NET1000 - Management traffic is not blocked by egress ACL - 'access-list MGMT_EGRESS_ACL deny LOCAL_MANAGEMENT_NETWORK'

Information

The gateway router for the managed network is not configured with an ACL or filter on the egress interface to block all outbound management traffic.

The management network must still have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the managed network's premise equipment such as using egress ACLs.

NOTE: Change 'MGMT_EGRESS_ACL' to the egress access control list for blocking your organization's outbound traffic.
NOTE: Change 'LOCAL_MANAGEMENT_NETWORK' to the management network for your organization.

Solution

Configure the gateway router of the managed network with an ACL or filter on the egress interface to block all outbound management traffic.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R32_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CAT|II, Rule-ID|SV-19083r2_rule, STIG-ID|NET1000, Vuln-ID|V-17829

Plugin: Cisco

Control ID: 1e48160ea788da58b4a5c5a07dcd177a93f3a0d592e916a42e909ae9a0d78ae7