Infrastructure L3 Switch Security Technical Implementation Guide

Infrastructure L3 Switch Security Technical Implementation Guide

Details

Version / Release: V8R20

Published: 2016-06-30

Updated At: 2018-09-23 05:06:19

Compare/View Releases

Select any two versions of this STIG to compare the individual requirements

Select any old version/release of this STIG to view the previous requirements

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-3000r4_rule NET1020 LOW The network device must log all interface access control lists (ACL) deny statements. Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network d
    SV-3008r1_rule NET1800 MEDIUM The IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network. Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the premise of the managed networks and at the NOC. Dedicated links can be deployed using provisioned circuits (ATM, Frame Relay, SONET, T-carrier, and others or VPN te
    SV-3012r4_rule NET0230 HIGH Network devices must be password protected. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to
    SV-3013r4_rule NET0340 MEDIUM Network devices must display the DoD-approved logon banner warning. All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized
    SV-3014r4_rule NET1639 MEDIUM The network devices must timeout management connections for administrative access after 10 minutes or less of inactivity. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network device and a PC or terminal server when the later has been left
    SV-3020r3_rule NET0820 LOW Network devices must have DNS servers defined if it is configured as a client resolver. The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of t
    SV-3021r3_rule NET0890 MEDIUM Network devices must only allow SNMP access from addresses belonging to the management network. Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.Information Assuranc
    SV-3034r3_rule NET0400 MEDIUM Network devices must authenticate all IGP peers. A rogue router could send a fictitious routing update to convince a site's premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information of the site's network, or mere
    SV-3043r4_rule NET1675 MEDIUM The network device must use different SNMP community names or groups for various levels of read and write access. Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking
    SV-3056r7_rule NET0460 HIGH Group accounts must not be configured for use on the network device. Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the
    SV-3057r5_rule NET0465 MEDIUM Authorized accounts must be assigned the least privilege level necessary to perform assigned duties. By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mis
    SV-3058r5_rule NET0470 MEDIUM Unauthorized accounts must not be configured for access to the network device. A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service
    SV-3062r4_rule NET0600 HIGH Network devices must be configured to ensure passwords are not viewable when displaying configuration information. Many attacks on information systems and network devices are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration.Information Assura
    SV-3069r5_rule NET1638 MEDIUM Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules. Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted
    SV-3070r4_rule NET1640 LOW Network devices must log all attempts to establish a management connection for administrative access. Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. Wit
    SV-3072r3_rule NET1030 LOW The running configuration must be synchronized with the startup configuration after changes have been made and implemented. If the running and startup router configurations are not synchronized properly and a router malfunctions, it will not restart with all of the recent changes incorporated. If the recent changes were security related, then the routers would be vulnerable t
    SV-3079r3_rule NET0730 LOW Network devices must have the Finger service disabled. The Finger service supports the UNIX Finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engi
    SV-3081r3_rule NET0770 MEDIUM IP source routing must be disabled. Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.Information Assurance OfficerECSC-1
    SV-3085r3_rule NET0740 MEDIUM Network devices must have HTTP service for administrative access disabled. The additional services that the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent sof
    SV-3143r4_rule NET0240 HIGH Network devices must not have any default manufacturer passwords. Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not
    SV-3160r4_rule NET0700 MEDIUM Network devices must be running a current and supported operating system with all IAVMs addressed. Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches
    SV-3175r5_rule NET1636 HIGH The network device must require authentication prior to establishing a management connection for administrative access. Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network ou
    SV-3196r4_rule NET1660 HIGH The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device. SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an
    SV-3210r4_rule NET1665 HIGH The network device must not use the default or well-known SNMP community strings public and private. Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device usi
    SV-3966r5_rule NET0440 MEDIUM In the event the authentication server is down or unavailable, there must only be one local account of last resort created for emergency use. Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between t
    SV-3967r4_rule NET1624 MEDIUM The network devices must time out access to the console port at 10 minutes or less of inactivity. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminati
    SV-3969r5_rule NET0894 MEDIUM Network devices must only allow SNMP read-only access. Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance Officer
