Infrastructure L3 Switch V8R20

a

The network device must log all interface access control lists (ACL) deny statements.

Low - V-3000 - SV-3000r4_rule

RMF Control

Severity

L

CCI

Version

NET1020

Vuln IDs

V-3000

Rule IDs

SV-3000r4_rule

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack, or identify a configuration mistake on the device.Information Assurance Officer

Checks: C-3947r6_chk

Review the network device interface ACLs to verify all deny statements are logged. If deny statements are not logged, this is a finding.

Fix: F-3025r4_fix

Configure interface ACLs to log all deny statements.

b

The IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network.

Medium - V-3008 - SV-3008r1_rule

RMF Control

Severity

M

CCI

Version

NET1800

Vuln IDs

V-3008

Rule IDs

SV-3008r1_rule

Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the premise of the managed networks and at the NOC. Dedicated links can be deployed using provisioned circuits (ATM, Frame Relay, SONET, T-carrier, and others or VPN technologies such as subscribing to MPLS Layer 2 and Layer 3 VPN services) or implementing a secured path with gateway-to-gateway IPsec tunnel. The tunnel mode ensures that the management traffic will be logically separated from any other traffic traversing the same path.Information Assurance Officer

Checks: C-3837r1_chk

Have the SA display the configuration settings that enable this feature. Review the network topology diagram, and review VPN concentrators. Determine if tunnel mode is being used by reviewing the configuration. Examples: In CISCO Router(config)# crypto ipsec transform-set transform-set-name transform1 Router(cfg-crypto-tran)# mode tunnel OR in Junos edit security ipsec security-association sa-name] mode tunnel

Fix: F-3033r1_fix

Establish the VPN as a tunneled VPN. Terminate the tunneled VPN outside of the firewall. Ensure all host-to-host VPN are established between trusted known hosts.

c

Network devices must be password protected.

High - V-3012 - SV-3012r4_rule

RMF Control

Severity

H

CCI

Version

NET0230

Vuln IDs

V-3012

Rule IDs

SV-3012r4_rule

Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.Information Assurance Officer

Checks: C-3456r6_chk

Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required. If passwords aren't used to administrative access to the device, this is a finding.

Fix: F-3037r6_fix

Configure the network devices so it will require a password to gain administrative access to the device.

b

Network devices must display the DoD-approved logon banner warning.

Medium - V-3013 - SV-3013r4_rule

RMF Control

Severity

M

CCI

Version

NET0340

Vuln IDs

V-3013

Rule IDs

SV-3013r4_rule

All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed. DoD CIO has issued new, mandatory policy standardizing the wording of "notice and consent" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, "Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.Information Assurance Officer

Checks: C-3474r10_chk

Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't." If the device configuration does not have a logon banner as stated above, this is a finding.

Fix: F-3038r8_fix

Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."

b

The network devices must timeout management connections for administrative access after 10 minutes or less of inactivity.

Medium - V-3014 - SV-3014r4_rule

RMF Control

Severity

M

CCI

Version

NET1639

Vuln IDs

V-3014

Rule IDs

SV-3014r4_rule

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network device and a PC or terminal server when the later has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device as well as reduce the risk of a management session from being hijacked. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance Officer

Checks: C-3540r6_chk

Review the management connection for administrative access and verify the network device is configured to time-out the connection at 10 minutes or less of inactivity. If the device does not terminate inactive management connections at 10 minutes or less, this is a finding.

Fix: F-3039r5_fix

Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.

a

Network devices must have DNS servers defined if it is configured as a client resolver.

Low - V-3020 - SV-3020r3_rule

RMF Control

Severity

L

CCI

Version

NET0820

Vuln IDs

V-3020

Rule IDs

SV-3020r3_rule

The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of the destination host name. If the response to this query is the IP address of a host operated by an attacker, the source host will establish a connection with the attacker's host, rather than the intended target. The user on the source host might then provide logon, authentication, and other sensitive data.Information Assurance Officer

Checks: C-3584r5_chk

Review the device configuration to ensure DNS servers have been defined if it has been configured as a client resolver (name lookup). If the device is configured as a client resolver and DNS servers are not defined, this is a finding.

Fix: F-3045r2_fix

Configure the device to include DNS servers or disable domain lookup.

b

Network devices must only allow SNMP access from addresses belonging to the management network.

Medium - V-3021 - SV-3021r3_rule

RMF Control

Severity

M

CCI

Version

NET0890

Vuln IDs

V-3021

Rule IDs

SV-3021r3_rule

Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.Information Assurance Officer

Checks: C-3586r8_chk

Review the device configuration and verify it is configured to only allow SNMP access from addresses belonging to the management network. If the device is not configured to filter SNMP from the management network only, this is a finding.

Fix: F-3046r4_fix

Configure the network devices to only allow SNMP access from only addresses belonging to the management network.

b

Network devices must authenticate all IGP peers.

Medium - V-3034 - SV-3034r3_rule

RMF Control

Severity

M

CCI

Version

NET0400

Vuln IDs

V-3034

Rule IDs

SV-3034r3_rule

A rogue router could send a fictitious routing update to convince a site's premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information of the site's network, or merely used to disrupt the network's ability to effectively communicate with other networks.Information Assurance OfficerECSC-1

Checks: C-3489r4_chk

Review the device configuration to determine if authentication is configured for all IGP peers. If authentication is not configured for all IGP peers, this is a finding.

Fix: F-3059r3_fix

Configure authentication for all IGP peers.

b

The network device must use different SNMP community names or groups for various levels of read and write access.

Medium - V-3043 - SV-3043r4_rule

RMF Control

Severity

M

CCI

Version

NET1675

Vuln IDs

V-3043

Rule IDs

SV-3043r4_rule

Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.Information Assurance Officer

Checks: C-3825r7_chk

Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access. If unique community strings or accounts are not used for SNMP peers, this is a finding.

Fix: F-3068r4_fix

Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.

c

Group accounts must not be configured for use on the network device.

High - V-3056 - SV-3056r7_rule

RMF Control

Severity

H

CCI

Version

NET0460

Vuln IDs

V-3056

Rule IDs

SV-3056r7_rule

Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.Information Assurance Officer

Checks: C-3503r11_chk

Review the network device configuration and validate there are no group accounts configured for access. If a group account is configured on the device, this is a finding.

Fix: F-3081r9_fix

Configure individual user accounts for each authorized person then remove any group accounts.

b

Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.

Medium - V-3057 - SV-3057r5_rule

RMF Control

Severity

M

CCI

Version

NET0465

Vuln IDs

V-3057

Rule IDs

SV-3057r5_rule

By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.Information Assurance Officer

Checks: C-3504r6_chk

Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the greatest privilege level unless deemed necessary for assigned duties. If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.

Fix: F-3082r5_fix

Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.

b

Unauthorized accounts must not be configured for access to the network device.

Medium - V-3058 - SV-3058r5_rule

RMF Control

Severity

M

CCI

Version

NET0470

Vuln IDs

V-3058

Rule IDs

SV-3058r5_rule

A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.Information Assurance Officer

Checks: C-3505r5_chk

Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device. If an unauthorized account is configured for access to the device, this is a finding.

Fix: F-3083r5_fix

Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.

c

Network devices must be configured to ensure passwords are not viewable when displaying configuration information.

High - V-3062 - SV-3062r4_rule

RMF Control

Severity

H

CCI

Version

NET0600

Vuln IDs

V-3062

Rule IDs

SV-3062r4_rule

Many attacks on information systems and network devices are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration.Information Assurance Officer

Checks: C-3508r5_chk

Review the network devices configuration to determine if passwords are viewable. If passwords are viewable in plaintext, this is a finding.

Fix: F-3087r7_fix

Configure the network devices to ensure passwords are not viewable when displaying configuration information.

b

Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.

Medium - V-3069 - SV-3069r5_rule

RMF Control

Severity

M

CCI

Version

NET1638

Vuln IDs

V-3069

Rule IDs

SV-3069r5_rule

Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.Information Assurance Officer

Checks: C-3532r8_chk

Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. -SSHv2 -SCP -HTTPS using TLS If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.

Fix: F-3094r5_fix

Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.

a

Network devices must log all attempts to establish a management connection for administrative access.

Low - V-3070 - SV-3070r4_rule

RMF Control

Severity

L

CCI

Version

NET1640

Vuln IDs

V-3070

Rule IDs

SV-3070r4_rule

Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.Information Assurance Officer

Checks: C-3542r6_chk

Review the configuration to verify all attempts to access the device via management connection are logged. If management connection attempts are not logged, this is a finding.

Fix: F-3095r3_fix

Configure the device to log all access attempts to the device to establish a management connection for administrative access.

a

The running configuration must be synchronized with the startup configuration after changes have been made and implemented.

Low - V-3072 - SV-3072r3_rule

RMF Control

Severity

L

CCI

Version

NET1030

Vuln IDs

V-3072

Rule IDs

SV-3072r3_rule

If the running and startup router configurations are not synchronized properly and a router malfunctions, it will not restart with all of the recent changes incorporated. If the recent changes were security related, then the routers would be vulnerable to attack.Information Assurance Officer

Checks: C-3636r6_chk

Review the running and boot configurations to determine if they are synchronized. IOS Procedure: With online editing, the "show running-config" command will only show the current running configuration settings, which are different from the IOS defaults. The "show startup-config" command will show the NVRAM startup configuration. Compare the two configurations to ensure they are synchronized. JUNOS Procedure: This will never be a finding. The active configuration is stored on flash as juniper.conf. A candidate configuration allows configuration changes while in configuration mode without initiating operational changes. The router implements the candidate configuration when it is committed; thereby, making it the new active configuration--at which time it will be stored on flash as juniper.conf and the old juniper.conf will become juniper.conf.1. If running configuration and boot configurations are not the same, this is a finding.

Fix: F-3097r4_fix

Add procedures to the standard operating procedure to keep the running configuration synchronized with the startup configuration.

a

Network devices must have the Finger service disabled.

Low - V-3079 - SV-3079r3_rule

RMF Control

Severity

L

CCI

Version

NET0730

Vuln IDs

V-3079

Rule IDs

SV-3079r3_rule

The Finger service supports the UNIX Finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engineering practices to try to elicit classified DoD information.Information Assurance Officer

Checks: C-3571r5_chk

Review the device configuration to determine if Finger has been implemented. If the Finger service is enabled, this is a finding.

