OS10-RTR-000010 - The Dell OS10 Router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

800-53|AC-4

CAT|II

CCI|CCI-001368

Rule-ID|SV-269849r1137893_rule

STIG-ID|OS10-RTR-000010

Vuln-ID|V-269849

OS10-RTR-000020 - The Dell OS10 BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Rule-ID|SV-269850r1137894_rule

STIG-ID|OS10-RTR-000020

Vuln-ID|V-269850

OS10-RTR-000030 - The Dell OS10 BGP router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

Rule-ID|SV-269851r1137895_rule

STIG-ID|OS10-RTR-000030

Vuln-ID|V-269851

OS10-RTR-000040 - The Dell OS10 BGP router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.

Rule-ID|SV-269852r1137896_rule

STIG-ID|OS10-RTR-000040

Vuln-ID|V-269852

OS10-RTR-000050 - The Dell OS10 BGP router must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS).

Rule-ID|SV-269853r1137897_rule

STIG-ID|OS10-RTR-000050

Vuln-ID|V-269853

OS10-RTR-000060 - The Dell OS10 BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

CAT|III

Rule-ID|SV-269854r1137898_rule

STIG-ID|OS10-RTR-000060

Vuln-ID|V-269854

OS10-RTR-000100 - The Dell OS10 BGP router must be configured to reject route advertisements from CE routers with an originating autonomous system (AS) in the AS_PATH attribute that does not belong to that customer.

Rule-ID|SV-269855r1195280_rule

STIG-ID|OS10-RTR-000100

Vuln-ID|V-269855

OS10-RTR-000130 - The Dell OS10 multicast router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.

CCI|CCI-001414

Rule-ID|SV-269857r1137908_rule

STIG-ID|OS10-RTR-000130

Vuln-ID|V-269857

OS10-RTR-000140 - The Dell OS10 multicast router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.

Rule-ID|SV-269858r1137911_rule

STIG-ID|OS10-RTR-000140

Vuln-ID|V-269858

OS10-RTR-000160 - The Dell OS10 Router must be configured to have all inactive interfaces disabled.

Rule-ID|SV-269859r1137913_rule

STIG-ID|OS10-RTR-000160

Vuln-ID|V-269859

OS10-RTR-000180 - The perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

CAT|I

Rule-ID|SV-269861r1137919_rule

STIG-ID|OS10-RTR-000180

Vuln-ID|V-269861

OS10-RTR-000200 - The Dell OS10 out-of-band management (OOBM) gateway router must be configured to have separate Interior Gateway Protocol (IGP) instances for the managed network and management network.

Rule-ID|SV-269863r1137925_rule

STIG-ID|OS10-RTR-000200

Vuln-ID|V-269863

OS10-RTR-000210 - The Dell OS10 out-of-band management (OOBM) gateway router must be configured to not redistribute routes between the management network routing domain and the managed network routing domain.

Rule-ID|SV-269864r1137928_rule

STIG-ID|OS10-RTR-000210

Vuln-ID|V-269864

OS10-RTR-000220 - The Dell OS10 multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Register messages received from the Designated Router (DR) for any undesirable multicast groups and sources.

Rule-ID|SV-269865r1137930_rule

STIG-ID|OS10-RTR-000220

Vuln-ID|V-269865

OS10-RTR-000230 - The Dell OS10 multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups.

Rule-ID|SV-269866r1137932_rule

STIG-ID|OS10-RTR-000230

Vuln-ID|V-269866

OS10-RTR-000260 - The Dell OS10 Router must be configured to log all packets that have been dropped.

800-53|AU-3

CCI|CCI-000134

Rule-ID|SV-269867r1051986_rule

STIG-ID|OS10-RTR-000260

Vuln-ID|V-269867

OS10-RTR-000280 - The Dell OS10 Router must not be configured to have any feature enabled that calls home to the vendor.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-269927r1052166_rule

STIG-ID|OS10-RTR-000280

Vuln-ID|V-269927

OS10-RTR-000290 - The Dell OS10 Router must be configured to use encryption for routing protocol authentication.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-269868r1051989_rule

STIG-ID|OS10-RTR-000290

Vuln-ID|V-269868

OS10-RTR-000300 - The Dell OS10 Router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-269869r1051992_rule

STIG-ID|OS10-RTR-000300

Vuln-ID|V-269869

OS10-RTR-000340 - The PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-269870r1052434_rule

STIG-ID|OS10-RTR-000340

Vuln-ID|V-269870

OS10-RTR-000380 - The Dell OS10 Router must be configured to restrict traffic destined to itself.