    SV-3971r2_rule NET-VLAN-004 MEDIUM VLAN 1 must not be used for user VLANs. In a VLAN-based network, switches use VLAN 1 as the default VLAN for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Pro
    SV-3972r2_rule NET-VLAN-005 LOW VLAN 1 must be pruned from all trunk and access ports that do not require it. VLAN 1 is a special VLAN that tags and handles most of the control plane traffic such as Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP) all
    SV-3973r2_rule NET-VLAN-002 LOW Disabled switch ports must be placed in an unused VLAN (do not use VLAN1). It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.Information Assurance Officer
    SV-3984r2_rule NET-VLAN-009 MEDIUM Access switchports must not be assigned to the native VLAN. Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victim's MAC address and with the victim attached to a different switch belonging to the same trunk group, the
    SV-4582r5_rule NET1623 HIGH The network device must require authentication for console access. Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Inform
    SV-4584r3_rule NET1021 LOW The network device must log all messages except debugging and send all log data to a syslog server. Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network.
    SV-5611r4_rule NET1637 MEDIUM The network devices must only allow management connections for administrative access from hosts residing in the management network. Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and c
    SV-5612r4_rule NET1645 MEDIUM The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions. An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for
    SV-5613r4_rule NET1646 MEDIUM The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface. An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance Officer
    SV-5622r2_rule NET-VLAN-008 MEDIUM The native VLAN must be assigned to a VLAN ID other than the default VLAN for all 802.1q trunk links. VLAN hopping can be initiated by an attacker who has access to a switch port belonging to the same VLAN as the native VLAN of the trunk link connecting to another switch in which the victim is connected to. If the attacker knows the victim's MAC address,
    SV-5623r2_rule NET-VLAN-007 MEDIUM Port trunking must be disabled on all access ports (do not configure trunk on, desirable, non-negotiate, or auto--only off). Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victims MAC address and with the victim attached to a different switch belonging to the same trunk group, ther
    SV-5624r1_rule NET-NAC-012 MEDIUM The IAO/NSO will ensure if 802.1x Port Authentication is implemented, re-authentication must occur every 60 minutes. Eliminating unauthorized access to the network from inside the enclave is vital to keeping a network secure. Internal access to the private network is enabled by simply connecting a workstation or laptop to a wall plate or access point located in the work
    SV-5626r3_rule NET-NAC-009 HIGH The switch must be configured to use 802.1x authentication on host facing access switch ports. The IEEE 802.1x standard is a client-server based access control and authentication protocol that restricts unauthorized clients from connecting to a local area network through host facing switch ports. The authentication server authenticates each client
    SV-5628r2_rule NET-VLAN-006 MEDIUM A dedicated management VLAN or VLANs must be configured to keep management traffic separate from user data and control plane traffic. All ports, including the internal sc0 interface, are configured by default to be members of VLAN 1. In a VLAN-based network, switches use VLAN 1 as the default VLAN for in-band management and to communicate with other networking devices using Spanning-Tre
    SV-5646r5_rule NET0965 MEDIUM The network device must drop half-open TCP connections through filtering thresholds or timeout periods. A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator. An att
    SV-7365r4_rule NET1629 LOW The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication. The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the de
    SV-15301r3_rule NET0422 LOW Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration exceeding 180 days. If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being gues
    SV-15310r2_rule NET0742 MEDIUM FTP servers on the device must be disabled. The additional services enabled on a router increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router.Information Assurance Office
    SV-15313r3_rule NET0744 MEDIUM Network devices must have BSDr commands disabled. Berkeley Software Distribution (BSD) "r" commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access wi
    SV-15327r4_rule NET0813 MEDIUM Network devices must authenticate all NTP messages received from NTP servers and peers. Since NTP is used to ensure accurate log file timestamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted
    SV-15336r3_rule NET0897 LOW The network device must use its loopback or OOB management interface address as the source address when originating authentication services traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15339r3_rule NET0898 LOW The network device must use its loopback or OOB management interface address as the source address when originating syslog traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15342r3_rule NET0899 LOW The network device must use its loopback or OOB management interface address as the source address when originating NTP traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15345r3_rule NET0900 LOW The network device must use its loopback or OOB management interface address as the source address when originating SNMP traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15348r3_rule NET0901 LOW The network device must use its loopback or OOB management interface address as the source address when originating IP Flow/NetFlow traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15351r4_rule NET0902 LOW The network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress filters for management plane traffic destined to the network mana