Fix: F-3104r4_fix

Configure the device to disable the Finger service.

b

IP source routing must be disabled.

Medium - V-3081 - SV-3081r3_rule

RMF Control

Severity

M

CCI

Version

NET0770

Vuln IDs

V-3081

Rule IDs

SV-3081r3_rule

Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.Information Assurance OfficerECSC-1

Checks: C-58979r1_chk

Review the configuration to determine if source routing is disabled. If IP source routing is enabled, this is a finding.

Fix: F-63435r1_fix

Configure the router to disable IP source routing.

b

Network devices must have HTTP service for administrative access disabled.

Medium - V-3085 - SV-3085r3_rule

RMF Control

Severity

M

CCI

Version

NET0740

Vuln IDs

V-3085

Rule IDs

SV-3085r3_rule

The additional services that the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software versions support remote configuration and monitoring using the World Wide Web's HTTP protocol. In general, HTTP access is equivalent to interactive access to the router. The authentication protocol used for HTTP is equivalent to sending a clear-text password across the network, and, unfortunately, there is no effective provision in HTTP for challenge-based or one-time passwords. This makes HTTP a relatively risky choice for use across the public Internet. Any additional services that are enabled increase the risk for an attack since the router will listen for these services.Information Assurance Officer

Checks: C-3572r5_chk

Review the device configuration to determine that HTTP is not enabled for administrative access. If the device allows the use of HTTP for administrative access, this is a finding.

Fix: F-3110r4_fix

Configure the device to disable using HTTP (port 80) for administrative access.

c

Network devices must not have any default manufacturer passwords.

High - V-3143 - SV-3143r4_rule

RMF Control

Severity

H

CCI

Version

NET0240

Vuln IDs

V-3143

Rule IDs

SV-3143r4_rule

Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.Information Assurance Officer

Checks: C-40236r3_chk

Review the network devices configuration to determine if the vendor default password is active. If any vendor default passwords are used on the device, this is a finding.

Fix: F-35391r3_fix

Remove any vendor default passwords from the network devices configuration.

b

Network devices must be running a current and supported operating system with all IAVMs addressed.

Medium - V-3160 - SV-3160r4_rule

RMF Control

Severity

M

CCI

Version

NET0700

Vuln IDs

V-3160

Rule IDs

SV-3160r4_rule

Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.Information Assurance Officer

Checks: C-3549r4_chk

Have the administrator display the OS version in operation. The OS must be current with related IAVMs addressed. If the device is using an OS that does not meet all IAVMs or currently not supported by the vendor, this is a finding.

Fix: F-3185r4_fix

Update operating system to a supported version that addresses all related IAVMs.

c

The network device must require authentication prior to establishing a management connection for administrative access.

High - V-3175 - SV-3175r5_rule

RMF Control

Severity

H

CCI

Version

NET1636

Vuln IDs

V-3175

Rule IDs

SV-3175r5_rule

Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance Officer

Checks: C-3516r9_chk

Review the network device configuration to verify all management connections for administrative access require authentication. If authentication isn't configured for management access, this is a finding.

Fix: F-3200r3_fix

Configure authentication for all management connections.

c

The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.

High - V-3196 - SV-3196r4_rule

RMF Control

Severity

H

CCI

Version

NET1660

Vuln IDs

V-3196

Rule IDs

SV-3196r4_rule

SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.Information Assurance Officer

Checks: C-3820r6_chk

Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption. Downgrades: If the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II. If the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III. If the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model. If the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.

Fix: F-3221r5_fix

If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).

c

The network device must not use the default or well-known SNMP community strings public and private.

High - V-3210 - SV-3210r4_rule

RMF Control

Severity

H

CCI

Version

NET1665

Vuln IDs

V-3210

Rule IDs

SV-3210r4_rule

Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string "public". In addition, an attacker can change a system configuration using the write community string "private".Information Assurance Officer

Checks: C-3822r7_chk

Review the network devices configuration and verify if either of the SNMP community strings "public" or "private" is being used. If default or well-known community strings are used for SNMP, this is a finding.

Fix: F-3235r4_fix

Configure unique SNMP community strings replacing the default community strings.

b

In the event the authentication server is down or unavailable, there must only be one local account of last resort created for emergency use.

Medium - V-3966 - SV-3966r5_rule

RMF Control

Severity

M

CCI

Version

NET0440

Vuln IDs

V-3966

Rule IDs

SV-3966r5_rule

Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.

Checks: C-3502r6_chk

Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one account of last resort configured locally for an emergency. Verify the username and password for the account of last resort is contained within a sealed envelope kept in a safe. If an authentication server is used and more than one local account exists, this is a finding.

Fix: F-3899r8_fix

Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.

b

The network devices must time out access to the console port at 10 minutes or less of inactivity.

Medium - V-3967 - SV-3967r4_rule

RMF Control

Severity

M

CCI

Version

NET1624

Vuln IDs

V-3967

Rule IDs

SV-3967r4_rule

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance Officer

Checks: C-3511r5_chk

Review the configuration and verify a session using the console port will time out after 10 minutes or less of inactivity. If console access is not configured to timeout at 10 minutes or less, this is a finding.

Fix: F-3900r4_fix

Configure the timeout for idle console connection to 10 minutes or less.

b

Network devices must only allow SNMP read-only access.

Medium - V-3969 - SV-3969r5_rule

RMF Control

Severity

M

CCI

Version

NET0894

Vuln IDs

V-3969

Rule IDs

SV-3969r5_rule

Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance Officer

Checks: C-3942r10_chk

Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3. If write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the ISSO, this is a finding.

Fix: F-3902r7_fix

Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.

b

VLAN 1 must not be used for user VLANs.

Medium - V-3971 - SV-3971r2_rule

RMF Control

Severity

M

CCI

Version

NET-VLAN-004

Vuln IDs

V-3971

Rule IDs

SV-3971r2_rule

In a VLAN-based network, switches use VLAN 1 as the default VLAN for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)--all untagged traffic. As a consequence, VLAN 1 may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.Information Assurance Officer

Checks: C-4028r3_chk

Review the device configuration and verify that access ports have not been assigned membership to the VLAN 1. If any access ports are found in VLAN 1, this is a finding.

Fix: F-3904r2_fix

Best practices for VLAN-based networks is to prune unnecessary ports from gaining access to VLAN 1 as well as the management VLAN, and to separate in-band management, device protocol, and data traffic.

a

VLAN 1 must be pruned from all trunk and access ports that do not require it.

Low - V-3972 - SV-3972r2_rule

RMF Control

Severity

L

CCI

Version

NET-VLAN-005

Vuln IDs

V-3972

Rule IDs

SV-3972r2_rule

VLAN 1 is a special VLAN that tags and handles most of the control plane traffic such as Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP) all VLAN 1 tagged traffic. VLAN 1 is enabled on all trunks and ports by default. With larger campus networks, care needs to be taken about the diameter of the VLAN 1 STP domain; instability in one part of the network could affect VLAN 1, thereby influencing control-plane stability and therefore STP stability for all other VLANs.Information Assurance Officer

Checks: C-4030r3_chk

Review the device configuration to determine if VLAN 1 is pruned from all trunk and access switch ports. If VLAN 1 is not pruned from trunk or access switch ports where it's not required, this is a finding.

Fix: F-3905r2_fix

Best practice for VLAN-based networks is to prune unnecessary ports from gaining access to VLAN 1 and insure that it does not traverse trunks not requiring VLAN 1 traffic.

a

Disabled switch ports must be placed in an unused VLAN (do not use VLAN1).

Low - V-3973 - SV-3973r2_rule

RMF Control

Severity

L

CCI

Version

NET-VLAN-002

Vuln IDs

V-3973

Rule IDs

SV-3973r2_rule

It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.Information Assurance Officer

Checks: C-4035r3_chk

Review the device configuration to determine if all disabled ports have been placed into an unused VLAN. The VLAN must not be VLAN 1. If disabled ports are not assigned to an unused VLAN or have been placed into VLAN 1, this is a finding.

Fix: F-3906r2_fix

Assign all disabled ports to an unused VLAN. Do not use VLAN1.

b

Access switchports must not be assigned to the native VLAN.

Medium - V-3984 - SV-3984r2_rule

RMF Control

Severity

M

CCI

Version

NET-VLAN-009

Vuln IDs

V-3984

Rule IDs

SV-3984r2_rule

Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victim's MAC address and with the victim attached to a different switch belonging to the same trunk group, thereby requiring the trunk link and frame tagging, the malicious user can begin the attack by sending frames with two sets of tags. The outer tag that will have the attacker's VLAN ID (probably the well-known and omnipresent VLAN 1) is stripped off by the switch, and the inner tag that will have the victim's VLAN ID is used by the switch as the next hop and sent out the trunk port.Information Assurance Officer

Checks: C-4034r2_chk

Review the switch configurations and examine all access ports. Verify that they do not belong to the native VLAN. If any access switch ports are assigned to the native VLAN, it is a finding.

Fix: F-3917r2_fix

To insure the integrity of the trunk link and prevent unauthorized access, the native VLAN of the trunk port should be changed from the default VLAN 1 to its own unique VLAN. Access switchports must never be assigned to the native VLAN.

c

The network device must require authentication for console access.

High - V-4582 - SV-4582r5_rule

RMF Control

Severity

H

CCI

Version

NET1623

Vuln IDs

V-4582

Rule IDs

SV-4582r5_rule

Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance Officer

Checks: C-3510r6_chk

Review the network device's configuration and verify authentication is required for console access. If authentication is not configured for console access, this is a finding.

Fix: F-4515r4_fix

Configure authentication for console access on the network device.

a

The network device must log all messages except debugging and send all log data to a syslog server.

Low - V-4584 - SV-4584r3_rule

RMF Control

Severity

L

CCI

Version

NET1021

Vuln IDs

V-4584

Rule IDs

SV-4584r3_rule

Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. Syslog levels 0-6 are the levels required to collect the necessary information to help in the recovery process.Information Assurance Officer

Checks: C-3950r6_chk

Review the network device configuration to ensure all messages up to and including severity level 6 (informational) are logged and sent to a syslog server. Severity Level Message Type 0 Emergencies 1 Alerts 2 Critical 3 Errors 4 Warning 5 Notifications 6 Informational 7 Debugging If logging does not capture of up severity level 6, this is a finding.

