CCI-000032

Enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.

Details
Associations

13 rules found Severity: Medium

19 rules found Severity: Medium

4 rules found Severity: Medium

1 rule found Severity: Low

3 rules found Severity: Low

2 rules found Severity: Low

1 rule found Severity: Low

1 rule found Severity: Medium

1 rule found Severity: Low

CCI-000032

Ensure SELinux Not Disabled in the kernel arguments

Ensure SELinux Not Disabled in /etc/default/grub

Ensure No Device Files are Unlabeled by SELinux

The Arista BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

The Arista BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

The Cisco BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

The Cisco BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

The Cisco BGP switch must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

The Cisco BGP switch must be configured to reject route advertisements from CE switches with an originating AS in the AS_PATH attribute that does not belong to that customer.

The Juniper BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

The Juniper router configured for BGP must reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

The ALG that is part of a CDS must enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.

The Juniper BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.