Information
Information flow control regulates authorized information to travel within a network and between interconnected networks. Controlling the flow of network traffic is critical so it does not introduce any unacceptable risk to the network infrastructure or data. An example of a flow control restriction is blocking outside traffic claiming to be from within the organization. For most routers, internal information flow control is a product of system design.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
This requirement is not applicable for the DODIN Backbone.
[edit firewall family inet]
set filter FILTER_INBOUND_TRAFFIC term TCP_ESTABLISHED from tcp-established
set filter FILTER_INBOUND_TRAFFIC term TCP_ESTABLISHED then accept
set filter FILTER_INBOUND_TRAFFIC term ALLOW_BGP from source-address x.1.12.1/32
set filter FILTER_INBOUND_TRAFFIC term ALLOW_BGP from protocol tcp
set filter FILTER_INBOUND_TRAFFIC term ALLOW_BGP from destination-port bgp
set filter FILTER_INBOUND_TRAFFIC term ALLOW_BGP then accept
set filter FILTER_INBOUND_TRAFFIC term ALLOW_PING from protocol icmp
set filter FILTER_INBOUND_TRAFFIC term ALLOW_PING from icmp-type echo-reply
set filter FILTER_INBOUND_TRAFFIC term ALLOW_PING from icmp-type echo-request
set filter FILTER_INBOUND_TRAFFIC term ALLOW_PING then accept
set filter FILTER_INBOUND_TRAFFIC term ALLOW_WWW from destination-address x.12.1.22/32
set filter FILTER_INBOUND_TRAFFIC term ALLOW_WWW from protocol tcp
set filter FILTER_INBOUND_TRAFFIC term ALLOW_WWW from destination-port http
set filter FILTER_INBOUND_TRAFFIC term ALLOW_WWW then accept
set filter FILTER_INBOUND_TRAFFIC term DENY_ALL_OTHER then syslog
set filter FILTER_INBOUND_TRAFFIC term DENY_ALL_OTHER then reject
Step 2: Apply the filter inbound on all applicable interfaces.
[edit interfaces ge-0/0/0 unit 0 family inet]
set filter input FILTER_INBOUND_TRAFFIC