The SEL-2740S must be configured to capture all packets without flow rule match criteria.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-92279	SELS-SW-000290	SV-102367r1_rule		Medium

Description
The OTSDN switch must be capable of capturing frames that are not engineered to be in the network and send them to a Security Information and Event Manager (SIEM) or midpoint sensor for analysis.

STIG	Date
SEL-2740S L2S Security Technical Implementation Guide	2019-05-06

Details

Check Text ( C-91577r3_chk )
Review the SEL-2740S to ensure that the "no match criteria" rule is set to capture the packet for analysis as a possible injection or intrusion. If the SEL-2740S is not configured to with the "no match criteria" rules for the Security Information and Event Manager (SIEM), this is a finding.

Fix Text (F-98519r2_fix)
To configure to capture all packets without flow rule match criteria, do the following: 1. Log on to OTSDN Controller using Permission Level 3. 2. Click "Flow Entries" in Navigation Menu. 3. Click "Add Flow" button. 4. Enter a "no match" flow rule for given ports. 5. Click "Submit".