CCI-002403
Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
The A10 Networks ADC, when used to load balance web applications, must examine incoming user requests against the URI White Lists.
1 rule found Severity: Medium
Kona Site Defender must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
1 rule found Severity: Medium
The Arista Multilayer Switch must only allow incoming communications from authorized sources to be routed to authorized destinations.
1 rule found Severity: Medium
The CA API Gateway must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
1 rule found Severity: Medium
The FortiGate firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
1 rule found Severity: Medium
The FortiGate firewall must apply egress filters to traffic outbound from the network through any internal interface.
1 rule found Severity: Medium
1 rule found Severity: Medium
The FortiGate firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.
1 rule found Severity: Medium
The HP FlexFabric Switch must only allow incoming communications from authorized sources to be routed to authorized destinations.
1 rule found Severity: Medium
The DataPower Gateway must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Sentry must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
2 rules found Severity: Medium
Symantec ProxySG must allow incoming communications only from organization-defined authorized sources routed to organization-defined authorized destinations.
1 rule found Severity: Medium
The NSX-T Tier-1 Gateway Firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
1 rule found Severity: Medium
The NSX-T Tier-0 Gateway Firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
1 rule found Severity: Medium
The network device must not be configured to have any feature enabled that calls home to the vendor.
3 rules found Severity: Medium
The BIG-IP AFM module must be configured to only allow incoming communications from authorized sources routed to authorized destinations.
1 rule found Severity: Medium
The BIG-IP Core implementation must be configured to only allow incoming communications from authorized sources routed to authorized destinations.
1 rule found Severity: Medium
The Arista perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.
1 rule found Severity: Medium
The Arista perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.
1 rule found Severity: Medium
The Arista perimeter router must be configured to have Link Layer Discovery Protocols (LLDPs) disabled on all external interfaces.
1 rule found Severity: Low
The Arista perimeter router must be configured to have Proxy ARP disabled on all external interfaces.
1 rule found Severity: Medium
The Arista multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.
1 rule found Severity: Low
The Arista multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.
1 rule found Severity: Medium
The Arista Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel.
1 rule found Severity: Medium
The Cisco perimeter switch must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.
3 rules found Severity: Medium
The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes.
3 rules found Severity: Medium
3 rules found Severity: Medium
The Cisco perimeter switch must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.
3 rules found Severity: Low
The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.
3 rules found Severity: Medium
The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.
3 rules found Severity: Medium
The Cisco perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.
3 rules found Severity: Low
The Cisco perimeter router must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.
3 rules found Severity: Low
The Cisco perimeter router must be configured to have Proxy ARP disabled on all external interfaces.
3 rules found Severity: Medium
The Cisco multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.
3 rules found Severity: Low
The Cisco multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.
3 rules found Severity: Medium
The Cisco Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.
3 rules found Severity: Medium
3 rules found Severity: Medium
1 rule found Severity: Medium
The Cisco perimeter switch must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.
3 rules found Severity: Low
The Cisco perimeter switch must be configured to have Proxy ARP disabled on all external interfaces.
3 rules found Severity: Medium
3 rules found Severity: Medium
The Cisco multicast Designated switch (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.
3 rules found Severity: Low
The Cisco multicast Designated switch (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.
3 rules found Severity: Medium
The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to only accept MSDP packets from known MSDP peers.
2 rules found Severity: Medium
2 rules found Severity: Medium
The Cisco perimeter switch must be configured drop IPv6 packets with a Routing Header type 0, 1, or 3-255.
2 rules found Severity: Medium
The Cisco perimeter switch must be configured to drop IPv6 packets containing a Hop-by-Hop header with invalid option type values.
2 rules found Severity: Medium
The Cisco perimeter switch must be configured to drop IPv6 packets containing a Destination Option header with invalid option type values.
2 rules found Severity: Medium
The Cisco perimeter switch must be configured to drop IPv6 packets containing an extension header with the Endpoint Identification option.
2 rules found Severity: Medium
The Cisco perimeter switch must be configured to drop IPv6 packets containing the NSAP address option within Destination Option header.
2 rules found Severity: Medium
The Cisco perimeter switch must be configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type.
2 rules found Severity: Medium
3 rules found Severity: Medium
The Cisco perimeter router must be configured drop IPv6 packets with a Routing Header type 0, 1, or 3–255.
