The network element must route all management traffic through a dedicated management interface.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000198-RTR-NA	SRG-NET-000198-RTR-NA	SRG-NET-000198-RTR-NA_rule		Medium

Description
From an architectural perspective, implementing out of band management (OOBM) for network elements is a best practice and the first step in the deployment of a management network. OOBM networks isolate network users from communication channels dedicated to network management; thereby providing traffic separation that will increase security for all network management activities. The management network should have a direct connection to the managed network elements. Where this is not possible, the OOBM traffic can traverse a transient IP backbone via private encrypted tunnel. Regardless of transport, all management traffic received by the managed network element must be received by a dedicated management interface connected to the OOBM network. This requirement is applicable to network device management and is not applicable to the routing function.

Description

From an architectural perspective, implementing out of band management (OOBM) for network elements is a best practice and the first step in the deployment of a management network. OOBM networks isolate network users from communication channels dedicated to network management; thereby providing traffic separation that will increase security for all network management activities. The management network should have a direct connection to the managed network elements. Where this is not possible, the OOBM traffic can traverse a transient IP backbone via private encrypted tunnel. Regardless of transport, all management traffic received by the managed network element must be received by a dedicated management interface connected to the OOBM network. This requirement is applicable to network device management and is not applicable to the routing function.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000198-RTR-NA_chk )
This requirement is NA for router.

Fix Text (F-SRG-NET-000198-RTR-NA_fix)
This requirement is NA for router.