III - Administrative Sensitive
Rules and Groups employed by this XCCDF Profile
-
NET-SDN-012
<GroupDescription></GroupDescription>Group -
Quality of service (QoS) must be implemented on the underlying IP network to provide preferred treatment for traffic between the SDN controllers and SDN-enabled switches and hypervisors.
<VulnDiscussion>With the network topology abstraction, the SDN controllers are able to determine how traffic should flow through network devi...Rule Low Severity -
NET-SDN-013
<GroupDescription></GroupDescription>Group -
SDN controllers must be deployed as clusters and on separate physical hosts to eliminate single point of failure.
<VulnDiscussion>SDN relies heavily on control messages between a controller and the forwarding devices for network convergence. The controlle...Rule Medium Severity -
NET-SDN-014
<GroupDescription></GroupDescription>Group -
Physical devices hosting an SDN controller must be connected to two switches for high-availability.
<VulnDiscussion>SDN relies heavily on control messages between a controller and the forwarding devices for network convergence. The controlle...Rule Low Severity -
NET-SDN-015
<GroupDescription></GroupDescription>Group -
SDN-enabled routers and switches must rate limit the amount of unknown data plane packets that are punted to the SDN controller.
<VulnDiscussion>SDN-enabled forwarding devices are dependent on the SDN controller for their forwarding tables as well as their configuration...Rule Low Severity -
NET-SDN-016
<GroupDescription></GroupDescription>Group -
Servers hosting SDN controllers must have logging enabled.
<VulnDiscussion>It is critical for both network and security personnel to be aware of the state of the SDN infrastructure to maintain network...Rule Medium Severity -
NET-SDN-018
<GroupDescription></GroupDescription>Group -
Servers hosting SDN controllers must have an HIDS implemented to detect unauthorized changes.
<VulnDiscussion>The SDN controller is the backbone of the SDN infrastructure. If the server hosting the SDN controller is breached or if unau...Rule Medium Severity -
NET-SDN-020
<GroupDescription></GroupDescription>Group -
All Virtual Extensible Local Area Network (VXLAN) enabled switches must be configured with the appropriate VXLAN network identifier (VNI) to ensure VMs can send and receive all associated traffic for their Layer 2 domain.
<VulnDiscussion>VXLAN is a Layer 2 network that overlays a Layer 3 network; that is, it creates a Layer 2 adjacency across a routed IP fabric...Rule Medium Severity -
NET-SDN-021
<GroupDescription></GroupDescription>Group -
Virtual Extensible Local Area Network (VXLAN) identifiers must be mapped to the appropriate VLAN identifiers.
<VulnDiscussion>VXLAN is a Layer 2 network that overlays a Layer 3 network; that is, it creates a Layer 2 adjacency across a routed IP fabric...Rule Medium Severity -
NET-SDN-022
<GroupDescription></GroupDescription>Group -
The proper multicast group for each Virtual Extensible Local Area Network (VXLAN) identifier must be mapped to the appropriate virtual tunnel endpoint (VTEP) so the VTEP will join the associated multicast groups.
<VulnDiscussion>VXLAN is a Layer 2 network that overlays a Layer 3 network; that is, it creates a Layer 2 adjacency across a routed IP fabric...Rule Medium Severity -
NET-SDN-024
<GroupDescription></GroupDescription>Group -
The virtual tunnel endpoint (VTEP) must be dual-homed to two physical network nodes.
<VulnDiscussion>If uplink connectivity for the VTEP to the Virtual Extensible Local Area Network (VXLAN) transport network fails, traffic to ...Rule Low Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.