    SV-15357r3_rule NET0903 LOW The network device must use its loopback interface address as the source address for all iBGP peering sessions. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane traffic. Log information recorded by authentication and syslog ser
    SV-15397r2_rule NET-IPV6-025 MEDIUM The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF. As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect netw
    SV-15427r1_rule NET-IPV6-034 MEDIUM The network element must be configured from accepting any outbound IP packet that contains an illegitimate address in the source address field via egress ACL or by enabling Unicast Reverse Path Forwarding in an IPv6 enclave. Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interfa
    SV-15459r4_rule NET1647 MEDIUM The network device must not allow SSH Version 1 to be used for administrative access. SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly
    SV-16067r2_rule NET-TUNL-017 MEDIUM ISATAP tunnels must terminate at an interior router. ISATAP is an automatic tunnel mechanism that does not provide authentication such as IPSec. As a result of this limitation, ISATAP is thought of as a tool that is used inside the enclave among trusted hosts, which would limit it to internal attacks. ISA
    SV-16259r4_rule NET0433 MEDIUM Network devices must use two or more authentication servers for the purpose of granting administrative access. The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ o
    SV-16261r5_rule NET0441 HIGH The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online. The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate autho
    SV-18945r2_rule NET1807 MEDIUM IPSec tunnels used to transit management traffic must be restricted to only the authorized management packets based on destination and source IP address. The Out-of-Band Management (OOBM) network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device enabling n
    SV-19063r1_rule NET1808 MEDIUM Gateway configuration at the remote VPN end-point is a not a mirror of the local gateway The IPSec tunnel end points may be configured on the OOBM gateway routers connecting the managed network and the NOC. They may also be configured on a firewall or VPN concentrator located behind the gateway router. In either case, the crypto access-list u
    SV-19068r1_rule NET0985 MEDIUM IGP instances configured on the OOBM gateway router do not peer only with their appropriate routing domain. If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains
    SV-19069r1_rule NET0986 MEDIUM The routes from the two IGP domains are redistributed to each other. If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains
    SV-19071r1_rule NET0987 MEDIUM Traffic from the managed network is able to access the OOBM gateway router If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the O
    SV-19072r1_rule NET0988 MEDIUM Traffic from the managed network will leak into the management network via the gateway router interface connected to the OOBM backbone. If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries such as using interface ACLs or filters at the boundaries between the two networks
    SV-19073r2_rule NET0989 MEDIUM Management network traffic must not leak onto the managed network. If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. To provide separation, access control lists or filters must be configured to bloc
    SV-19075r4_rule NET0991 MEDIUM The network devices OOBM interface must be configured with an OOBM network address. The OOBM access switch will connect to the management interface of the managed network device. The management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; there
    SV-19076r4_rule NET0992 MEDIUM The network devices management interface must be configured with both an ingress and egress ACL. The OOBM access switch will connect to the management interface of the managed network device. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface
    SV-19077r3_rule NET0993 LOW The management interface must be configured as passive for the IGP instance deployed in the managed network. The OOBM access switch will connect to the management interface of the managed network devices. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface
    SV-19078r1_rule NET0994 MEDIUM The management interface is an access switchport and has not been assigned to a separate management VLAN. The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interfac
    SV-19079r1_rule NET0995 LOW An address has not been configured for the management VLAN from space belonging to the OOBM network assigned to that site. The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interfac
    SV-19080r1_rule NET0996 MEDIUM The access switchport connecting to the OOBM access switch is not the only port with membership to the management VLAN. The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interfac
    SV-19081r1_rule NET0997 LOW The management VLAN is not pruned from any VLAN trunk links belonging to the managed network’s infrastructure. The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interfac
    SV-19090r2_rule NET1003 MEDIUM The management VLAN must be configured with an IP address from the management network address block. If the management systems reside within the same layer 2 switching domain as the managed network device, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the s
    SV-19091r2_rule NET1004 MEDIUM Authorized management traffic must be forwarded by the multi-layer switch from the production or managed VLANs to the management VLAN. If the management systems reside within the same layer 2 switching domain as the managed network device, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the s
    SV-19092r1_rule NET1005 MEDIUM An inbound ACL is not configured for the management network sub-interface of the trunk link to block non-management traffic. If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the