Fix: F-4517r6_fix

Configure the network device to log all messages except debugging and send all log data to a syslog server.

b

The network devices must only allow management connections for administrative access from hosts residing in the management network.

Medium - V-5611 - SV-5611r4_rule

RMF Control

Severity

M

CCI

Version

NET1637

Vuln IDs

V-5611

Rule IDs

SV-5611r4_rule

Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.Information Assurance Officer

Checks: C-3527r6_chk

Review the configuration and verify management access to the device is allowed only from hosts within the management network. If management access can be gained from outside of the authorized management network, this is a finding.

Fix: F-5522r4_fix

Configure an ACL or filter to restrict management access to the device from only the management network.

b

The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.

Medium - V-5612 - SV-5612r4_rule

RMF Control

Severity

M

CCI

Version

NET1645

Vuln IDs

V-5612

Rule IDs

SV-5612r4_rule

An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network device.Information Assurance Officer

Checks: C-3534r6_chk

Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period. If the device is not configured to drop broken SSH sessions after 60 seconds, this is a finding.

Fix: F-5523r5_fix

Configure the network devices so it will require a secure shell timeout of 60 seconds or less.

b

The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface.

Medium - V-5613 - SV-5613r4_rule

RMF Control

Severity

M

CCI

Version

NET1646

Vuln IDs

V-5613

Rule IDs

SV-5613r4_rule

An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance Officer

Checks: C-3538r8_chk

Review the configuration and verify the number of unsuccessful SSH logon attempts is set at 3. If the device is not configured to reset unsuccessful SSH logon attempts at 3, this is a finding.

Fix: F-5524r9_fix

Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.

b

The native VLAN must be assigned to a VLAN ID other than the default VLAN for all 802.1q trunk links.

Medium - V-5622 - SV-5622r2_rule

RMF Control

Severity

M

CCI

Version

NET-VLAN-008

Vuln IDs

V-5622

Rule IDs

SV-5622r2_rule

VLAN hopping can be initiated by an attacker who has access to a switch port belonging to the same VLAN as the native VLAN of the trunk link connecting to another switch in which the victim is connected to. If the attacker knows the victim's MAC address, it can forge a frame with two 802.1q tags and a layer 2 header with the destination address of the victim. Since the frame will ingress the switch from a port belonging to its native VLAN, the trunk port connecting to victim's switch will simply remove the outer tag because native VLAN traffic is to be untagged. The switch will forward the frame unto the trunk link unaware of the inner tag with a VLAN ID for which the victim's switchport is a member of.Information Assurance Officer

Checks: C-3770r3_chk

Review the device configuration and examine all trunk links. Verify the native VLAN has been configured to a VLAN other than the default VLAN 1. If the native VLAN has been configured to VLAN 1, this is a finding.

Fix: F-5533r2_fix

To ensure the integrity of the trunk link and prevent unauthorized access, the native VLAN of the trunk port should be changed from the default VLAN 1 to its own unique VLAN. The native VLAN must be the same on both ends of the trunk link; otherwise traffic could accidently leak between broadcast domains.

b

Port trunking must be disabled on all access ports (do not configure trunk on, desirable, non-negotiate, or auto--only off).

Medium - V-5623 - SV-5623r2_rule

RMF Control

Severity

M

CCI

Version

NET-VLAN-007

Vuln IDs

V-5623

Rule IDs

SV-5623r2_rule

Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victims MAC address and with the victim attached to a different switch belonging to the same trunk group, thereby requiring the trunk link and frame tagging, the malicious user can begin the attack by sending frames with two sets of tags. The outer tag that will have the attackers VLAN ID (probably the well-known and omnipresent VLAN 1) is stripped off by the switch, and the inner tag that will have the victims VLAN ID is used by the switch as the next hop and sent out the trunk port.Information Assurance Officer

Checks: C-58983r1_chk

Review the device configuration to determine if trunking has been disabled on access ports. If trunking is enabled on any access port, this is a finding.

Fix: F-5534r1_fix

Disable trunking on all access ports.

b

The IAO/NSO will ensure if 802.1x Port Authentication is implemented, re-authentication must occur every 60 minutes.

Medium - V-5624 - SV-5624r1_rule

RMF Control

Severity

M

CCI

Version

NET-NAC-012

Vuln IDs

V-5624

Rule IDs

SV-5624r1_rule

Eliminating unauthorized access to the network from inside the enclave is vital to keeping a network secure. Internal access to the private network is enabled by simply connecting a workstation or laptop to a wall plate or access point located in the work area.Information Assurance Officer

Checks: C-3773r1_chk

Review the switch configuration for the following interface command: dot1x reauthentication Once re-authentication is enabled, the default is 60 minutes. The interval can be made smaller. For example, if you would want re-authentication to occur every 30 minutes, you would configure the following interface commnand: dot1x timeout reauth-period 1800

Fix: F-5535r1_fix

Ensure 802.1x reauthentication occurs every 60 minutes.

c

The switch must be configured to use 802.1x authentication on host facing access switch ports.

High - V-5626 - SV-5626r3_rule

RMF Control

Severity

H

CCI

Version

NET-NAC-009

Vuln IDs

V-5626

Rule IDs

SV-5626r3_rule

The IEEE 802.1x standard is a client-server based access control and authentication protocol that restricts unauthorized clients from connecting to a local area network through host facing switch ports. The authentication server authenticates each client connected to to a switch port before making any services available to the client from the LAN. Unless the client is successfully authenticated, 802.1x access control allows only Extensible Authentication Protocol over LAN (EAPOL) traffic through the port to which the client is connected. After authentication is successful, normal traffic can pass through the port. Without the use of 802.1x, a malicious user could use the switch port to connect an unauthorized piece of computer or other network device to inject or steal data from the network without detection.At this time, NET-NAC-009 can be downgraded to a CAT III finding if Static MAC filter is used in lieu of 802.1x authentication on host facing switch ports.Information Assurance OfficerECSC-1

Checks: C-23203r7_chk

Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e. RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. If 802.1x authentication is not configured on these host-facing access switch ports, this is a CAT 1 finding. If MAC address filtering is implemented in lieu of 802.1x authentication, this finding will be downgraded to a CAT 3. NOTE: The section below is intended for classified networks. If it’s determined that 802.1x is not implemented on a classified network, the Traditional review team must be notified to determine if the physical requirements are implemented. For a site to be downgraded to a CAT III open finding, the physical security requirements must be implemented in addition to static MAC or sticky secure MAC port security. If both physical and logical downgrades are not implemented, a CAT I open finding will be issued. If classified LAN drops are not authenticated by an 802.1x implementation, they must be located within spaces properly established as Secret vaults, Secret Secure Rooms (AKA: Collateral Classified Open Storage Areas), TS secure room, or SCIF. Otherwise, one of the following supplemental physical security controls must be implemented. 1. Wall jacks must be secured when unattended by persons with Secret or higher clearance with a properly constructed lock box (Hoffman or similar commercial product or locally fabricated). The lock box must have no exposed or removable hinges. The hasp hardware must be riveted to the box or otherwise installed so that removal will require physical breaking of the box; thereby leaving evidence of actual or attempted entry. The lock box must be secured with a 3-position high security combination padlock (IAW the NSTISSI 7003). The S&G 8077 combination padlock is the only existing padlock meeting this standard. 2. If lock boxes are not used, the alternative is to physically disconnect the SIPRNet link at the SIPRNet point of presence (PoP) after normal duty hours. The PoP must be located within a proper Secret or higher secure room.

Fix: F-5537r4_fix

Configure 802.1x authentication on all host facing access switch ports.

b

A dedicated management VLAN or VLANs must be configured to keep management traffic separate from user data and control plane traffic.

Medium - V-5628 - SV-5628r2_rule

RMF Control

Severity

M

CCI

Version

NET-VLAN-006

Vuln IDs

V-5628

Rule IDs

SV-5628r2_rule

All ports, including the internal sc0 interface, are configured by default to be members of VLAN 1. In a VLAN-based network, switches use VLAN 1 as the default VLAN for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP) all untagged traffic. As a consequence, VLAN 1 may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.Information Assurance Officer

Checks: C-3767r3_chk

Review the device configurations to determine if a dedicated VLAN(s) have been implemented for the management network. VLAN 1 must not be used. If a dedicated VLAN or VLANs have not been established for the management network, this is a finding. If VLAN 1 is used for management, this is also a finding.

Fix: F-5539r2_fix

Best practices for VLAN-based networks is create a dedicated management VLAN, prune unnecessary ports from gaining access to VLAN 1 as well as the management VLAN, and to separate in-band management, device protocol, and data traffic.

b

The network device must drop half-open TCP connections through filtering thresholds or timeout periods.

Medium - V-5646 - SV-5646r5_rule

RMF Control

Severity

M

CCI

Version

NET0965

Vuln IDs

V-5646

Rule IDs

SV-5646r5_rule

A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator. An attacker's goal in this scenario is to cause a denial of service to the network or device by initiating a high volume of TCP packets, then never sending an acknowledgement, leaving connections in a half-opened state. Without the device having a connection or time threshold for these half-opened sessions, the device risks being a victim of a denial of service attack. Setting a TCP timeout threshold will instruct the device to shut down any incomplete connections. Services such as SSH, BGP, SNMP, LDP, etc. are some services that may be prone to these types of denial of service attacks. If the router does not have any BGP connections with BGP neighbors across WAN links, values could be set to even tighter constraints.Information Assurance Officer

Checks: C-3604r11_chk

Review the device configuration to determine if threshold filters or timeout periods are set for dropping excessive half-open TCP connections. For timeout periods, the time should be set to 10 seconds or less. If the device cannot be configured for 10 seconds or less, it should be set to the least amount of time allowable in the configuration. Threshold filters will need to be determined by the organization for optimal filtering. If the device is not configured in a way to drop half-open TCP connections using filtering or timeout periods, this is a finding.

Fix: F-5557r6_fix

Configure the device to drop half-open TCP connections through threshold filtering or timeout periods.

a

The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.

Low - V-7011 - SV-7365r4_rule

RMF Control

Severity

L

CCI

Version

NET1629

Vuln IDs

V-7011

Rule IDs

SV-7365r4_rule

The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.Information Assurance Officer

Checks: C-3513r5_chk

Review the configuration and verify the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected. If the auxiliary port is enabled without the use of a secured modem, this is a finding.

Fix: F-6614r3_fix

Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.

a

Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration exceeding 180 days.

