V-283887

Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway router.

Check Content

This requirement is not applicable for the DODIN Backbone.

Review the CPM filter for the router receive path using the example below: 

- show system security cpm-filter ip-filter entry 10

CPM IP Filter Entry

Entry Id           : 10
Description        : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id             : n/a
Src. IP            : 192.168.50.0/24
Src. Port          : n/a
Dst. IP            : n/a
Dest. Port         : n/a
Protocol           : none               Dscp               : Undefined
ICMP Type          : Undefined          ICMP Code          : Undefined
Fragment           : Off                Option-present     : Off
IP-Option          : n/a                Multiple Option    : Off
TCP-syn            : Off                TCP-ack            : Off
Action             : Forward
Match Router ID    : n/a
Dropped pkts       : 0                  Forwarded pkts     : 0

If the CPM filter is not configured to only allow traffic to the route processor from the OOBM local area network (LAN), this is a finding.