<VulnDiscussion>For in-band management, the management network must have its own subnet to enforce control and access boundaries provided by layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the perimeter of the managed network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
This requirement is not applicable for the DODIN Backbone.
Configure the perimeter router of the managed network with a firewall filter on the egress interface to block all outbound management traffic.
set firewall family inet filter <name> term block-UDP-MGT-SRC from protocol udp
set firewall family inet filter <name> term block-UDP-MGT-SRC from source-port [ snmp snmptrap 2055 9995 9996 ]
set firewall family inet filter <name> term block-UDP-MGT-SRC then syslog
set firewall family inet filter <name> term block-UDP-MGT-SRC then discard
set firewall family inet filter <name> term block-TCP-MGT-SRC from protocol tcp
set firewall family inet filter <name> term block-TCP-MGT-SRC from source-port [ ssh tacacs ]
set firewall family inet filter <name> term block-TCP-MGT-SRC then syslog
set firewall family inet filter <name> term block-TCP-MGT-SRC then discard
set firewall family inet filter <name> term block-UDP-MGT-DST from protocol udp
set firewall family inet filter <name> term block-UDP-MGT-DST from destination-port [ snmp snmptrap 2055 9995 9996 ]
set firewall family inet filter <name> term block-UDP-MGT-DST then syslog
set firewall family inet filter <name> term block-UDP-MGT-DST then discard
set firewall family inet filter <name> term block-TCP-MGT-DST from protocol tcp
set firewall family inet filter <name> term block-TCP-MGT-DST from destination-port [ ssh tacacs ]
set firewall family inet filter <name> term block-TCP-MGT-DST then syslog
set firewall family inet filter <name> term block-TCP-MGT-DST then discard
<additional terms>
set firewall family inet filter <name> term accept-others then accept
set firewall family inet6 filter <name> term block-UDP-MGT-SRC from next-header udp
set firewall family inet6 filter <name> term block-UDP-MGT-SRC from source-port [ snmp snmptrap 2055 9995 9996 ]
set firewall family inet6 filter <name> term block-UDP-MGT-SRC then syslog
set firewall family inet6 filter <name> term block-UDP-MGT-SRC then discard
set firewall family inet6 filter <name> term block-TCP-MGT-SRC from next-header tcp
set firewall family inet6 filter <name> term block-TCP-MGT-SRC from source-port [ ssh tacacs ]
set firewall family inet6 filter <name> term block-TCP-MGT-SRC then syslog
set firewall family inet6 filter <name> term block-TCP-MGT-SRC then discard
set firewall family inet6 filter <name> term block-UDP-MGT-DST from next-header udp
set firewall family inet6 filter <name> term block-UDP-MGT-DST from destination-port [ snmp snmptrap 2055 9995 9996 ]
set firewall family inet6 filter <name> term block-UDP-MGT-DST then syslog
set firewall family inet6 filter <name> term block-UDP-MGT-DST then discard
set firewall family inet6 filter <name> term block-TCP-MGT-DST from next-header tcp
set firewall family inet6 filter <name> term block-TCP-MGT-DST from destination-port [ ssh tacacs ]
set firewall family inet6 filter <name> term block-TCP-MGT-DST then syslog
set firewall family inet6 filter <name> term block-TCP-MGT-DST then discard
<additional terms>
set firewall family inet6 filter <name> term accept-others then accept
set interfaces <external interface> unit <number> family inet filter output <name>
set interfaces <external interface> unit <number> family inet address <IPv4 address>/<mask>
set interfaces <external interface> unit <number> family inet6 filter output <name>
set interfaces <external interface> unit <number> family inet6 address <IPv6 address>/<prefix>