Low - V-14667 - SV-15301r3_rule

RMF Control

Severity

L

CCI

Version

NET0422

Vuln IDs

V-14667

Rule IDs

SV-15301r3_rule

If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being guessed. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates, both with 180-day expirations.Information Assurance Officer

Checks: C-12696r5_chk

Review device configuration for key expirations of 180 days or less. If rotating keys are not configured to expire at 180 days or less, this is a finding.

Fix: F-14125r4_fix

Configure the device so rotating keys expire at 180 days or less.

b

FTP servers on the device must be disabled.

Medium - V-14668 - SV-15310r2_rule

RMF Control

Severity

M

CCI

Version

NET0742

Vuln IDs

V-14668

Rule IDs

SV-15310r2_rule

The additional services enabled on a router increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router.Information Assurance Officer

Checks: C-12776r3_chk

Review the device configuration to determine if the device has been setup to be an FTP server. If the device has been configured to be an FTP server, this is a finding.

Fix: F-14129r2_fix

Disable FTP server services on the device.

b

Network devices must have BSDr commands disabled.

Medium - V-14669 - SV-15313r3_rule

RMF Control

Severity

M

CCI

Version

NET0744

Vuln IDs

V-14669

Rule IDs

SV-15313r3_rule

Berkeley Software Distribution (BSD) "r" commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access without passwords to services such as remote command execution (rsh), remote login (rlogin), and remote file copy (rcp and rdist). The difficulty with these commands is they use address-based authentication. An attacker who convinces a server that he is coming from a "trusted" machine can essentially get complete and unrestricted access to a system. The attacker can convince the server by impersonating a trusted machine and using IP address, by confusing DNS so that DNS thinks that the attacker's IP address maps to a trusted machine's name, or by any of a number of other methods.Information Assurance Officer

Checks: C-12779r5_chk

Review the device configuration and verify there are no BSDr commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) enabled. If BSDr commands are enabled, this is a finding.

Fix: F-14130r4_fix

Configure the device to disable BSDr command services.

b

Network devices must authenticate all NTP messages received from NTP servers and peers.

Medium - V-14671 - SV-15327r4_rule

RMF Control

Severity

M

CCI

Version

NET0813

Vuln IDs

V-14671

Rule IDs

SV-15327r4_rule

Since NTP is used to ensure accurate log file timestamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka "symmetric mode"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers. A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to it upstream NTP server, it will be able to choose time from one of its peers. The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It's not used to authenticate NTP clients because NTP servers don't care about the authenticity of their clients, as they never accept any time from them.Information Assurance Officer

Checks: C-12793r7_chk

Review the device configuration and verify it is authenticating the NTP messages received from the NTP server or peer. Authentication must be performed using either PKI (supported in NTP v4) or SHA-1 hashing algorithm. If NTP messages are not authenticated using PKI or SHA-1 hashing, this is a finding.

Fix: F-14132r2_fix

Configure the device to authenticate all received NTP messages using either PKI (supported in NTP v4) or SHA-1 hashing algorithm.

a

The network device must use its loopback or OOB management interface address as the source address when originating authentication services traffic.

Low - V-14672 - SV-15336r3_rule

RMF Control

Severity

L

CCI

Version

NET0897

Vuln IDs

V-14672

Rule IDs

SV-15336r3_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses. TACACS+, RADIUS messages sent to management servers should use the loopback address as the source address.Information Assurance OfficerECSC-1

Checks: C-12802r5_chk

Review the device configuration and determine if authentication services are using the loopback or OOB management interface as the source address. If the loopback or OOB management interface isn't being used as the source address for authentications services, this is a finding.

Fix: F-14134r5_fix

Configure the device to use its loopback or OOB management interface address as the source address when originating authentication services traffic.

a

The network device must use its loopback or OOB management interface address as the source address when originating syslog traffic.

Low - V-14673 - SV-15339r3_rule

RMF Control

Severity

L

CCI

Version

NET0898

Vuln IDs

V-14673

Rule IDs

SV-15339r3_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses. Syslog messages sent to management servers should use the loopback address as the source address.Information Assurance OfficerECSC-1

Checks: C-12805r7_chk

Review the configuration and verify the loopback interface address is used as the source address when originating syslog traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. If the loopback or OOB management interface isn't being used as the source address for syslog traffic, this is a finding.

Fix: F-14135r4_fix

Configure the device to use its loopback or OOB management interface address as the source address when originating syslog traffic.

a

The network device must use its loopback or OOB management interface address as the source address when originating NTP traffic.

Low - V-14674 - SV-15342r3_rule

RMF Control

Severity

L

CCI

Version

NET0899

Vuln IDs

V-14674

Rule IDs

SV-15342r3_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses. NTP messages sent to management servers should use the loopback address as the source address.Information Assurance OfficerECSC-1

Checks: C-12808r5_chk

Review the configuration and verify the loopback interface address is used as the source address when originating NTP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. If the loopback or OOB management interface isn't being used as the source address for NTP traffic, this is a finding.

Fix: F-14136r4_fix

Configure the device to use its loopback or OOB management interface address as the source address when originating NTP traffic.

a

The network device must use its loopback or OOB management interface address as the source address when originating SNMP traffic.

Low - V-14675 - SV-15345r3_rule

RMF Control

Severity

L

CCI

Version

NET0900

Vuln IDs

V-14675

Rule IDs

SV-15345r3_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses. SNMP messages sent to management servers should use the loopback address as the source address.Information Assurance OfficerECSC-1

Checks: C-12811r5_chk

Review the configuration and verify the loopback interface address is used as the source address when originating SNMP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. If the loopback or OOB management interface isn't being used as the source address for SNMP traffic, this is a finding.

Fix: F-14137r4_fix

Configure the device to use its loopback or OOB management interface address as the source address when originating SNMP traffic.

a

The network device must use its loopback or OOB management interface address as the source address when originating IP Flow/NetFlow traffic.

Low - V-14676 - SV-15348r3_rule

RMF Control

Severity

L

CCI

Version

NET0901

Vuln IDs

V-14676

Rule IDs

SV-15348r3_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses. NetFlow messages sent to management servers should use the loopback address as the source address.Information Assurance Officer

Checks: C-12814r5_chk

Review the configuration and verify the loopback interface address is used as the source address when originating NetFlow traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. If the loopback or OOB management interface isn't being used as the source address for IP Flow/NetFlow traffic, this is a finding.

Fix: F-63437r1_fix

Configure the device to use its loopback or OOB management interface address as the source address when originating IP Flow/NetFlow traffic.

a

The network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.

Low - V-14677 - SV-15351r4_rule

RMF Control

Severity

L

CCI

Version

NET0902

Vuln IDs

V-14677

Rule IDs

SV-15351r4_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress filters for management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses. TFTP and FTP messages sent to management servers should use the loopback address as the source address.Information Assurance OfficerECSC-1

Checks: C-12818r7_chk

Review the device configuration to verify the loopback interface address is used as the source address when originating TFTP or FTP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. If the loopback or OOB management interface isn't being used as the source address for TFTP or FTP traffic, this is a finding.

Fix: F-14139r6_fix

Configure the network device to use a loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.

a

The network device must use its loopback interface address as the source address for all iBGP peering sessions.

Low - V-14681 - SV-15357r3_rule

RMF Control

Severity

L

CCI

Version

NET0903

Vuln IDs

V-14681

Rule IDs

SV-15357r3_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane traffic. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses.Information Assurance Officer

Checks: C-12824r3_chk

Review the configuration and verify iBGP peering uses the devices loopback interface address as the source address. If the loopback interface isn't being used as the source address for iBGP peering, this is a finding.

Fix: F-14148r3_fix

Configure the network device's loopback address as the source address for iBGP peering.

b

The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF.

Medium - V-14693 - SV-15397r2_rule

RMF Control

Severity

M

CCI

Version

NET-IPV6-025

Vuln IDs

V-14693

Rule IDs

SV-15397r2_rule

As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect network security through leaks, ambiguity and potential misrouting, as documented in section 2 of RFC3879. RFC3879 formally deprecates the IPv6 site-local unicast prefix defined in RFC3513, i.e., 1111111011 binary or FEC0::/10.Information Assurance OfficerECSC-1

Checks: C-12864r2_chk

Review the device configuration to ensure FEC0::/10 IP addresses are not defined. If FEC0::/10 IP addresses are defined, this is a finding.

Fix: F-14158r1_fix

Configure the device using authorized IP addresses.

b

The network element must be configured from accepting any outbound IP packet that contains an illegitimate address in the source address field via egress ACL or by enabling Unicast Reverse Path Forwarding in an IPv6 enclave.

Medium - V-14707 - SV-15427r1_rule

RMF Control

Severity

M

CCI

Version

NET-IPV6-034

Vuln IDs

V-14707

Rule IDs

SV-15427r1_rule

Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interface appear in the routing table and match the interface on which the packet was received. If the packet was received from one of the best reverse path routes, the packet is forwarded as normal. If there is no reverse path route on the same interface from which the packet was received, it might mean that the source address was modified. If Unicast RPF does not find a reverse path for the packet, the packet is dropped. If internal nodes automatically configure an address based on a prefix from a bogus Router Advertisement a dangerous situation may exist. An internal host may contact an internal server which responds with a packet that could be routed outside of the network via default routing (because the routers do not recognize the destination address as an internal address). To prevent this, filtering should be applied to network interfaces between internal host LANs and internal server LANs to insure that source addresses have valid prefixes. Information Assurance Officer

Checks: C-12894r1_chk

Unicast Strict mode: Review the router configuration to ensure uRPF has been configured on all internal interfaces.

Fix: F-14172r1_fix

The network element must be configured to ensure that an ACL is configured to restrict the router from accepting any outbound IP packet that contains an external IP address in the source field.

b

The network device must not allow SSH Version 1 to be used for administrative access.

Medium - V-14717 - SV-15459r4_rule

RMF Control

Severity

M

CCI

Version

NET1647

Vuln IDs

V-14717

Rule IDs

SV-15459r4_rule

SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1.Information Assurance Officer

Checks: C-12924r8_chk

Review the configuration and verify SSH Version 1 is not being used for administrative access. If the device is using an SSHv1 session, this is a finding.

Fix: F-14184r5_fix

Configure the network device to use SSH version 2.

b

ISATAP tunnels must terminate at an interior router.

