STIGQter STIGQter: STIG Summary: Cisco IOS XR Router RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Cisco out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the Network Operations Center (NOC).

DISA Rule

SV-216772r531087_rule

Vulnerability Number

V-216772

Group Title

SRG-NET-000205-RTR-000011

Rule Version

CISC-RT-000440

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

Step 1: Configure the ACL to only allow traffic to the route processor from the OOBM backbone and the NOC.

RP/0/0/CPU0:R2(config)#ipv4 access-list TRAFFIC_FROM_NOC
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.11.1.0 0.255.255.255 host 10.11.$
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.12.1.0 0.255.255.255 host 10.11.$
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.11.1.0 0.255.255.255 host 10.13.$
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.12.1.0 0.255.255.255 host 10.13.$
RP/0/0/CPU0:R2(config-ipv4-acl)#deny ip any host 10.11.1.8 log-input
RP/0/0/CPU0:R2(config-ipv4-acl)#deny ip any host 10.13.1.1 log-input
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0$
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0$
RP/0/0/CPU0:R2(config-ipv4-acl)#deny ip any any log-input
RP/0/0/CPU0:R2(config-ipv4-acl)#exit

Step 2: Configure the ACL to only allow traffic to the route processor from the OOBM LAN.

RP/0/0/CPU0:R2(config)#ipv4 access-list TRAFFIC_TO_NOC
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.13.1.0 0.255.255.255 host 10.13.$
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.13.1.0 0.255.255.255 host 10.11.$
RP/0/0/CPU0:R2(config-ipv4-acl)#deny ip any host 10.13.1.1 log-input
RP/0/0/CPU0:R2(config-ipv4-acl)#deny ip any host 10.11.1.8 log-input
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.13.1.0 0.255.255.255 10.11.1.0 0$
RP/0/0/CPU0:R2(config-ipv4-acl)#permit ip 10.13.1.0 0.255.255.255 10.12.1.0 0$
RP/0/0/CPU0:R2(config-ipv4-acl)#deny ip any any log-input
RP/0/0/CPU0:R2(config-ipv4-acl)#exit

Step 3: Apply the ACLs configured above to the appropriate OOBM interfaces as shown in the example below.

RP/0/0/CPU0:R2(config)#int g0/0/0/2
RP/0/0/CPU0:R2(config-if)#ipv4 access-group TRAFFIC_FROM_NOC in
RP/0/0/CPU0:R2(config)#int g0/0/0/3
RP/0/0/CPU0:R2(config-if)#access-group TRAFFIC_TO_NOC in
RP/0/0/CPU0:R2(config-if)#end

Check Contents

This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

Verify that traffic destined to itself is only sourced by the OOBM or the NOC. In the example below, the OOBM backbone network is 10.11.1.0/24, the NOC address spaces is 10.12.1.0/24, and the OOBM LAN address space at remote site connecting to the managed network is 10.13.1.0/24.

Step 1: Note the inbound ACL applied to the OOBM interfaces.

interface GigabitEthernet0/0/0/2
description OOB link to NOC
ip address 10.11.1.8 255.255.255.0
ipv4 access-group TRAFFIC_FROM_NOC ingress
!
interface Giga GigabitEthernet0/0/0/3
description link to OOBM LAN access switch
ip address 10.13.1.1 255.255.255.0
ipv4 access-group TRAFFIC_TO_NOC ingress

Step 2: Review the inbound ACL bound to any OOB interface connecting to the OOBM backbone and verify traffic destined to itself is only from the OOBM or NOC address space.

ipv4 access-list TRAFFIC_FROM_NOC
10 permit ipv4 10.11.1.0 0.255.255.255 host 10.11.1.8
20 permit ipv4 10.12.1.0 0.255.255.255 host 10.11.1.8
30 permit ipv4 10.11.1.0 0.255.255.255 host 10.13.1.1
40 permit ipv4 10.12.1.0 0.255.255.255 host 10.13.1.1
50 deny ipv4 any host 10.11.1.8 log-input
60 deny ipv4 any host 10.13.1.1 log-input
70 permit ipv4 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0.255
80 permit ipv4 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0.255
90 deny ipv4 any any log-input

Step 3: Review the inbound ACL bound to any OOBM LAN interfaces and verify traffic destined to itself is from the OOBM LAN address space.

ipv4 access-list TRAFFIC_TO_NOC
10 permit ipv4 10.13.1.0 0.255.255.255 host 10.13.1.1
20 permit ipv4 10.13.1.0 0.255.255.255 host 10.11.1.8
30 deny ipv4 any host 10.13.1.1 log-input
40 deny ipv4 any host 10.11.1.8 log-input
50 permit ipv4 10.13.1.0 0.255.255.255 10.11.1.0 0.0.0.255
60 permit ipv4 10.13.1.0 0.255.255.255 10.12.1.0 0.0.0.255
70 deny ipv4 any any log-input

If the router does not block any traffic destined to itself that is not sourced from the OOBM network or the NOC, this is a finding.

Vulnerability Number

V-216772

Documentable

False

Rule Version

CISC-RT-000440

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

Verify that traffic destined to itself is only sourced by the OOBM or the NOC. In the example below, the OOBM backbone network is 10.11.1.0/24, the NOC address spaces is 10.12.1.0/24, and the OOBM LAN address space at remote site connecting to the managed network is 10.13.1.0/24.

Step 1: Note the inbound ACL applied to the OOBM interfaces.

interface GigabitEthernet0/0/0/2
description OOB link to NOC
ip address 10.11.1.8 255.255.255.0
ipv4 access-group TRAFFIC_FROM_NOC ingress
!
interface Giga GigabitEthernet0/0/0/3
description link to OOBM LAN access switch
ip address 10.13.1.1 255.255.255.0
ipv4 access-group TRAFFIC_TO_NOC ingress

Step 2: Review the inbound ACL bound to any OOB interface connecting to the OOBM backbone and verify traffic destined to itself is only from the OOBM or NOC address space.

ipv4 access-list TRAFFIC_FROM_NOC
10 permit ipv4 10.11.1.0 0.255.255.255 host 10.11.1.8
20 permit ipv4 10.12.1.0 0.255.255.255 host 10.11.1.8
30 permit ipv4 10.11.1.0 0.255.255.255 host 10.13.1.1
40 permit ipv4 10.12.1.0 0.255.255.255 host 10.13.1.1
50 deny ipv4 any host 10.11.1.8 log-input
60 deny ipv4 any host 10.13.1.1 log-input
70 permit ipv4 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0.255
80 permit ipv4 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0.255
90 deny ipv4 any any log-input

Step 3: Review the inbound ACL bound to any OOBM LAN interfaces and verify traffic destined to itself is from the OOBM LAN address space.

ipv4 access-list TRAFFIC_TO_NOC
10 permit ipv4 10.13.1.0 0.255.255.255 host 10.13.1.1
20 permit ipv4 10.13.1.0 0.255.255.255 host 10.11.1.8
30 deny ipv4 any host 10.13.1.1 log-input
40 deny ipv4 any host 10.11.1.8 log-input
50 permit ipv4 10.13.1.0 0.255.255.255 10.11.1.0 0.0.0.255
60 permit ipv4 10.13.1.0 0.255.255.255 10.12.1.0 0.0.0.255
70 deny ipv4 any any log-input

If the router does not block any traffic destined to itself that is not sourced from the OOBM network or the NOC, this is a finding.

Check Content Reference

M

Target Key

4029

Comments