← Back to Nokia Service Router OS 25.x Router Security Technical Implementation Guide

V-283892

CAT II (Medium)

The Nokia perimeter router must be configured to block all outbound management traffic.

Rule ID

SV-283892r1203925_rule

STIG

Nokia Service Router OS 25.x Router Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-002403

Discussion

For in-band management, the management network must have its own subnet to enforce control and access boundaries provided by layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes that are used for production or operational traffic. Safeguards must be implemented to ensure the management traffic does not leak past the perimeter of the managed network.

Check Content

This requirement is not applicable for the DODIN Backbone.

The perimeter router of the managed network must be configured with an access control list (ACL) or filter on the egress interface to block all management traffic.

Verify IPv4 and IPv6 filters are applied on the interface using the commands below: 

- show router interface "TO-PE2" detail | match "Egress Filter"

Egress Filter    : 10                   Ingress Filter    : 10

- show router interface "TO-PE2" detail | match "Egr IPv6 Flt"

Egr IPv6 Flt     : 20                   Ingr IPv6 Flt     : none

If management traffic is not blocked at the perimeter, this is a finding.

Fix Text

This requirement is not applicable for the DODIN Backbone.

Configure the perimeter router of the managed network with IPv4 and IPv6 filters on the egress interface to block all outbound management traffic using the example below: 

 Create an IPv4 filter:

- configure filter ip-filter 10
- config>filter>ip-filter# entry 10
- config>filter>ip-filter# entry 10 create
- config>filter>ip-filter>entry$ match dst-ip 172.10.1.0/24
- config>filter>ip-filter>entry$ action drop
- config>filter>ip-filter>entry$ exit
- config>filter>ip-filter# default-action forward
- config>filter>ip-filter# exit all

Create an IPv6 filter: 

- configure filter ipv6-filter 20 create
- config>filter>ipv6-filter$ entry 10 create
- config>filter>ipv6-filter>entry$ match dst-ip  2001:acad:1234:200::1/64
- config>filter>ipv6-filter>entry$ action drop
- config>filter>ipv6-filter>entry$ exit
- config>filter>ipv6-filter$ default-action forward
- config>filter>ipv6-filter$ exit all

 Apply the IPv4 filter and IPv6 filter on the interface:

- configure router interface "TO-PE2" egress filter ip 10
- configure router interface "TO-PE2" egress filter ipv6 20