7.10 Ensure management plane traffic has been separated from data plane traffic

Information

Separate management plane traffic from data plane traffic.
Rationale:
Separating the management plane traffic from data plane traffic ensures that these traffics are on their respective paths. These paths could then be individually monitored and could be tied to different traffic control policies and monitoring. It also ensures that management plane is always reachable despite the huge volume of data flow.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Initialize Swarm with dedicated interfaces for management and data planes respectively.
For example,
docker swarm init --advertise-addr=192.168.0.1 --data-path-addr=17.1.0.3
Impact:
You would require 2 network interface cards per node.
Default Value:
By default, the data plane traffic is not separated from management plane traffic.

See Also

https://workbench.cisecurity.org/files/1726

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(13), CSCv6|18

Plugin: Unix

Control ID: 1c02c4a8965ff88c28f54fcfb2f8bd8b34d6c8154b4a441de07f6990b2fc30a4