NET1006 - IPSec traffic is not restricted - 'access-list IN_BAND_MGMT_VPN_ACL permit'

Information

Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address.

Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity between the NOC and the managed networks' premise routers would be enabled using either provisioned circuits or VPN technologies such as IPSec tunnels or MPLS VPN services.

NOTE: Change 'IN_BAND_MGMT_VPN_ACL' to the access control list filtering VPN access for in-band management of the device.
NOTE: Change 'LOCAL_MANAGEMENT_NETWORK' to the management network for your organization.

Solution

Where IPSec technology is deployed to connect the managed network to the NOC, it is imperative that the traffic entering the tunnels is restricted to only the authorized management packets based on destination address.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_Infrastructure_Router_L3_Switch_V8R29_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(15), CAT|II, Rule-ID|SV-19310r1_rule, STIG-ID|NET1006, Vuln-ID|V-17835

Plugin: Cisco

Control ID: 1a49ad9854a7e9c0ce1f6d0504c1e86629358aa45303831960506b5150bd151c