Detections
Analytics

1.1.1.1 Ensure the Management VRF Exists

Information

Ensure that the mgmt vrf exists and is assigned to the interface that connects to the management network for out of band access. The switch has a dedicated management interface that should be assigned to this vrf.

A Management VRF (Virtual Routing and Forwarding) is a dedicated, isolated routing instance on a network device used exclusively for out-of-band management traffic. It separates administrator access (like SSH, SNMP, and Syslog) from production data traffic.

Solution

Creat a vrf, assign it to the management interface and create a static route to the rest of the network. The vrf instance should have a meaningful name and description indicating its purpose.

vrf instance mgmt
 description Management VRF
!
interface Management1
 vrf mgmt

ip route vrf mgmt 0/0 {Gateway Address}
no ip routing vrf mgmt

See Also

https://workbench.cisecurity.org/benchmarks/25683

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(21)

Plugin: Arista

Control ID: a1e22709baae77f521598e10b915abbeed7ff71c3117d2261765c67aa1a41e66