V-283886

Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries; otherwise, it is possible that management traffic will not be separated from production traffic. Because the managed network and the management network are separate routing domains, separate Interior Gateway Protocol (IGP) routing instances must be configured on the router, one for the managed network and one for the OOBM network. In addition, the routes from the two domains must not be redistributed to each other. Satisfies: SRG-NET-000019-RTR-000012, SRG-NET-000019-RTR-000011

Check Content

This requirement is not applicable for the DODIN Backbone.

Verify the IGP instance used for the managed network does not redistribute routes into the Interior Gateway Protocol instance used for the management network and vice versa.

Verify Virtual Private Routed Network (VPRN) services for MGMT and PROD using the command below:

- show service id 30 base

Service Basic Information

Service Id        : 30                  Vpn Id            : 0
Service Type      : VPRN
MACSec enabled    : no
Name              : 30
Description       : (Not Specified)
Customer Id       : 1                   Creation Origin   : manual
Last Status Change: 12/18/2025 02:36:25
Last Mgmt Change  : 12/18/2025 02:36:25
Admin State       : Up                  Oper State        : Up

Router Oper State : Up
Route Dist.       : 3.3.3.3:30          VPRN Type         : regular
Oper Route Dist   : 3.3.3.3:30
Oper RD Type      : configured
AS Number         : 65100               Router Id         : 3.3.3.3
ECMP              : Enabled             ECMP Max Routes   : 1
Max IPv4 Routes   : No Limit
Local Rt Domain-Id: None                D-Path Lng Ignore : Disabled

Auto Bind Tunnel
Allow Flex-Alg-Fb : Disabled
Resolution        : any
Weighted ECMP     : Disabled            ECMP Max Routes   : 1
Strict Tnl Tag    : Disabled

Max IPv6 Routes   : No Limit
Ignore NH Metric  : Disabled
Hash Label        : Disabled
Entropy Label     : Disabled
Vrf Target        : target:65100:300
Vrf Import        : None
Vrf Export        : None
MVPN Vrf Target   : None
MVPN Vrf Import   : None
MVPN Vrf Export   : None
Car. Sup C-VPN    : Disabled
Label mode        : vrf
BGP VPN Backup    : Disabled
BGP Export Inactv : Disabled
LOG all events    : Disabled

SAP Count         : 1                   SDP Bind Count    : 0

-------------------------------------------------------------------------------
Service Access & Destination Points
-------------------------------------------------------------------------------
Identifier                               Type         AdmMTU  OprMTU  Adm  Opr
-------------------------------------------------------------------------------
sap:1/1/c5/1                             null         1514    1514    Up   Up

- show service id 40 base

Service Basic Information

Service Id        : 40                  Vpn Id            : 0
Service Type      : VPRN
MACSec enabled    : no
Name              : 40
Description       : (Not Specified)
Customer Id       : 1                   Creation Origin   : manual
Last Status Change: 12/18/2025 16:09:25
Last Mgmt Change  : 12/18/2025 16:09:25
Admin State       : Up                  Oper State        : Up

Router Oper State : Up
Route Dist.       : 3.3.3.3:40          VPRN Type         : regular
Oper Route Dist   : 3.3.3.3:40
Oper RD Type      : configured
AS Number         : 65100               Router Id         : 3.3.3.3
ECMP              : Enabled             ECMP Max Routes   : 1
Max IPv4 Routes   : No Limit
Local Rt Domain-Id: None                D-Path Lng Ignore : Disabled

Auto Bind Tunnel
Allow Flex-Alg-Fb : Disabled
Resolution        : any
Weighted ECMP     : Disabled            ECMP Max Routes   : 1
Strict Tnl Tag    : Disabled

Max IPv6 Routes   : No Limit
Ignore NH Metric  : Disabled
Hash Label        : Disabled
Entropy Label     : Disabled
Vrf Target        : target:65100:40
Vrf Import        : None
Vrf Export        : None
MVPN Vrf Target   : None
MVPN Vrf Import   : None
MVPN Vrf Export   : None
Car. Sup C-VPN    : Disabled
Label mode        : vrf
BGP VPN Backup    : Disabled
BGP Export Inactv : Disabled
LOG all events    : Disabled

SAP Count         : 1                   SDP Bind Count    : 0

-------------------------------------------------------------------------------
Service Access & Destination Points
-------------------------------------------------------------------------------
Identifier                               Type         AdmMTU  OprMTU  Adm  Opr
-------------------------------------------------------------------------------
sap:1/1/c6/1                             null         1514    1514    Up   Up

If the IGP instance used for the managed network redistributes routes into the IGP instance used for the management network, or vice versa, this is a finding.