3 rules found Severity: Medium
The Cisco perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop header with invalid option type values.
3 rules found Severity: Medium
The Cisco perimeter router must be configured to drop IPv6 packets containing a Destination Option header with invalid option type values.
3 rules found Severity: Medium
The Cisco perimeter router must be configured to drop IPv6 packets containing an extension header with the Endpoint Identification option.
3 rules found Severity: Medium
The Cisco perimeter router must be configured to drop IPv6 packets containing the NSAP address option within Destination Option header.
3 rules found Severity: Medium
The Cisco perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type.
3 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Juniper router must not be configured to have any feature enabled that calls home to the vendor.
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
The Juniper perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to have Link Layer Discovery Protocols (LLDPs) disabled on all external interfaces.
1 rule found Severity: Low
The Juniper perimeter router must be configured to have Proxy ARP disabled on all external interfaces.
2 rules found Severity: Medium
The Juniper multicast Designated Router (DR) must be configured to filter the IGMP and MLD Report messages to allow hosts to join only multicast groups that have been approved by the organization.
1 rule found Severity: Low
The Juniper multicast Designated Router (DR) must be configured to filter the IGMP and MLD Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.
1 rule found Severity: Medium
The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to drop fragmented IPv6 packets where the first fragment does not include the entire IPv6 header chain.
1 rule found Severity: Medium
The Juniper perimeter router must be configured drop IPv6 packets with a Routing Header type 0, 1, or 3255.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop header with invalid option type values.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to drop IPv6 packets containing a Destination Option header with invalid option type values.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to drop IPv6 packets containing an extension header with the Endpoint Identification option.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to drop IPv6 packets containing the NSAP address option within Destination Option header.
2 rules found Severity: Medium
The Juniper perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type.
2 rules found Severity: Medium
The Windows PAW must be configured so that all inbound ports and services to a PAW are blocked except as needed for monitoring, scanning, and management tools or when the inbound communication is a response to an outbound connection request.
1 rule found Severity: Medium
The perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.
1 rule found Severity: Medium
The perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.
1 rule found Severity: Medium
The perimeter router must be configured to have Link Layer Discovery Protocols (LLDPs) disabled on all external interfaces.
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
The multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.
1 rule found Severity: Low
The multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.
1 rule found Severity: Medium
The Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop header with invalid option type values.
1 rule found Severity: Medium
The perimeter router must be configured to drop IPv6 packets containing a Destination Option header with invalid option type values.
1 rule found Severity: Medium
The perimeter router must be configured to drop IPv6 packets containing an extension header with the Endpoint Identification option.
1 rule found Severity: Medium
The perimeter router must be configured to drop IPv6 packets containing the NSAP address option within Destination Option header.
1 rule found Severity: Medium
The perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type.
1 rule found Severity: Medium
The SDN controller must be configured to only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
1 rule found Severity: Medium
The ALG must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
1 rule found Severity: Medium
The firewall must apply egress filters to traffic that is outbound from the network through any internal interface.
1 rule found Severity: Medium
The premise firewall (located behind the premise router) must block all outbound management traffic.
1 rule found Severity: Medium
The firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.
1 rule found Severity: Medium
The Dell OS10 multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.
1 rule found Severity: Low
The Dell OS10 multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.
1 rule found Severity: Medium
The Dell OS10 Router must not be configured to have any feature enabled that calls home to the vendor.
1 rule found Severity: Medium
AOS, when configured as a WLAN bridge, must not be configured to have any feature enabled that calls home to the vendor.
1 rule found Severity: Medium
The Juniper perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.
1 rule found Severity: Low
The Juniper multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.
1 rule found Severity: Low
The Juniper multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.
1 rule found Severity: Medium
The Juniper SRX Services Gateway Firewall must only allow inbound communications from organization-defined authorized sources routed to organization-defined authorized destinations.
1 rule found Severity: Medium
The Juniper SRX Services Gateway VPN must only allow incoming VPN communications from organization-defined authorized sources routed to organization-defined authorized destinations.
1 rule found Severity: Medium
The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.
1 rule found Severity: Medium
The NSX Tier-0 Gateway Firewall must deny network communications traffic by default and allow network communications traffic by exception.
1 rule found Severity: Medium