Detections
Analytics

1.18 CISC-RT-000250

Information

The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

GROUP ID: V-216753RULE ID: SV-216753r531087

Information flow control regulates authorized information to travel within a network and between interconnected networks. Controlling the flow of network traffic is critical so it does not introduce any unacceptable risk to the network infrastructure or data. An example of a flow control restriction is blocking outside traffic claiming to be from within the organization. For most routers, internal information flow control is a product of system design.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

This requirement is not applicable for the DODIN Backbone.

Step 1: Configure an ACL to allow or deny traffic as shown in the example below.

RP/0/0/CPU0:R3(config)#ipv4 access-list EXTERNAL_ACL_INBOUNDRP/0/0/CPU0:R3(config-ipv4-acl)#permit tcp host x.11.1.1 eq bgp host x.11.1.2RP/0/0/CPU0:R3(config-ipv4-acl)#permit tcp host x.11.1.1 host x.11.1.2 eq bgpRP/0/0/CPU0:R3(config-ipv4-acl)#permit icmp host x.11.1.1 host x.11.1.2 echoRP/0/0/CPU0:R3(config-ipv4-acl)#permit icmp host x.11.1.1 host x.11.1.2 echo-replyRP/0/0/CPU0:R3(config-ipv4-acl)#deny ip any host x.11.1.1 log-inputRP/0/0/CPU0:R3(config-ipv4-acl)#permit tcp any host x.12.1.22 eq wwwRP/0/0/CPU0:R3(config-ipv4-acl)#permit tcp any any establishedRP/0/0/CPU0:R3(config-ipv4-acl)#deny ip any any log-inputRP/0/0/CPU0:R3(config-ipv4-acl)#exit

Step 2: Apply the ACL inbound on all external interfaces.

RP/0/0/CPU0:R3(config)#int g0/0/0/1
RP/0/0/CPU0:R3(config-if)#ipv4 access-group EXTERNAL_ACL_INBOUND inRP/0/0/CPU0:R3(config-if)#end

See Also

https://workbench.cisecurity.org/benchmarks/23599

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4, CAT|II, CCI|CCI-001414, Rule-ID|SV-216753r531087_rule, STIG-ID|CISC-RT-000250, Vuln-ID|V-216753

Plugin: Cisco

Control ID: 32fe8ebfff1fb9de1ec5e53c21d3e2fb71b46e1f6ee4a3310d9dfeb6e37d0b82