STIGQter: STIG Summary: HPE Aruba Networking AOS NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

AOS must enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies.

DISA Rule

SV-266910r1039751_rule

Vulnerability Number

V-266910

Group Title

SRG-APP-000097-NDM-000227

Rule Version

ARBA-ND-000213

Severity

CAT II

CCI(s)

• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure AOS with the following commands:
configure terminal
ip access-list session <name>
network <A.B.C.D> <netmask A.B.C.D> any any permit
any any any deny log
ipv6 network <X:X:X:X::X/<0-128> any any permit
ipv6 any any any deny log
exit
write memory
interface gigabit <#/#/#>
ip access-group session <ACL name>
exit
write mem

Check Contents

Verify the AOS configuration with the following command:
show running-config | begin "interface gigabit"

Note the configured IP access-group session Access Control List (ACL) for each active interface.

For each configured ACL:
show ip access-list <ACL name>

If each ACL does not end in an "any any deny log" for both IPv4 and IPv6, this is a finding.

Vulnerability Number

V-266910

Documentable

False

Rule Version

ARBA-ND-000213

Severity Override Guidance

Verify the AOS configuration with the following command:
show running-config | begin "interface gigabit"

Note the configured IP access-group session Access Control List (ACL) for each active interface.

For each configured ACL:
show ip access-list <ACL name>

If each ACL does not end in an "any any deny log" for both IPv4 and IPv6, this is a finding.

Check Content Reference

M

Target Key

5648