The out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-78357	SRG-NET-000205-RTR-000011	SV-93063r1_rule		Medium

Description
If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway router.

STIG	Date
Router Security Requirements Guide	2020-06-30

Details

Check Text ( C-77919r2_chk )
This requirement is not applicable for the DoDIN Backbone. Review the access control list (ACL) or filter for the router receive path. Verify that only traffic sourced from the OOBM network or the NOC is allowed to access the router. If the router does not block any traffic destined to itself that is not sourced from the OOBM network or the NOC, this is a finding. Note: If the platform does not support the receive path filter, verify that all non-OOBM interfaces have an ingress ACL to restrict access to that interface address or any of the router’s loopback addresses to only traffic sourced from the management network. An exception would be to allow packets destined to these interfaces used for troubleshooting, such as ping and traceroute.

Check Text ( C-77919r2_chk )

This requirement is not applicable for the DoDIN Backbone.

Review the access control list (ACL) or filter for the router receive path.

Verify that only traffic sourced from the OOBM network or the NOC is allowed to access the router.

If the router does not block any traffic destined to itself that is not sourced from the OOBM network or the NOC, this is a finding.

Note: If the platform does not support the receive path filter, verify that all non-OOBM interfaces have an ingress ACL to restrict access to that interface address or any of the router’s loopback addresses to only traffic sourced from the management network. An exception would be to allow packets destined to these interfaces used for troubleshooting, such as ping and traceroute.

Fix Text (F-85089r1_fix)
This requirement is not applicable for the DoDIN Backbone. Ensure that traffic from the managed network is not able to access the OOBM gateway router using either receive path or interface ingress ACLs.