Control Plane ACL

HochStufe 1Manuelle Prüfungarista-eos

Beschreibung

A default control plane ACL is provided and applied to the system control-plane. The default control-place ACL is read-only, but you can create and assign a different ACL to the system control-plane if customization is needed. However, it is strongly recommended to use the default control-plane ACL as a template for any custom ACL that you may apply to ensure protocol and management operations function correctly. The default control plane ACL filters all IP traffic inbound and outbound on any management interface. SSH, Telnet, NTP, SNMP, IP protocols, and logging/matching on management traffic are done by this ACL. CIS assessment: Manual. Reported as SKIP with review instructions.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

CIS assessment: Manual. Run the following command to check that either your custom ACL or the default ACL is applied switch#show running-config all section system control-plane system control-plane ip access-group custom-control-plane-acl in ip access-group default-control-plane-acl vrf MGMT in switch# The control plane ACL is referenced by the ip[v6] access-group <ACLNAME> in configuration.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

! Apply a control plane ACL to the default vrf and all non default vrfs system control-plane ip access-group custom-control-plane-acl in ip access-group custom-control-plane-acl vrf MGMT in

Eigenschaften

Betriebssysteme: Beliebig
Tags: arista-eosnetworkhardening
Referenz: CIS Arista EOS Benchmark v1.0.0 - 1.1.2 Control Plane ACL