The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18545	NET-VLAN-024	SV-20089r2_rule		Medium

Description
A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.

Description

A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.

STIG	Date
Infrastructure L3 Switch Secure Technical Implementation Guide - Cisco	2018-11-27

Details

Check Text ( C-21406r2_chk )
To verify compliance with this requirement, an ACL must be configured on the L3 switch VLAN interface assigned for the printer VLAN, or on the firewall interface connecting to the printer VLAN. Exception to this requirement is traffic from RSD sensors connected to the VLAN. Note: The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are ports 515, 631, 1782, 9100, 9101, and 9102. The SA can review RFC 1700 Port Assignments and review printer vendor documents to determine what ports should be allowed.

Check Text ( C-21406r2_chk )

To verify compliance with this requirement, an ACL must be configured on the L3 switch VLAN interface assigned for the printer VLAN, or on the firewall interface connecting to the printer VLAN.

Exception to this requirement is traffic from RSD sensors connected to the VLAN.

Note: The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are ports 515, 631, 1782, 9100, 9101, and 9102. The SA can review RFC 1700 Port Assignments and review printer vendor documents to determine what ports should be allowed.

Fix Text (F-19149r1_fix)
Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.