800-53|SC-7a.

CCI|CCI-001097

Rule-ID|SV-269872r1052001_rule

STIG-ID|OS10-RTR-000380

Vuln-ID|V-269872

OS10-RTR-000390 - The Dell OS10 Router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-269873r1052004_rule

STIG-ID|OS10-RTR-000390

Vuln-ID|V-269873

OS10-RTR-000430 - The Dell OS10 BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

Rule-ID|SV-269877r1052016_rule

STIG-ID|OS10-RTR-000430

Vuln-ID|V-269877

OS10-RTR-000470 - The Dell OS10 out-of-band management (OOBM) gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).

Rule-ID|SV-269879r1052022_rule

STIG-ID|OS10-RTR-000470

Vuln-ID|V-269879

OS10-RTR-000480 - The Dell OS10 out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.

Rule-ID|SV-269880r1052242_rule

STIG-ID|OS10-RTR-000480

Vuln-ID|V-269880

OS10-RTR-000540 - The Dell OS10 Router must be configured to implement message authentication for all control plane protocols.

800-53|SC-23

CCI|CCI-001184

Rule-ID|SV-269882r1052031_rule

STIG-ID|OS10-RTR-000540

Vuln-ID|V-269882

OS10-RTR-000550 - The Dell OS10 BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.

Rule-ID|SV-269883r1052034_rule

STIG-ID|OS10-RTR-000550

Vuln-ID|V-269883

OS10-RTR-000560 - The Dell OS10 Router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-269884r1052037_rule

STIG-ID|OS10-RTR-000560

Vuln-ID|V-269884

OS10-RTR-000600 - The Dell OS10 Router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

800-53|SC-5

CCI|CCI-002385

Rule-ID|SV-269885r1052040_rule

STIG-ID|OS10-RTR-000600

Vuln-ID|V-269885

OS10-RTR-000610 - The Dell OS10 Router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

Rule-ID|SV-269886r1052435_rule

STIG-ID|OS10-RTR-000610

Vuln-ID|V-269886

OS10-RTR-000620 - The Dell OS10 Router must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-269887r1052046_rule

STIG-ID|OS10-RTR-000620

Vuln-ID|V-269887

OS10-RTR-000630 - The Dell OS10 Router must be configured to have IP directed broadcast disabled on all interfaces.

Rule-ID|SV-269888r1052480_rule

STIG-ID|OS10-RTR-000630

Vuln-ID|V-269888

OS10-RTR-000640 - The Dell OS10 Router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.

Rule-ID|SV-269889r1052052_rule

STIG-ID|OS10-RTR-000640

Vuln-ID|V-269889

OS10-RTR-000670 - The Dell OS10 BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix deaggregation attacks.

Rule-ID|SV-269890r1052055_rule

STIG-ID|OS10-RTR-000670

Vuln-ID|V-269890

OS10-RTR-000680 - The Dell OS10 BGP router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.

Rule-ID|SV-269891r1052058_rule

STIG-ID|OS10-RTR-000680

Vuln-ID|V-269891

OS10-RTR-000710 - The Dell OS10 multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.

Rule-ID|SV-269892r1052061_rule

STIG-ID|OS10-RTR-000710

Vuln-ID|V-269892

OS10-RTR-000800 - The Dell OS10 multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.

Rule-ID|SV-269898r1052079_rule

STIG-ID|OS10-RTR-000800

Vuln-ID|V-269898

OS10-RTR-000810 - The Dell OS10 multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.

Rule-ID|SV-269899r1052082_rule

STIG-ID|OS10-RTR-000810

Vuln-ID|V-269899

OS10-RTR-000910 - The Dell OS10 BGP router must be configured to use its loopback address as the source address for iBGP peering sessions.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-269901r1052088_rule

STIG-ID|OS10-RTR-000910

Vuln-ID|V-269901

OS10-RTR-001020 - The Dell OS10 Router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule-ID|SV-269902r1052091_rule

STIG-ID|OS10-RTR-001020

Vuln-ID|V-269902

OS10-RTR-001030 - The Dell OS10 Router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-269903r1052094_rule

STIG-ID|OS10-RTR-001030

Vuln-ID|V-269903

OS10-RTR-001040 - The Dell OS10 Router must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.

Detections

Analytics

DISA Dell OS10 Switch Router STIG v1r2

Audit Details

File Details

Audit Changelog

No revisions found