    SV-19094r1_rule NET1006 MEDIUM Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address. Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity
    SV-19097r1_rule NET1007 LOW Management traffic is not classified and marked at the nearest upstream MLS or router when management traffic must traverse several nodes to reach the management network. When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored.
    SV-19098r1_rule NET1008 LOW The core router within the managed network has not been configured to provide preferred treatment for management traffic that must traverse several nodes to reach the management network. When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored.
    SV-20061r2_rule NET-SRVFRM-003 MEDIUM Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture. Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of
    SV-20062r1_rule NET-SRVFRM-004 MEDIUM The IAO will ensure the Server Farm infrastructure is secured by ACLs on VLAN interfaces that restrict data originating from one server farm segment destined to another server farm segment. ACLs on VLAN interfaces do not protect against compromised servers. The Server farm vlans need to protect the servers located on one subnet from servers located on another subnet. Protecting a client’s data from other clients is necessary and can be acc
    SV-20088r2_rule NET-VLAN-023 LOW Printers must be assigned to a VLAN that is not shared by unlike devices. Aspects of hardening the network wall plate may include traffic filtering or restrictions on connectivity to enforce a device-, community of interest-, or user-specific security policy. For example, if a printer were plugged into a switch port, it would b
    SV-20089r1_rule NET-VLAN-024 MEDIUM The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic. A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp por
    SV-20109r1_rule NET-NAC-032 LOW The IAO will ensure that all switchports configured using MAC port security will shutdown upon receiving a frame with a different layer 2 source address than what has been configured or learned for port security. The Port Security feature remembers the Ethernet MAC address connected to the switch port and allows only that MAC address to communicate on that port. If any other MAC address tries to communicate through the port, port security will disable the port. In
    SV-20110r3_rule NET-NAC-031 MEDIUM The switch must only allow a maximum of one registered MAC address per access port. Limiting the number of registered MAC addresses on a switch access port can help prevent a CAM table overflow attack. This type of attack lets an attacker exploit the hardware and memory limitations of a switch. If there are enough entries stored in a C
    SV-20504r2_rule NET-TUNL-012 MEDIUM Default routes must not be directed to the tunnel entry point. Routing in the network containing the tunnel entry point must be configured to direct the intended traffic into the tunnel. Depending on the router products used this may be done by creating routes to a tunnel by name, by address, or by interface. If
    SV-21027r3_rule NET0966 MEDIUM The network device must have control plane protection enabled. The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the router
    SV-21028r1_rule NET-MCAST-010 LOW The administrator must ensure that multicast routers are configured to establish boundaries for Admin-local or Site-local scope multicast traffic. A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope,
    SV-28651r4_rule NET0812 LOW Network devices must use at least two NTP servers to synchronize time. Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the ex
    SV-36774r4_rule NET0405 MEDIUM A service or feature that calls home to the vendor must be disabled. Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could
    SV-40311r1_rule NET-MCAST-001 MEDIUM The administrator must ensure that Protocol Independent Multicast (PIM) is disabled on all interfaces that are not required to support multicast routing. A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope,
    SV-40314r1_rule NET-MCAST-002 MEDIUM The administrator must ensure that a PIM neighbor filter is bound to all interfaces that have PIM enabled. Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution tress for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a
    SV-40325r1_rule NET-MCAST-020 LOW The administrator must ensure that multicast groups used for source specific multicast (SSM) routing are from the specific multicast address space reserved for this purpose. Packet origin is a concern because unauthorized sources could potentially send multicast data to a group, using any source address that is permitted. The unauthorized data could impact the integrity of the nodes receiving the data or could create a DoS co
    SV-40388r2_rule NET-IPV6-059 LOW Network devices must have a maximum hop limit of at least 32. The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN s
    SV-40452r1_rule NET-IPV6-065 MEDIUM The administrator must ensure the 6-to-4 router is configured to drop any IPv4 packets with protocol 41 received from the internal network. The 6to4 specific filters accomplish the role of endpoint verification and provide assurance that the tunnels are being used properly. This primary guidance assumes that only the designated 6to4 router is allowed to form tunnel packets. If they are being
    SV-40537r1_rule NET-IPV6-066 LOW The administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave. An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in
    SV-40554r2_rule NET-TUNL-034 MEDIUM L2TPv3 sessions must be authenticated prior to transporting traffic. L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP
    SV-41553r3_rule NET0408 MEDIUM Network devices must authenticate all BGP peers within the same or between autonomous systems (AS). As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately, without waiting for out of sequence packets to arrive. RFC 793 al