CCI-004891
Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
1 rule found Severity: Medium
The Arista MLS layer 2 switch must not have the default VLAN assigned to any host-facing switch ports.
1 rule found Severity: Medium
The Arista MLS layer 2 switch must have the default VLAN pruned from all trunk ports that do not require it.
1 rule found Severity: Medium
The Arista MLS layer 2 switch must have all user-facing or untrusted ports configured as access switch ports.
1 rule found Severity: Medium
The Arista MLS layer 2 switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
The Cisco switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.
3 rules found Severity: Medium
3 rules found Severity: Low
The Cisco out-of-band management (OOBM) gateway router must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel.
3 rules found Severity: Medium
The Cisco switch must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.
2 rules found Severity: Medium
The Juniper EX switch must be configured to assign all disabled access interfaces to an unused VLAN.
1 rule found Severity: Medium
The Juniper EX switch must not be configured with VLANs used for L2 control traffic assigned to any host-facing access interface.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Juniper out-of-band management (OOBM) gateway must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel.
1 rule found Severity: Medium
The Juniper router must be configured to only permit management traffic that ingresses and egresses the OOBM interface.
1 rule found Severity: Medium
The Juniper PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance bound to the appropriate physical or logical interfaces to maintain traffic separation between all MPLS L3VPNs.
1 rule found Severity: High
The Juniper PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Target (RT).
1 rule found Severity: High
The Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have all attachment circuits defined to the virtual forwarding instance (VFI) with the globally unique VPN ID assigned for each customer VLAN.
1 rule found Severity: High
The layer 2 switch must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
1 rule found Severity: Medium
The router must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
1 rule found Severity: Medium
The SDN controller must be configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
1 rule found Severity: Medium
The ALG must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
1 rule found Severity: Medium
The Dell OS10 Switch must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
1 rule found Severity: Medium
The firewall must be configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
1 rule found Severity: Medium
The IDPS must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
1 rule found Severity: Medium
The Juniper out-of-band management (OOBM) gateway router must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel.
1 rule found Severity: Medium
For User Role Firewalls, the Juniper SRX Services Gateway Firewall must employ user attribute-based security policies to enforce approved authorizations for logical access to information and system resources.
1 rule found Severity: Medium
The Juniper SRX Services Gateway Firewall must only allow inbound communications from organization-defined authorized sources routed to organization-defined authorized destinations.
1 rule found Severity: Medium
The Juniper SRX Services Gateway VPN must use AES256 for the IPsec proposal to protect the confidentiality of remote access sessions.
1 rule found Severity: High
The Juniper SRX Services Gateway VPN must use AES256 encryption for the Internet Key Exchange (IKE) proposal to protect the confidentiality of remote access sessions.
1 rule found Severity: High
The Juniper SRX Services Gateway VPN must be configured to use Diffie-Hellman (DH) group 15 or higher.
1 rule found Severity: High
The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.
1 rule found Severity: Medium