UCF STIG Viewer Logo

The network device must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.


Overview

Finding ID Version Rule ID IA Controls Severity
V-243225 WLAN-NW-001200 SV-243225r720130_rule Medium
Description
The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. (See SRG-NET-000205-RTR-000012.) Network boundaries, also known as managed interfaces, include, for example, gateways, routers, firewalls, guards, network-based malicious code analysis, and virtualization systems, or encrypted tunnels implemented within a security architecture (e.g., routers protecting firewalls or application gateways residing on protected subnetworks). Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones (DMZs). Methods used for prohibiting interfaces within organizational information systems include, for example, restricting external web traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses.
STIG Date
Network WLAN AP-NIPR Platform Security Technical Implementation Guide 2021-04-16

Details

Check Text ( C-46500r720128_chk )
Review the device configuration to determine if the OOB management interface is assigned an appropriate IP address from the authorized OOB management network.

If an IP address assigned to the interface is not from an authorized OOB management network, this is a finding.
Fix Text (F-46457r720129_fix)
Configure the network device so that only management traffic that ingresses and egresses the OOBM interface is permitted.