum of one.
> Software endpoints on workstations: multiples as with hardware endpoints. Voice and data traffic may coexist on the data VLAN when leaving the workstation. Based on the Unified Capabilities Requirements (UCR) requirement that the Unified Capabilities (UC) application tag its signaling and media traffic with the proper UCR defined Differentiated Service Code Point (DSCP), the LAN access switch port must route the UC traffic to the voice/video VLAN. If the LAN access switch is not capable, then routing upstream must perform this. A separate NIC is not required for UC VLANs.
> VVoIP system core control equipment containing the LSC, endpoint configuration server, and DHCP server if used, etc.
> Media gateways (MG) to the DSN and PSTN.
> Signaling gateways (SG) to the DSN.
> DoD WAN access VVoIP firewall (SBC or other).
> Voicemail / Unified Messaging Servers. These may need to be accessible from both the voice and data VLANs.
> UC servers such as those supporting unified messaging, IM/presence, “web” browser based conferencing, and directory services. These may need to be accessible from both the voice and data VLANs.
NOTE: Hardware based VTC endpoints that utilize LSC services for session control may reside in the VoIP endpoint VLANs. These may include desktop and “executive” or office based units. All other Hardware based VTC endpoints require their own dedicated network or VLAN.
NOTE: Separate VLANs work in conjunction with the dedicated address space discussed earlier to provide the required effect. Each VLAN is configured with a subset of addresses (valid IP subnet) from the designated VVoIP address space
NOTE: Per NI STIG requirements the NE’s default VLAN (VLAN 0 or 1) will not be used for any of the required VVoIP, data, or VTC VLANs.
NOTE: ACLs are required between the various VLANs that will filter traffic between them based on what protocols and IP addresses are permitted to access or control the devices residing in the VLAN. Therefore it is expected that the LAN / VVoIP system design will include one or more routers or layer-3 switches as the intersection of all of these VLANs to access and traffic flow between them. This routing device will be configured with ACLs to only permit the functionally necessary traffic to flow between the various VLANs and the equipment they contain.
NOTE: These VLANs may be replaced by direct connections to the VVoIP core routing devices so that the ACLs may be implemented on the physical interface to the device. This requires that such direct physical connections be given a discrete subnet.
NOTE: The VLAN/subnets and associated ACLs need only to be assigned / applied for devices that exist in the VVoIP system. The VLAN / ACL design may change depending upon the location and physical makeup of the VVoIP core equipment. An example of this is if a MG and SG reside on the same platform and both use the same Ethernet LAN connections (and potentially the same or different IP address), then separate VLANs are not needed for the MG and SG but the ACL protecting them may need to be adjusted accordingly.
This is a finding in the event the design or implementation of the VVoIP system and supporting LAN does not include the required VLANs and subnets based upon the equipment and services provided by or included in the VVoIP system. Size of the system or the number of users supported has no effect on the need for this segmentation. However under some circumstances such as in the case of a small deployable package the number of VLANs can be reduced based upon a benefit vs. risk assessment, AO approval, and package C&A.
NOTE: The existence of the required VLANs will be validated in subsequent computing checks. The purpose of this check is to determine if the system design and implementation plan includes consideration for VLAN segmentation.
M
Information Assurance Officer
594