Medium - V-15288 - SV-16067r2_rule

RMF Control

Severity

M

CCI

Version

NET-TUNL-017

Vuln IDs

V-15288

Rule IDs

SV-16067r2_rule

ISATAP is an automatic tunnel mechanism that does not provide authentication such as IPSec. As a result of this limitation, ISATAP is thought of as a tool that is used inside the enclave among trusted hosts, which would limit it to internal attacks. ISATAP is a service versus a product, and is readily available to most users. If a user knows the ISATAP router IP address, they can essentially get onto the IPv6 intranet. To control the vulnerability of this tunnel mechanism, it is critical to control the use of protocol 41 and use IPv4 filters to control what IPv4 nodes can send protocol 41 packets to an ISATAP router interface. Although the ISATAP tunneling mechanism is similar to other automatic tunneling mechanisms, such as IPv6 6to4 tunneling, ISATAP is designed for transporting IPv6 packets between sites within an enclave, not between enclaves.Information Assurance OfficerECSC-1

Checks: C-13686r5_chk

Verify ISATAP tunnels are terminated on the infrastructure routers or L3 switches within the enclave.

Fix: F-14730r6_fix

Terminate ISATAP tunnels at the infrastructure router to prohibit tunneled traffic from exiting the enclave perimeter prior to inspection by the IDS, IPS, or firewall.

b

Network devices must use two or more authentication servers for the purpose of granting administrative access.

Medium - V-15432 - SV-16259r4_rule

RMF Control

Severity

M

CCI

Version

NET0433

Vuln IDs

V-15432

Rule IDs

SV-16259r4_rule

The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity. The use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.Information Assurance Officer

Checks: C-14439r6_chk

Verify an authentication server is required to access the device and that there are two or more authentication servers defined. If the device is not configured for two separate authentication servers, this is a finding.

Fix: F-15096r3_fix

Configure the device to use two separate authentication servers.

c

The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.

High - V-15434 - SV-16261r5_rule

RMF Control

Severity

H

CCI

Version

NET0441

Vuln IDs

V-15434

Rule IDs

SV-16261r5_rule

The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.Information Assurance Officer

Checks: C-14441r6_chk

Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online. If the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.

Fix: F-15098r7_fix

Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.

b

IPSec tunnels used to transit management traffic must be restricted to only the authorized management packets based on destination and source IP address.

Medium - V-17754 - SV-18945r2_rule

RMF Control

Severity

M

CCI

Version

NET1807

Vuln IDs

V-17754

Rule IDs

SV-18945r2_rule

The Out-of-Band Management (OOBM) network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device enabling network management traffic to flow between the managed NEs and the NOC. This allows the use of paths separate from those used by the network being managed. Traffic from the managed network to the management network and vice-versa must be secured via IPSec encapsulation.Information Assurance Officer

Checks: C-19015r3_chk

Review the device configuration to determine if IPSec tunnels used in transiting management traffic are filtered to only accept authorized traffic based on source and destination IP addresses of the management network. If filters are not restricting only authorized management traffic into the IPSec tunnel, this is a finding.

Fix: F-17652r2_fix

Configure filters based on source and destination IP address to restrict only authorized management traffic into IPSec tunnels used for transiting management data.

b

Gateway configuration at the remote VPN end-point is a not a mirror of the local gateway

Medium - V-17814 - SV-19063r1_rule

RMF Control

Severity

M

CCI

Version

NET1808

Vuln IDs

V-17814

Rule IDs

SV-19063r1_rule

The IPSec tunnel end points may be configured on the OOBM gateway routers connecting the managed network and the NOC. They may also be configured on a firewall or VPN concentrator located behind the gateway router. In either case, the crypto access-list used to identify the traffic to be protected must be a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.System AdministratorInformation Assurance Officer

Checks: C-19020r1_chk

Verify the configuration at the remote VPN end-point is a mirror configuration as that reviewed for the local end-point.

Fix: F-17724r1_fix

Configure he crypto access-list used to identify the traffic to be protected so that it is a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.

b

IGP instances configured on the OOBM gateway router do not peer only with their appropriate routing domain.

Medium - V-17815 - SV-19068r1_rule

RMF Control

Severity

M

CCI

Version

NET0985

Vuln IDs

V-17815

Rule IDs

SV-19068r1_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network. System AdministratorECSC-1

Checks: C-19232r1_chk

Verify that the OOBM interface is an adjacency only in the IGP routing domain for the management network.

Fix: F-17730r1_fix

Ensure that multiple IGP instances configured on the OOBM gateway router peer only with their appropriate routing domain. Verify that the all interfaces are configured for the appropriate IGP instance.

b

The routes from the two IGP domains are redistributed to each other.

Medium - V-17816 - SV-19069r1_rule

RMF Control

Severity

M

CCI

Version

NET0986

Vuln IDs

V-17816

Rule IDs

SV-19069r1_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network. In addition, the routes from the two domains must not be redistributed to each other. System AdministratorInformation Assurance OfficerECSC-1

Checks: C-19233r1_chk

Verify that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa. As an alternative, static routes can be used to forward management traffic to the OOBM interface; however, this method may not scale well. If static routes are used to forward management traffic to the OOB backbone network, verify that the OOBM interface is not an IGP adjacency and that the correct destination prefix has been configured to forward the management traffic to the correct next-hop and interface for the static route. In the following configuration examples, 10.1.1.0/24 is the management network and 10.1.20.4 is the interface address of the OOB backbone router that the OOB gateway router connects to. The network 10.1.20.0/24 is the OOBM backbone.

Fix: F-17731r1_fix

Ensure that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.

b

Traffic from the managed network is able to access the OOBM gateway router

Medium - V-17817 - SV-19071r1_rule

RMF Control

Severity

M

CCI

Version

NET0987

Vuln IDs

V-17817

Rule IDs

SV-19071r1_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway rouiter.System AdministratorInformation Assurance OfficerECSC-1

Checks: C-19234r1_chk

Review the ACL or filters for the router’s receive path and verify that only traffic sourced from the management network is allowed to access the router. This would include both management and control plane traffic.

Fix: F-17732r1_fix

Ensure that traffic from the managed network is not able to access the OOBM gateway router using either receive path or interface ingress ACLs.

b

Traffic from the managed network will leak into the management network via the gateway router interface connected to the OOBM backbone.

Medium - V-17818 - SV-19072r1_rule

RMF Control

Severity

M

CCI

Version

NET0988

Vuln IDs

V-17818

Rule IDs

SV-19072r1_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries such as using interface ACLs or filters at the boundaries between the two networks. System AdministratorInformation Assurance OfficerECSC-1

Checks: C-19235r1_chk

Examine the egress filter on the OOBM interface of the gateway router to verify that only traffic sourced from the management address space is allowed to transit the OOBM backbone. In the example configurations below, the 10.1.1.0/24 is the management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC.

Fix: F-17733r1_fix

Configure the OOBM gateway router interface ACLs to ensure traffic from the managed network does not leak into the management network.

b

Management network traffic must not leak onto the managed network.

Medium - V-17819 - SV-19073r2_rule

RMF Control

Severity

M

CCI

Version

NET0989

Vuln IDs

V-17819

Rule IDs

SV-19073r2_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. To provide separation, access control lists or filters must be configured to block any traffic from the management network destined for the managed network's production address spaces.System AdministratorInformation Assurance Officer

Checks: C-19236r4_chk

Examine the ingress filter on the OOBM interface of the gateway router to verify that traffic is only destined to the local management address space. If the device is not configured from prohibiting management traffic off the managed network, this is a finding.

Fix: F-17734r2_fix

Configure access control lists or filters to block any traffic from the management network destined for the managed network's production address spaces.

b

The network devices OOBM interface must be configured with an OOBM network address.

Medium - V-17821 - SV-19075r4_rule

RMF Control

Severity

M

CCI

Version

NET0991

Vuln IDs

V-17821

Rule IDs

SV-19075r4_rule

The OOBM access switch will connect to the management interface of the managed network device. The management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.System AdministratorInformation Assurance Officer

Checks: C-19238r5_chk

Review the device configuration to determine if the OOB management interface is assigned an appropriate IP address from the authorized OOB management network. If an IP address assigned to the interface is not from an authorized OOB management network, this is a finding.

Fix: F-17736r2_fix

Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.

b

The network devices management interface must be configured with both an ingress and egress ACL.

Medium - V-17822 - SV-19076r4_rule

RMF Control

Severity

M

CCI

Version

NET0992

Vuln IDs

V-17822

Rule IDs

SV-19076r4_rule

The OOBM access switch will connect to the management interface of the managed network device. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.System AdministratorInformation Assurance Officer

Checks: C-19239r5_chk

Step 1: Verify the managed interface has an inbound and outbound ACL or filter. Step 2: Verify the ingress ACL blocks all transit traffic--that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. Step 3: Verify the egress ACL blocks any traffic not originated by the managed element. If management interface does not have an ingress and egress filter configured and applied, this is a finding.

Fix: F-17737r2_fix

If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.

a

The management interface must be configured as passive for the IGP instance deployed in the managed network.

Low - V-17823 - SV-19077r3_rule

RMF Control

Severity

L

CCI

Version

NET0993

Vuln IDs

V-17823

Rule IDs

SV-19077r3_rule

The OOBM access switch will connect to the management interface of the managed network devices. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network devices will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic, both data plane and control plane, does not leak into the managed network and that production traffic does not leak into the management network.System AdministratorInformation Assurance Officer

Checks: C-19240r7_chk

Review the configuration to verify the management interface is configured as passive for the IGP instance for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration. If the management interface is not configured to be passive for IGP instances, this is a finding.

Fix: F-17738r2_fix

Configure the management interface as passive for the IGP instance configured for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration.

b

The management interface is an access switchport and has not been assigned to a separate management VLAN.

Medium - V-17824 - SV-19078r1_rule

RMF Control

Severity

M

CCI

Version

NET0994

Vuln IDs

V-17824

Rule IDs

SV-19078r1_rule

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.System AdministratorInformation Assurance OfficerECSC-1

Checks: C-19241r1_chk

Review the managed switch configuration and verify that the access port connected to the OOBM access switch has been assigned to the management VLAN.

