The router must be configured with a filter to deny all traffic applied to all inactive interfaces.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000019-RTR-000008	SRG-NET-000019-RTR-000008	SRG-NET-000019-RTR-000008_rule		Medium

Description
Without a filter configured to deny all traffic on inactive interfaces, a router interface connected to an external network will expose the router and backbone network to malicious traffic.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000019-RTR-000008_chk )
Verify all inactive interfaces have a filter to deny all traffic applied to the interface. If an inactive interface does not have a filter to deny all traffic, this is a finding.

Fix Text (F-SRG-NET-000019-RTR-000008_fix)
Configure a filter to deny all traffic then apply it to all inactive interfaces.