UCF STIG Viewer Logo

Default routes must not be directed to the tunnel entry point.


Overview

Finding ID Version Rule ID IA Controls Severity
V-18790 NET-TUNL-012 SV-20504r2_rule ECSC-1 Medium
Description
Routing in the network containing the tunnel entry point must be configured to direct the intended traffic into the tunnel. Depending on the router products used this may be done by creating routes to a tunnel by name, by address, or by interface. If multiple tunnels are defined or IPv6 interfaces, you must be selective with static routes, policy based routing, or even let the interior gateway protocol (IGP) make the decision since a ipv4 or ipv6 address has been configured on the tunnel. The key is the administrator should carefully plan and configure or let the IGP determine what goes into each tunnel.
STIG Date
Infrastructure L3 Switch - Cisco Security Technical Implementation Guide 2017-09-28

Details

Check Text ( C-22501r1_chk )
Identify the tunnel endpoints, then review all routing devices to ensure the tunnel entry point is not used as a default route.

Traffic destined to the tunnel should be directed to the tunnel endpoint by static routes, policy based routing, or by the mechanics of the interior routing protocol, but not by default route statements.
Fix Text (F-19446r1_fix)
The SA must carefully plan and configure or let IGP determine what goes into each tunnel.