Fix: F-17739r1_fix

If the management interface is an access switchport, assign it to a separate management VLAN while the remainder of the access switchports can be assigned to user VLANs belonging to the managed network. This provides some level of separation between the management network and the managed network.

a

An address has not been configured for the management VLAN from space belonging to the OOBM network assigned to that site.

Low - V-17825 - SV-19079r1_rule

RMF Control

Severity

L

CCI

Version

NET0995

Vuln IDs

V-17825

Rule IDs

SV-19079r1_rule

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. System AdministratorInformation Assurance OfficerECSC-1

Checks: C-19242r1_chk

Review the managed switch configuration and verify that an address has been configured for management VLAN from space belonging to the OOBM network that has been assigned to that site.

Fix: F-17740r1_fix

Assign an IP address to the management VLAN from the address space belonging to the OOBM network.

b

The access switchport connecting to the OOBM access switch is not the only port with membership to the management VLAN.

Medium - V-17826 - SV-19080r1_rule

RMF Control

Severity

M

CCI

Version

NET0996

Vuln IDs

V-17826

Rule IDs

SV-19080r1_rule

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. System AdministratorECSC-1

Checks: C-19243r1_chk

Review the managed switch configuration and verify that the access port connected to the OOBM access switch is the only port has been assigned to the management VLAN.

Fix: F-17741r1_fix

Ensure that the access switchport connecting to the OOBM access switch is the only port with membership to the management VLAN

a

The management VLAN is not pruned from any VLAN trunk links belonging to the managed network’s infrastructure.

Low - V-17827 - SV-19081r1_rule

RMF Control

Severity

L

CCI

Version

NET0997

Vuln IDs

V-17827

Rule IDs

SV-19081r1_rule

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network. ISL and 802.1q trunking enables multiple VLANs to traverse the same physical links between layer 2 switches or between a layer 2 switch and a router. If the management VLAN is not pruned from any VLAN trunk links belonging to the managed network’s infrastructure, management traffic has the potential to leak into the production network. System AdministratorInformation Assurance OfficerECSC-1

Checks: C-19244r1_chk

By default all the VLANs that exist on a switch are active on a trunk link. Since the switch is being managed via OOBM connection, management traffic should not traverse any trunk links.

Fix: F-17744r1_fix

Prune the management VLAN from any VLAN trunk links belonging to the managed network’s infrastructure.

b

The management VLAN must be configured with an IP address from the management network address block.

Medium - V-17832 - SV-19090r2_rule

RMF Control

Severity

M

CCI

Version

NET1003

Vuln IDs

V-17832

Rule IDs

SV-19090r2_rule

If the management systems reside within the same layer 2 switching domain as the managed network device, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the same time it is defined as a unique VLAN.System AdministratorInformation Assurance Officer

Checks: C-19249r2_chk

Review the switch configuration to determine if the management VLAN has been assigned an IP address from the management network address block. If the management VLAN interface has not been assigned an IP address from the management network address block, this is a finding.

Fix: F-17749r1_fix

Configure the management VLAN with an IP address from the management network address block.

b

Authorized management traffic must be forwarded by the multi-layer switch from the production or managed VLANs to the management VLAN.

Medium - V-17833 - SV-19091r2_rule

RMF Control

Severity

M

CCI

Version

NET1004

Vuln IDs

V-17833

Rule IDs

SV-19091r2_rule

If the management systems reside within the same layer 2 switching domain as the managed network device, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the same time it is defined as a unique VLAN. Inter-VLAN routing or the routing of traffic between nodes residing in different subnets requires a router or multi-layer switch (MLS). Access control lists must be used to enforce the boundaries between the management network and the network being managed.System AdministratorInformation Assurance Officer

Checks: C-19250r3_chk

Review the configuration to determine if an inbound ACL has been configured for the management VLAN interface to block non-management traffic. If an inbound ACL has not been configured, this is a finding.

Fix: F-17750r1_fix

If an MLS is used to provide inter-VLAN routing, configure an inbound ACL for the management network VLAN interface.

b

An inbound ACL is not configured for the management network sub-interface of the trunk link to block non-management traffic.

Medium - V-17834 - SV-19092r1_rule

RMF Control

Severity

M

CCI

Version

NET1005

Vuln IDs

V-17834

Rule IDs

SV-19092r1_rule

If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the same time it is defined as a unique VLAN. Inter-VLAN routing or the routing of traffic between nodes residing in different subnets requires a router or multi-layer switch (MLS). Access control lists must be used to enforce the boundaries between the management network and the network being managed. All physical and virtual (i.e. MLS SVI) routed interfaces must be configured with ACLs to prevent the leaking of unauthorized traffic from one network to the other. System AdministratorInformation Assurance Officer

Checks: C-19251r1_chk

Review the router configuration and verify that an inbound ACL has been configured for the management network sub-interface.

Fix: F-17751r1_fix

If a router is used to provide inter-VLAN routing, configure an inbound ACL for the management network sub-interface for the trunk link to block non-management traffic.

b

Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address.

Medium - V-17835 - SV-19094r1_rule

RMF Control

Severity

M

CCI

Version

NET1006

Vuln IDs

V-17835

Rule IDs

SV-19094r1_rule

Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity between the NOC and the managed networks’ premise routers would be enabled using either provisioned circuits or VPN technologies such as IPSec tunnels or MPLS VPN services. System AdministratorInformation Assurance OfficerECSC-1

Checks: C-19252r1_chk

For both the NOC and the managed network, the IPSec tunnel end points may be configured on the premise or gateway router, a VPN gateway firewall or VPN concentrator. Verify that all traffic from the managed network to the management network and vice-versa is secured via IPSec encapsulation.

Fix: F-17752r1_fix

Where IPSec technology is deployed to connect the managed network to the NOC, it is imperative that the traffic entering the tunnels is restricted to only the authorized management packets based on destination address.

a

Management traffic is not classified and marked at the nearest upstream MLS or router when management traffic must traverse several nodes to reach the management network.

Low - V-17836 - SV-19097r1_rule

RMF Control

Severity

L

CCI

Version

NET1007

Vuln IDs

V-17836

Rule IDs

SV-19097r1_rule

When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed. When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic. System AdministratorInformation Assurance Officer

Checks: C-19308r1_chk

Review the configuration of the MLS or router to determine if the management traffic is classified and marked to a favorable PHB at the distribution layer. According to the DISN approved QoS classifications, control plane and management plane traffic should use DSCP 48 (Network-Control PHB). In the example configurations below, an infrastructure router within the managed network’s distribution layer will classify and mark at ingress all traffic destined to management network with DSCP 48.

Fix: F-17756r1_fix

When management traffic must traverse several nodes to reach the management network, classify and mark management traffic at the nearest upstream MLS or router.

a

The core router within the managed network has not been configured to provide preferred treatment for management traffic that must traverse several nodes to reach the management network.

Low - V-17837 - SV-19098r1_rule

RMF Control

Severity

L

CCI

Version

NET1008

Vuln IDs

V-17837

Rule IDs

SV-19098r1_rule

When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed. When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic. System AdministratorInformation Assurance OfficerECSC-1

Checks: C-19313r1_chk

When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic. This will ensure that management traffic receives guaranteed bandwidth at each forwarding device along the path to the management network. Verify that a service policy is bound to all core or internal router interfaces. The service policy should be configured to place management traffic in the appropriate forwarding class. The classes must be configured to receive the required service.

Fix: F-17757r1_fix

When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic.

b

Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.

Medium - V-18522 - SV-20061r2_rule

RMF Control

Severity

M

CCI

Version

NET-SRVFRM-003

Vuln IDs

V-18522

Rule IDs

SV-20061r2_rule

Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.Information Assurance OfficerECSC-1

Checks: C-21297r5_chk

Review the device configuration to validate an ACL with a deny-by-default security posture has been implemented on the server VLAN interface.

Fix: F-19125r4_fix

Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.

b

The IAO will ensure the Server Farm infrastructure is secured by ACLs on VLAN interfaces that restrict data originating from one server farm segment destined to another server farm segment.

Medium - V-18523 - SV-20062r1_rule

RMF Control

Severity

M

CCI

Version

NET-SRVFRM-004

Vuln IDs

V-18523

Rule IDs

SV-20062r1_rule

ACLs on VLAN interfaces do not protect against compromised servers. The Server farm vlans need to protect the servers located on one subnet from servers located on another subnet. Protecting a client’s data from other clients is necessary and can be accomplished using VLAN provisioning, layer 3 filtering and content filtering at the Server Farm entry point. Restricting protocol, source and destination traffic via filters is an option; however additional security practices such as content filtering are required. The Server farm private vlans need to protect the servers located on one subnet from servers located on another subnet.Information Assurance Officer

Checks: C-21298r1_chk

Review the firewall protecting the server farm. Vlan configurations should have a filter that secures the servers located on the vlan segment. Identify the source ip addresses that have access to the servers and verify the privilege intended with the SA. The filter should be in a deny by default posture. If the filter is not defined on the firewall and the architecture contains a layer 3 switch between the firewall and the server, than review the VLAN definition on the L3 switch.

Fix: F-19126r1_fix

Review the filter and ensure access from other server segments is denied unless necessary for application operation. The intent of the policy should be to protect servers from a server that has been compromised by an intruder.

a

Printers must be assigned to a VLAN that is not shared by unlike devices.

Low - V-18544 - SV-20088r2_rule

RMF Control

Severity

L

CCI

Version

NET-VLAN-023

Vuln IDs

V-18544

Rule IDs

SV-20088r2_rule

Aspects of hardening the network wall plate may include traffic filtering or restrictions on connectivity to enforce a device-, community of interest-, or user-specific security policy. For example, if a printer were plugged into a switch port, it would be prudent to ensure that only printer traffic is allowed on that switch port. If the printer is unplugged and a substitute device other than a printer is plugged into that switch port, the substitute device should not be able to communicate arbitrarily with other devices because only printer traffic is allowed on that switch port.Information Assurance OfficerDCSP-1

Checks: C-21399r3_chk

Review the device configuration to determine if a VLAN has been established for printers.

Fix: F-19148r3_fix

Create a VLAN on the device for print type devices and assign printers to the VLAN ID.

b

The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

Medium - V-18545 - SV-20089r1_rule

RMF Control

Severity

M

CCI

Version

NET-VLAN-024

Vuln IDs

V-18545

Rule IDs

SV-20089r1_rule

A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.Information Assurance Officer

Checks: C-21406r1_chk

An ACL or firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set. Verify the filter applied to the printer VLAN subnet.

