The router must deny network traffic by default and allow network traffic by exception at all interfaces at the network perimeter.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000202-RTR-000088	SRG-NET-000202-RTR-000088	SRG-NET-000202-RTR-000088_rule		Low

Description
All inbound and outbound traffic must be denied by default. Firewalls and perimeter routers should only allow traffic through that is explicitly permitted. The initial defense for the internal network is to block at the perimeter any traffic that is attempting to make a connection to a host residing on the internal network. In addition, allowing unknown or undesirable outbound traffic by the firewall or router will establish state that will subsequently permit the inbound return of this undesirable traffic.

Description

All inbound and outbound traffic must be denied by default. Firewalls and perimeter routers should only allow traffic through that is explicitly permitted. The initial defense for the internal network is to block at the perimeter any traffic that is attempting to make a connection to a host residing on the internal network. In addition, allowing unknown or undesirable outbound traffic by the firewall or router will establish state that will subsequently permit the inbound return of this undesirable traffic.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000202-RTR-000088_chk )
Inspect the policy filters installed on the router. Verify the perimeter router is configured in a deny-by-default posture. If the perimeter router is not configured in a deny-by-default posture for all inbound and outbound traffic, this is a finding.

Fix Text (F-SRG-NET-000202-RTR-000088_fix)
Configure the inbound and outbound router interfaces to deny network traffic by default and allow network traffic by exception at all interfaces at the network perimeter.