← Back to Aviat Networks WTM NDM Security Technical Implementation Guide

V-286487

CAT II (Medium)

WTM must be configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.

Rule ID

SV-286487r1273742_rule

STIG

Aviat Networks WTM NDM Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-004192

Discussion

Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through either an external or internal network. Communications paths can be logically separated using encryption.

Check Content

1. Log in to the WTM Web UI.
2. Navigate to Switching and Routing >> VLAN Management >> Membership.
3. Verify that both GigabitEthernet1/1 and 1/2 are on mode access. 
4. Verify GigabitEthernet1/1 and 1/2 are using different VLAN IDs.

If GigabitEthernet1/1 and 1/2 are using the same VLAN IDs, this is a finding.

Fix Text

1. Log in to the WTM Web UI.
2. Navigate to Switching and Routing >> VLAN Management >> Membership.
3. If GigabitEthernet1/1 is the out of band management interface, then select mode access. 
4. On GigabitEthernet1/1 under settings, select the VLAN for the management network.
5. On GigabitEthernet1/2, if it is a trunk link (meaning it is carrying 802.1q tagged VLAN traffic), select trunk for the mode. 
6. Enter all the VLANs in the allowed VLANs field. Ensure that the management VLAN is not in this list.
7. On GigabitEthernet1/2, if it is an access link (meaning it is carrying traffic that is not tagging the 802.1q field), select access for the mode. 
8. Select the VLAN ID being used for data plane traffic. The management VLAN must not be selected.
9. Click "Commit".