V-283859

Discussion

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions.

Check Content

Verify the router is configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Verify the Virtual Private Routed Network (VPRN) service information, as shown in the example below:

- show service id 30 base

Service Basic Information

Service Id        : 30                  Vpn Id            : 0
Service Type      : VPRN
MACSec enabled    : no
Name              : 30
Description       : (Not Specified)
Customer Id       : 1                   Creation Origin   : manual
Last Status Change: 12/11/2025 17:17:26
Last Mgmt Change  : 12/11/2025 17:17:26
Admin State       : Up                  Oper State        : Up

Router Oper State : Up
Route Dist.       : 3.3.3.3:30          VPRN Type         : regular
Oper Route Dist   : 3.3.3.3:30
Oper RD Type      : configured
AS Number         : 65100               Router Id         : 3.3.3.3
ECMP              : Enabled             ECMP Max Routes   : 1
Max IPv4 Routes   : No Limit
Local Rt Domain-Id: None                D-Path Lng Ignore : Disabled

Auto Bind Tunnel
Allow Flex-Alg-Fb : Disabled
Resolution        : any
Weighted ECMP     : Disabled            ECMP Max Routes   : 1
Strict Tnl Tag    : Disabled

Max IPv6 Routes   : No Limit
Ignore NH Metric  : Disabled
Hash Label        : Disabled
Entropy Label     : Disabled
Vrf Target        : target:65100:30
Vrf Import        : None
Vrf Export        : None
MVPN Vrf Target   : None
MVPN Vrf Import   : None
MVPN Vrf Export   : None
Car. Sup C-VPN    : Disabled
Label mode        : vrf
BGP VPN Backup    : Disabled
BGP Export Inactv : Disabled
LOG all events    : Disabled

SAP Count         : 1                   SDP Bind Count    : 0

-------------------------------------------------------------------------------
Service Access & Destination Points
-------------------------------------------------------------------------------
Identifier                               Type         AdmMTU  OprMTU  Adm  Opr
-------------------------------------------------------------------------------
sap:1/1/c5/1                             null         1514    1514    Up   Up

If the router is not configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions, this is a finding.