Fix: F-19149r1_fix

Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.

a

The IAO will ensure that all switchports configured using MAC port security will shutdown upon receiving a frame with a different layer 2 source address than what has been configured or learned for port security.

Low - V-18565 - SV-20109r1_rule

RMF Control

Severity

L

CCI

Version

NET-NAC-032

Vuln IDs

V-18565

Rule IDs

SV-20109r1_rule

The Port Security feature remembers the Ethernet MAC address connected to the switch port and allows only that MAC address to communicate on that port. If any other MAC address tries to communicate through the port, port security will disable the port. Information Assurance Officer

Checks: C-21652r1_chk

A shutdown action puts the interface into the error-disabled state immediately and sends an SNMP trap notification if it receives a frame with a different layer 2 source address that what has been configured or learned for port security. The following Catalyst IOS interface command will shutdown the interface when such an event occurs: switchport port-security violation shutdown

Fix: F-19192r1_fix

Configure the port to shutdown when insecure hosts are connected to the wall jack.

b

The switch must only allow a maximum of one registered MAC address per access port.

Medium - V-18566 - SV-20110r3_rule

RMF Control

Severity

M

CCI

Version

NET-NAC-031

Vuln IDs

V-18566

Rule IDs

SV-20110r3_rule

Limiting the number of registered MAC addresses on a switch access port can help prevent a CAM table overflow attack. This type of attack lets an attacker exploit the hardware and memory limitations of a switch. If there are enough entries stored in a CAM table before the expiration of other entries, no new entries can be accepted into the CAM table. An attacker will able to flood the switch with mostly invalid MAC addresses until the CAM table’s resources have been depleted. When there are no more resources, the switch has no choice but to flood all ports within the VLAN with all incoming traffic. This happens because the switch cannot find the switch port number for a corresponding MAC address within the CAM table, allowing the switch to become a hub and traffic to be monitored.Information Assurance OfficerDCSP-1

Checks: C-21653r5_chk

Review the switch configuration to verify each access port is configured for a single registered MAC address. Some technologies are exempt from requiring a single MAC address per access port; however, restrictions still apply. VoIP or VTC endpoints may provide a PC port so a PC can be connected. Each of the devices will need to be statically assigned to each access port. Another green initiative where a single LAN drop is shared among several devices is called "hot-desking", which is related to conservation of office space and teleworking. Hot-desking is where several people are assigned to work at the same desk at different times, each user with their own PC. In this case, a different MAC address needs to be permitted for each PC that is connecting to the LAN drop in the workspace. Additionally, this workspace could contain a single phone (and possibly desktop VTC endpoint) used by all assignees and the PC port on it might be the connection for their laptop. In this case, it is best not to use sticky port security, but to use a static mapping of authorized devices or implement 802.1x. If this is not a teleworking remote location, this exemption does not apply.

Fix: F-19193r3_fix

Configure the switch to limit the maximum number of registered MAC addresses on each access switch port to one.

b

Default routes must not be directed to the tunnel entry point.

Medium - V-18790 - SV-20504r2_rule

RMF Control

Severity

M

CCI

Version

NET-TUNL-012

Vuln IDs

V-18790

Rule IDs

SV-20504r2_rule

Routing in the network containing the tunnel entry point must be configured to direct the intended traffic into the tunnel. Depending on the router products used this may be done by creating routes to a tunnel by name, by address, or by interface. If multiple tunnels are defined or IPv6 interfaces, you must be selective with static routes, policy based routing, or even let the interior gateway protocol (IGP) make the decision since a ipv4 or ipv6 address has been configured on the tunnel. The key is the administrator should carefully plan and configure or let the IGP determine what goes into each tunnel.Information Assurance OfficerECSC-1

Checks: C-22501r1_chk

Identify the tunnel endpoints, then review all routing devices to ensure the tunnel entry point is not used as a default route. Traffic destined to the tunnel should be directed to the tunnel endpoint by static routes, policy based routing, or by the mechanics of the interior routing protocol, but not by default route statements.

Fix: F-19446r1_fix

The SA must carefully plan and configure or let IGP determine what goes into each tunnel.

b

The network device must have control plane protection enabled.

Medium - V-19188 - SV-21027r3_rule

RMF Control

Severity

M

CCI

Version

NET0966

Vuln IDs

V-19188

Rule IDs

SV-21027r3_rule

The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Hence, any disruption to the RP or the control and management planes can result in mission critical network outages. In addition to control plane and management plane traffic that is in the router's receive path, the RP must also handle other traffic that must be punted to the RP--that is, the traffic must be fast or process switched. This is the result of packets that must be fragmented, require an ICMP response (TTL expiration, unreachable, etc.) have IP options, etc. A DoS attack targeting the RP can be perpetrated either inadvertently or maliciously involving high rates of punted traffic resulting in excessive RP CPU and memory utilization. To maintain network stability, the router must be able to securely handle specific control plane and management plane traffic that is destined to it, as well as other punted traffic. Using the ingress filter on forwarding interfaces is a method that has been used in the past to filter both forwarding path and receiving path traffic. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grow. Control plane policing can be used to increase security of routers and multilayer switches by protecting the RP from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch.System AdministratorInformation Assurance OfficerECSC-1

Checks: C-23115r5_chk

Determine if control plane protection has been implemented on the device by verifying traffic types have been classified based on importance levels and a policy has been configured to filter and rate limit the traffic according to each class. If the device doesn't have any control plane protection configured on the device, this is a finding.

Fix: F-19812r1_fix

Implement control plane protection by classifying traffic types based on importance levels and configure filters to restrict and rate limit the traffic punted to the route processor as according to each class.

a

The administrator must ensure that multicast routers are configured to establish boundaries for Admin-local or Site-local scope multicast traffic.

Low - V-19189 - SV-21028r1_rule

RMF Control

Severity

L

CCI

Version

NET-MCAST-010

Vuln IDs

V-19189

Rule IDs

SV-21028r1_rule

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"-that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces." Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Hence, administrative scoped multicast traffic must not cross the perimeter of the enclave in either direction. Admin-local scope could be used to contain multicast traffic to a portion of an enclave or within a site. This can make it more difficult for a malicious user to access sensitive traffic if the traffic is restricted to links that the user does not have access to. Admin-local scope is encouraged for any multicast traffic within a network that is intended for network management as well as control plane traffic that must reach beyond link-local destinations.System AdministratorInformation Assurance Officer

Checks: C-23116r1_chk

An administratively scoped IP multicast region is defined to be a topological region in which there are one or more boundary routers with common boundary definitions. Such a router is said to be a boundary for multicast scoped addresses in the range defined in its configuration. In order to support administratively scoped multicast, a multicast boundary router will drop multicast traffic matching an interface's boundary definition in either direction. The IPv4 administrative scoped multicast address space is 239/8 which is divided into two scope levels: the Local Scope and Organization Local Scope. The Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The IPv4 Organization Local Scope is 239.192.0.0/14 is the space from which an organization should allocate sub-ranges when defining scopes for private use. This scope can be expanded to 239.128.0.0/10, 239.64.0.0/10, and 239.0.0.0/10 if necessary. The scope of IPv6 multicast packets are determined by the scope value where 4 (ffx4::/16) is Admin-local, 5 (ffx5::/16) is Site-local, and 8 (ffx8::/16) is Organization-local. Review the multicast topology to determine any documented Admin-local (scope = 4) or Site-local (scope = 5) multicast boundaries for IPv6 traffic or any Local-scope (address block 239.255.0.0/16) boundary for IPv4 traffic. Verify that appropriate boundaries are configured on the applicable multicast-enabled interfaces.

Fix: F-19813r1_fix

Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The scope of IPv6 multicast packets are determined by the scope value where 4 is Admin-local and 5 is Site-local. Configure the necessary boundary to ensure packets addressed to these administratively scoped multicast addresses do not cross the applicable administrative boundaries.

a

Network devices must use at least two NTP servers to synchronize time.

Low - V-23747 - SV-28651r4_rule

RMF Control

Severity

L

CCI

Version

NET0812

Vuln IDs

V-23747

Rule IDs

SV-28651r4_rule

Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source.System AdministratorInformation Assurance Officer

Checks: C-3581r5_chk

Review the configuration and verify two NTP servers have been defined. If the device is not configured to use two separate NTP servers, this is a finding.

Fix: F-3044r2_fix

Configure the device to use two separate NTP servers.

b

A service or feature that calls home to the vendor must be disabled.

Medium - V-28784 - SV-36774r4_rule

RMF Control

Severity

M

CCI

Version

NET0405

Vuln IDs

V-28784

Rule IDs

SV-36774r4_rule

Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.Information Assurance OfficerNetwork Security Officer

Checks: C-35853r3_chk

Review the device configuration to determine if the call home service or feature is disabled on the device. If the call home service is enabled on the device, this is a finding.

Fix: F-31103r1_fix

Configure the network device to disable the call home service or feature.

b

The administrator must ensure that Protocol Independent Multicast (PIM) is disabled on all interfaces that are not required to support multicast routing.

Medium - V-30577 - SV-40311r1_rule

RMF Control

Severity

M

CCI

Version

NET-MCAST-001

Vuln IDs

V-30577

Rule IDs

SV-40311r1_rule

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be “convex from a routing perspective”—that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, “One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces.” Hence, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once, this is done, the zones can be scoped as required.System Administrator

Checks: C-39163r1_chk

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Review the router or multi-layer switch configuration to determine if multicast routing is enabled and what interfaces are enabled for PIM.

Fix: F-34295r1_fix

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Enable PIM only on the applicable interfaces according to the multicast topology diagram.

b

The administrator must ensure that a PIM neighbor filter is bound to all interfaces that have PIM enabled.

Medium - V-30578 - SV-40314r1_rule

RMF Control

Severity

M

CCI

Version

NET-MCAST-002

Vuln IDs

V-30578

Rule IDs

SV-40314r1_rule

Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution tress for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled.Information Assurance Officer

Checks: C-39167r1_chk

Review the router or multi-layer switch to determine if either IPv4 or IPv6 multicast routing is enabled. If either is enabled, verify that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.

Fix: F-34301r1_fix

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.

a

The administrator must ensure that multicast groups used for source specific multicast (SSM) routing are from the specific multicast address space reserved for this purpose.

