CCI-001097
Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.
1 rule found Severity: Medium
The FortiGate firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave.
1 rule found Severity: Medium
1 rule found Severity: Medium
The NSX-T Tier-1 Gateway Firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
1 rule found Severity: Medium
1 rule found Severity: High
The network device must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.
4 rules found Severity: Medium
1 rule found Severity: High
The Arista router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.
1 rule found Severity: Medium
The Arista perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.
1 rule found Severity: Medium
The Arista perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.
1 rule found Severity: Medium
The Arista BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.
1 rule found Severity: Medium
The Arista router must be configured to block any traffic that is destined to IP core infrastructure.
1 rule found Severity: High
The Arista router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces.
1 rule found Severity: Medium
The out-of-band management (OOBM) Arista gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).
1 rule found Severity: Medium
The out-of-band management (OOBM) Arista gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.
1 rule found Severity: Medium
The Arista router must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Cisco ASA perimeter firewall must be configured to filter traffic destined to the enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.
1 rule found Severity: Medium
The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
2 rules found Severity: High
The Cisco perimeter switch must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.
3 rules found Severity: Medium
The Cisco perimeter switch must be configured to filter ingress traffic at the external interface on an inbound direction.
3 rules found Severity: Medium
The Cisco perimeter switch must be configured to filter egress traffic at the internal interface on an inbound direction.
3 rules found Severity: Medium
1 rule found Severity: High
The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.
1 rule found Severity: Medium
The Cisco perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.
3 rules found Severity: Medium
The Cisco perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.
3 rules found Severity: Medium
The Cisco perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.
3 rules found Severity: Medium
3 rules found Severity: Medium
The Cisco out-of-band management (OOBM) gateway router must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel.
3 rules found Severity: Medium
The Cisco out-of-band management (OOBM) gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).
3 rules found Severity: Medium
The Cisco out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the Network Operations Center (NOC).
3 rules found Severity: Medium
The Cisco router must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.
3 rules found Severity: Medium
The Cisco router providing connectivity to the Network Operations Center (NOC) must be configured to forward all in-band management traffic via an IPsec tunnel.
3 rules found Severity: Medium
The Cisco BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.
3 rules found Severity: Medium
The Cisco PE router must be configured to block any traffic that is destined to IP core infrastructure.
3 rules found Severity: High
The Cisco PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces.
3 rules found Severity: Medium
3 rules found Severity: Medium
The Cisco switch must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.
3 rules found Severity: Medium
The Cisco BGP switch must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.
2 rules found Severity: Medium
The Cisco PE switch must be configured to block any traffic that is destined to the IP core infrastructure.
3 rules found Severity: High
The Cisco PE switch must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces.
3 rules found Severity: Medium
The F5 BIG-IP appliance providing remote access intermediary services must be configured to route sessions to an IDPS for inspection.
1 rule found Severity: Medium
The BIG-IP appliance perimeter firewall must be configured to filter traffic destined to the enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.
1 rule found Severity: Medium
2 rules found Severity: High
The Juniper router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.
2 rules found Severity: Medium
The Juniper BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.
2 rules found Severity: Medium
The Juniper PE router must be configured to block any traffic that is destined to IP core infrastructure.
2 rules found Severity: High
The Juniper PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode, or a firewall filter, enabled on all CE-facing interfaces.
1 rule found Severity: Medium
The Juniper out-of-band management (OOBM) gateway must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel.
1 rule found Severity: Medium
The Juniper out-of-band management (OOBM) gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).
2 rules found Severity: Medium
The Juniper out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.
2 rules found Severity: Medium
The Juniper router must be configured to only permit management traffic that ingresses and egresses the OOBM interface.
2 rules found Severity: Medium
2 rules found Severity: Medium
An Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor all Demilitarized Zone (DMZ) segments housing public servers.
1 rule found Severity: Medium
An Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor the network segment hosting web, application, and database servers.
1 rule found Severity: Medium
An Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor network segments that house network security management servers.
1 rule found Severity: Medium
An Intrusion Detection and Prevention System (IDPS) must be deployed to monitor all unencrypted traffic entering and leaving the enclave.
1 rule found Severity: Medium
Multi-Protocol Labeled Switching (MPLS) labels must not be exchanged between the enclaves edge routers and any external neighbor routers.
1 rule found Severity: Medium
The router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.
1 rule found Severity: Medium
The perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.
1 rule found Severity: Medium
The perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.
1 rule found Severity: Medium
The perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.
1 rule found Severity: Medium
The BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.
1 rule found Severity: Medium
1 rule found Severity: High
The PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces..
1 rule found Severity: Medium
The out-of-band management (OOBM) gateway must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel.
1 rule found Severity: Medium
The out-of-band management (OOBM) gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).
1 rule found Severity: Medium
The out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.
1 rule found Severity: Medium
The router must be configured to only permit management traffic that ingresses and egresses the OOBM interface.
1 rule found Severity: Medium
The router providing connectivity to the NOC must be configured to forward all in-band management traffic via an IPsec tunnel.
1 rule found Severity: Medium
The perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
The Cisco router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
2 rules found Severity: High
The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
1 rule found Severity: Medium
The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.
1 rule found Severity: Medium
The Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must implement a security stack that restricts traffic flow inbound and outbound between the IaaS and the Boundary Cloud Access Point (BCAP) or Internal Cloud Access Point (ICAP) connection.
1 rule found Severity: High
The Mission Owner's internet-facing applications must be configured to traverse the Cloud Access Point (CAP) and Virtual Datacenter Security Stack (VDSS) prior to communicating with the internet.
1 rule found Severity: High
The Mission Owner of the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must configure scanning using an Assured Compliance Assessment Solution (ACAS) server or solution that meets DOD scanning and reporting requirements.
1 rule found Severity: Medium
The Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must be configured to maintain separation of all management and data traffic.
1 rule found Severity: Medium
The perimeter firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave.
1 rule found Severity: Medium
1 rule found Severity: High
The Dell OS10 Router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.
1 rule found Severity: Medium
The Dell OS10 BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.
1 rule found Severity: Medium
The Dell OS10 out-of-band management (OOBM) gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).
1 rule found Severity: Medium
The Dell OS10 out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.
1 rule found Severity: Medium
AOS, when used as a VPN Gateway, must be configured to route sessions to an intrusion detection and prevention system (IDPS) for inspection.
1 rule found Severity: Medium
AOS, when used as a WLAN bridge or controller, must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.
1 rule found Severity: Medium
The Juniper out-of-band management (OOBM) gateway router must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel.
1 rule found Severity: Medium
The Juniper router providing connectivity to the NOC must be configured to forward all in-band management traffic via an IPsec tunnel.
1 rule found Severity: Medium
The Juniper PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces.
1 rule found Severity: Medium
The NSX Tier-0 Gateway Firewall must deny network communications traffic by default and allow network communications traffic by exception.
1 rule found Severity: Medium
The NSX Tier-1 Gateway firewall must deny network communications traffic by default and allow network communications traffic by exception.
1 rule found Severity: Medium