The network device must be configured with both an ingress and egress ACL.
Changes to the hardware or software components of the network device can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should be allowed administrative access to the network device for implementing any changes or upgrades. This requirement applies to updates of the application files, configuration, ACLs, and policy filters.
1. Verify the managed interface has an inbound and outbound ACL or filter.
2. Verify the ingress ACL blocks all transit traffic (any traffic not destined to the router itself). In addition, traffic accessing the managed elements should be originated at the NOC.
3. Verify the egress ACL blocks any traffic not originated by the managed element.
If the management interface does not have an ingress and egress filter configured and applied, this is a finding.
Fix Text (F-46383r719907_fix)
If the management interface is a routed interface, configure it with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.