Low - V-30585 - SV-40325r1_rule

RMF Control

Severity

L

CCI

Version

NET-MCAST-020

Vuln IDs

V-30585

Rule IDs

SV-40325r1_rule

Packet origin is a concern because unauthorized sources could potentially send multicast data to a group, using any source address that is permitted. The unauthorized data could impact the integrity of the nodes receiving the data or could create a DoS condition. A receiver that subscribes to an SSM channel only receives data from the requested source. Since a channel is specific to a source, only that source can transmit on that channel. Hence, the SSM model provides more packet origin protection than ASM. To ensure that the subscriber is joining an authorized or known multicast group and source address pair, it is imperative that the group is from the reserved multicast address space as a first step measure.Information Assurance Officer

Checks: C-39203r1_chk

IANA has reserved the address range 232.0.0.0 through 232.255.255.255 for SSM applications and protocols. However, Cisco IOS allows SSM configuration for an arbitrary subset of the IP multicast address range 224.0.0.0 through 239.255.255.255. If IPv4 or IPv6 multicast routing is enabled, determine if gimp version 3 or MLD version 2 is enabled for IPv4 and IPv6 respectively. If enabled, then PIM-SSM is also enabled. Hence, you must verify that only the IANA reserved SSM range of addresses is used for this implementation. The SSM address range is 232.0.0.0/8 and FF3x::/32 for IPv4 and IPv6 respectively.

Fix: F-34303r1_fix

If IGMP version 3 or MLD version 2 is enabled for IPv4 and IPv6 multicast respectively, then PIM-SSM is also enabled. Hence, you must configure the router so that only the IANA reserved SSM range of addresses can be used for this implementation. The SSM address range is 232.0.0.0/8 and FF3x::/32 for IPv4 and IPv6 respectively.

a

Network devices must have a maximum hop limit of at least 32.

Low - V-30617 - SV-40388r2_rule

RMF Control

Severity

L

CCI

Version

NET-IPV6-059

Vuln IDs

V-30617

Rule IDs

SV-40388r2_rule

The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to hop limit reaching zero before the packets sent by a host reached its destination.Information Assurance Officer

Checks: C-39212r2_chk

Review the router or multi-layer switch configuration to determine if the maximum hop limit has been configured. If it has been configured, then it must be set to at least 32. If the maximum hop limit is not set to at least 32, this is a finding.

Fix: F-34363r2_fix

Configure maximum hop limit to at least 32.

b

The administrator must ensure the 6-to-4 router is configured to drop any IPv4 packets with protocol 41 received from the internal network.

Medium - V-30660 - SV-40452r1_rule

RMF Control

Severity

M

CCI

Version

NET-IPV6-065

Vuln IDs

V-30660

Rule IDs

SV-40452r1_rule

The 6to4 specific filters accomplish the role of endpoint verification and provide assurance that the tunnels are being used properly. This primary guidance assumes that only the designated 6to4 router is allowed to form tunnel packets. If they are being formed inside an enclave and passed to the 6to4 router, they are suspicious and must be dropped. In accordance with DoD IPv6 IA Guidance for MO3 (S5-C7-8), packets as such must be dropped and logged as a security event.Information Assurance Officer

Checks: C-39283r1_chk

If the router is functioning as a 6to4 router, verify that there is an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets.

Fix: F-34388r1_fix

If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets.

a

The administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

Low - V-30736 - SV-40537r1_rule

RMF Control

Severity

L

CCI

Version

NET-IPV6-066

Vuln IDs

V-30736

Rule IDs

SV-40537r1_rule

An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in pairs and thus do not require manual configuration because they treat the IPv4 infrastructure as a virtual non-broadcast link, using an IPv4 address embedded in the IPv6 address to find the remote end of the tunnel. In other words, the tunnel destination is determined by the IPv4 address of the external interface of the 6to4 router that is concatenated to the 2002::/16 prefix in the format 2002: V4ADDR::/48. Hence, the imbedded V4ADDR of the 6to4 prefix must belong to the same ipv4 prefix as configured on the external-facing interface of the 6to4 router. Information Assurance Officer

Checks: C-39310r1_chk

If the router is functioning as a 6to4 router, verify that an egress filter (inbound on the internal-facing interface) has been configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

Fix: F-34421r1_fix

If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

b

L2TPv3 sessions must be authenticated prior to transporting traffic.

Medium - V-30744 - SV-40554r2_rule

RMF Control

Severity

M

CCI

Version

NET-TUNL-034

Vuln IDs

V-30744

Rule IDs

SV-40554r2_rule

L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.Information Assurance OfficerECSC-1

Checks: C-39320r2_chk

Review the router or multi-layer switch configuration and determine if L2TPv3 has been configured to provide transport across an IP network. If it has been configured, verify that the L2TPv3 session requires authentication. If authentication has not been configured for L2TPv3, this is a finding. Note: Layer 2 Forwarding or L2F (RFC2341), which is the "version 1", and L2TPv2 (RFC 2661) are used for remote access services based on the Virtual Private Dial-up Network (VPDN) model--not for tunneling IP packets across a backbone as with L2TPv3. With the VPDN model, a user obtains a layer-2 connection to a RAS using dialup PSTN or ISDN service and then establishes a PPP session over that connection. The L2 termination and PPP session endpoints reside on the RAS. L2TP extends the PPP model by allowing the L2 and PPP endpoints to reside on different devices that are interconnected by a backbone network. A remote access client has an L2 connection to an L2TP Access Concentrator (LAC) that tunnels PPP frames across the IP backbone to the L2TP Network Server (LNS) residing in the private network.

Fix: F-34428r1_fix

Configure L2TPv3 to use authentication for any peering sessions.

b

Network devices must authenticate all BGP peers within the same or between autonomous systems (AS).

Medium - V-31285 - SV-41553r3_rule

RMF Control

Severity

M

CCI

Version

NET0408

Vuln IDs

V-31285

Rule IDs

SV-41553r3_rule

As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately, without waiting for out of sequence packets to arrive. RFC 793 also requires that sequence numbers are checked against the window size before accepting data or control flags as valid. A router receiving an RST segment will close the TCP session with the BGP peer that is being spoofed; thereby, purging all routes learned from that BGP neighbor. A RST segment is valid as long as the sequence number is within the window. The TCP reset attack is made possible due to the requirements that Reset flags should be processed immediately and that a TCP endpoint must accept out of order packets that are within the range of a window size. This reduces the number of sequence number guesses the attack must make by a factor equivalent to the active window size. Each sequence number guess made by the attacker can be simply incremented by the receiving connections window size. The BGP peering session can protect itself against such an attack by authenticating each TCP segment. The TCP header options include an MD5 signature in every packet and are checked prior to the acceptance and processing of any TCP packet--including RST flags. One way to create havoc in a network is to advertise bogus routes to a network. A rogue router could send a fictitious routing update to convince a BGP router to send traffic to an incorrect or rogue destination. This diverted traffic could be analyzed to learn confidential information of the site's network, or merely used to disrupt the network's ability to effectively communicate with other networks. An autonomous system can advertise incorrect information by sending BGP updates messages to routers in a neighboring AS. A malicious AS can advertise a prefix originated from another AS and claim that it is the originator (prefix hijacking). Neighboring autonomous systems receiving this announcement will believe that the malicious AS is the prefix owner and route packets to it.ECSC-1

Checks: C-12685r2_chk

Review the device configuration to determine if authentication is being used for all peers. A password or key should be defined for each BGP neighbor regardless of the autonomous system the peer belongs. Most vendors' command lines use a neighbor statement or keyword to specify a BGP peer. If BGP peers are not authenticated, this is a finding.

Fix: F-14123r2_fix

Configure the device to authenticate all BGP peers.

Content changes 73

Checks: C-3947r6_chk

Fix: F-3025r4_fix

Generate Mitigation Statement:

Checks: C-3837r1_chk

Fix: F-3033r1_fix

Generate Mitigation Statement:

Checks: C-3456r6_chk

Fix: F-3037r6_fix

Generate Mitigation Statement:

Checks: C-3474r10_chk

Fix: F-3038r8_fix

Generate Mitigation Statement:

Checks: C-3540r6_chk

Fix: F-3039r5_fix

Generate Mitigation Statement:

Checks: C-3584r5_chk

Fix: F-3045r2_fix

Generate Mitigation Statement:

Checks: C-3586r8_chk

Fix: F-3046r4_fix

Generate Mitigation Statement:

Checks: C-3489r4_chk

Fix: F-3059r3_fix

Generate Mitigation Statement:

Checks: C-3825r7_chk

Fix: F-3068r4_fix

Generate Mitigation Statement:

Checks: C-3503r11_chk

Fix: F-3081r9_fix

Generate Mitigation Statement:

Checks: C-3504r6_chk

Fix: F-3082r5_fix

Generate Mitigation Statement:

Checks: C-3505r5_chk

Fix: F-3083r5_fix

Generate Mitigation Statement:

Checks: C-3508r5_chk

Fix: F-3087r7_fix

Generate Mitigation Statement:

Checks: C-3532r8_chk

Fix: F-3094r5_fix

Generate Mitigation Statement:

Checks: C-3542r6_chk

Fix: F-3095r3_fix

Generate Mitigation Statement:

Checks: C-3636r6_chk

Fix: F-3097r4_fix

Generate Mitigation Statement:

Checks: C-3571r5_chk

Fix: F-3104r4_fix

Generate Mitigation Statement:

Checks: C-58979r1_chk

Fix: F-63435r1_fix

Generate Mitigation Statement:

Checks: C-3572r5_chk

Fix: F-3110r4_fix

Generate Mitigation Statement:

Checks: C-40236r3_chk

Fix: F-35391r3_fix

Generate Mitigation Statement:

Checks: C-3549r4_chk

Fix: F-3185r4_fix

Generate Mitigation Statement:

Checks: C-3516r9_chk

Fix: F-3200r3_fix

Generate Mitigation Statement:

Checks: C-3820r6_chk

Fix: F-3221r5_fix

Generate Mitigation Statement:

Checks: C-3822r7_chk

Fix: F-3235r4_fix

Generate Mitigation Statement:

Checks: C-3502r6_chk

Fix: F-3899r8_fix

Generate Mitigation Statement:

Checks: C-3511r5_chk

Fix: F-3900r4_fix

Generate Mitigation Statement:

Checks: C-3942r10_chk