This requirement is not applicable for the DODIN Backbone. Review the network topology diagram to determine connectivity between the managed network and the NOC. Review the OOBM gateway router configuration to validate the path that the management traffic traverses. Verify that only management traffic is forwarded through the OOBM interface or IPsec tunnel. Verify the destination address is configured either via a prefix-list or directly assigned addresses in each firewall filter term match condition. [edit policy-options] prefix-list NOC-ipv4 { <IPv4 address>/<mask>; } prefix-list NOC-ipv6 { <IPv6 address>/<prefix>; } [edit firewall] family inet { filter permit-NOC-ipv4 { term 1 { from { destination-prefix-list { NOC-ipv4; } protocol <protocol>; destination-port [ <port 1> <port 2> ]; } then accept; } <additional permitted traffic terms> term default { then { log; syslog; discard; } } } } family inet6 { filter permit-NOC-ipv6 { term 1 { from { destination-prefix-list { NOC-ipv6; } next-header <protocol>; destination-port [ <port 1> <port 2> ]; } then accept; } <additional permitted traffic terms> term default { then { log; syslog; discard; } } } } [edit interfaces] <OOBM interface> { unit <number> { family inet { filter { output NOC-ipv4; } address <IPv4 address>/<mask>; } family inet6 { filter { output NOC-ipv6; } address <IPv6 address>/<prefix>; } } } Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example: input-list [ permit_mgt permit_routing_protocols default-deny ]; If using an IPsec tunnel, verify the route with the tunnel interface as the next-hop destination. [edit routing-options] rib inet6.0 { static { route <NOC IPv6 network> next-hop <(tunnel interface | NOC IPv6 tunnel endpoint address)>; } } static { route <NOC IPv4 network> next-hop <(tunnel interface | NOC IPv6 tunnel endpoint address)>; } If traffic other than authorized management traffic is permitted through the OOBM interface or IPsec tunnel, this is a finding.