Check: WLAN-NW-001200
Network WLAN AP-IG Platform STIG:
WLAN-NW-001200
(in versions v7 r3 through v7 r1)
Title
The network device must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface. (Cat II impact)
Discussion
The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. (See SRG-NET-000205-RTR-000012.) Network boundaries, also known as managed interfaces, include, for example, gateways, routers, firewalls, guards, network-based malicious code analysis, and virtualization systems, or encrypted tunnels implemented within a security architecture (e.g., routers protecting firewalls or application gateways residing on protected subnetworks). Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones (DMZs). Methods used for prohibiting interfaces within organizational information systems include, for example, restricting external web traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses.
Check Content
Review the device configuration to determine if the OOB management interface is assigned an appropriate IP address from the authorized OOB management network. If an IP address assigned to the interface is not from an authorized OOB management network, this is a finding.
Fix Text
Configure the network device so that only management traffic that ingresses and egresses the OOBM interface is permitted.
Additional Identifiers
Rule ID: SV-243214r720097_rule
Vulnerability ID: V-243214
Group Title: SRG-NET-000205
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001097 |
Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system. |
Controls
Number | Title |
---|---|
SC-7 |
Boundary Protection |