Information
If the gateway router is not a dedicated device for the OOBM network, implementation of several safeguards for containment of management and production traffic boundaries must occur. Since the managed and management network are separate routing domains, configuration of separate Interior Gateway Protocol routing instances is critical on the router to segregate traffic from each network.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
This requirement is not applicable for the DODIN backbone.
Configure the Arista router to enforce that Interior Gateway Protocol instances configured on the OOBM gateway router peer only with their own routing domain.
Configuring OSPF:
Step 1: Configure the interface and OOBM vrf instance.
vrf instance OOBM
ip routing vrf OOBM
LEAF-1A(config)#interface Vlan 2
LEAF-1A(config-if-Vl2)#description Connection to OOBM-LAN-Ethernet4
LEAF-1A(config-if-Vl2)#vrf OOBM
LEAF-1A(config-if-Vl2)#mtu 9214
LEAF-1A(config-if-Vl2)#no routerport
LEAF-1A(config-if-Vl2)#ip address 10.1.12.7/31
Step 2: Advertise the subnet in OSPF process 100.
LEAF-1A(config-router-rip)#router ospf 100 vrf OOBM
LEAF-1A(config-router-ospf)#network 10.1.12.0/24 area 0.0.0.0
Step 3: Configure the interface and LAN vrf instance.
vrf instance LAN
ip routing vrf LAN
LEAF-1A(config)#interface Ethernet8
LEAF-1A(config-if-Et8)#description Connection to Private-LAN-Ethernet4
LEAF-1A(config-if-Et8)#vrf LAN
LEAF-1A(config-if-Et8)#mtu 9214
LEAF-1A(config-if-Et8)#no routerport
LEAF-1A(config-if-Et8)#ip address 172.16.35.135/31
Step 4: Advertise the subnet in OSPF process 200.
LEAF-1A(config-router-ospf)#router ospf 200 vrf LAN
LEAF-1A(config-router-rip)#network 172.16.35.0/24 area 0.0.0.0