NET-VLAN-024 - Restricted VLAN not assigned to non-802.1x device.

Information

The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.

NOTE: This check is derived from the L3 switch guidance, if the scan target is a router the check can be ignored.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R32_STIG.zip

Item Details

References: CAT|II, Rule-ID|SV-20089r2_rule, STIG-ID|NET-VLAN-024, Vuln-ID|V-18545

Plugin: Cisco

Control ID: 98d6d9f325aab6b29f172385de8008c25a7263b17851df499fa50160a490610d