The network device must be configured with both an ingress and egress ACL.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-243205	WLAN-ND-001800	SV-243205r720070_rule		Medium

Description
Changes to the hardware or software components of the network device can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should be allowed administrative access to the network device for implementing any changes or upgrades. This requirement applies to updates of the application files, configuration, ACLs, and policy filters.

STIG	Date
Network WLAN Controller Management Security Technical Implementation Guide	2021-04-16

Details

Check Text ( C-46480r720068_chk )
1. Verify the managed interface has an inbound and outbound ACL or filter. 2. Verify the ingress ACL blocks all transit traffic (any traffic not destined to the router itself). In addition, traffic accessing the managed elements should be originated at the NOC. 3. Verify the egress ACL blocks any traffic not originated by the managed element. If the management interface does not have an ingress and egress filter configured and applied, this is a finding.

Check Text ( C-46480r720068_chk )

1. Verify the managed interface has an inbound and outbound ACL or filter.

2. Verify the ingress ACL blocks all transit traffic (any traffic not destined to the router itself). In addition, traffic accessing the managed elements should be originated at the NOC.

3. Verify the egress ACL blocks any traffic not originated by the managed element.

If the management interface does not have an ingress and egress filter configured and applied, this is a finding.

Fix Text (F-46437r720069_fix)
If the management interface is a routed interface, configure it with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.