Detections
Analytics

1.15 CISC-RT-000250

Information

The Cisco perimeter switch must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Group ID: V-221088
Rule ID: SV-221088r999697

Information flow control regulates authorized information to travel within a network and between interconnected networks. Controlling the flow of network traffic is critical so it does not introduce any unacceptable risk to the network infrastructure or data. An example of a flow control restriction is blocking outside traffic claiming to be from within the organization. For most switches, internal information flow control is a product of system design.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Step 1 : Configure an ACL to allow or deny traffic as shown in the example below:

SW2(config)# ip access-list EXTERNAL_ACL
SW2(config-acl)# permit tcp any any established
SW2(config-acl)# permit tcp x.11.1.1/32 eq bgp x.11.1.2/32
SW2(config-acl)# permit tcp x.11.1.1/32 x.11.1.2/32 eq bgp
SW2(config-acl)# permit icmp x.11.1.1/32 x.11.1.2/32 echo
SW2(config-acl)# permit icmp x.11.1.1/32 x.11.1.2/32 echo-reply
SW2(config-acl)# permit tcp any x.11.2.3/32 eq www
SW2(config-acl)# deny ip any any log
SW2(config-acl)# exit

Step 2 : Apply the ACL inbound on all applicable interfaces.

SW1(config)#int e2/2
SW1(config-if)# ip access-group EXTERNAL_ACL in

See Also

https://workbench.cisecurity.org/benchmarks/26426

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-4, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6, Rule-ID|SV-221088r999697_rule, STIG-ID|CISC-RT-000250, Vuln-ID|V-221088

Plugin: Cisco

Control ID: 6ce656901dcb840df3090c32d879f29e3dd1913e671b0b966167c136b05e909a