Control Plane ACL

AltaNivel 1Revisión manualarista-eos

Descripción

A default control plane ACL is provided and applied to the system control-plane. The default control-place ACL is read-only, but you can create and assign a different ACL to the system control-plane if customization is needed. However, it is strongly recommended to use the default control-plane ACL as a template for any custom ACL that you may apply to ensure protocol and management operations function correctly. The default control plane ACL filters all IP traffic inbound and outbound on any management interface. SSH, Telnet, NTP, SNMP, IP protocols, and logging/matching on management traffic are done by this ACL. CIS assessment: Manual. Reported as SKIP with review instructions.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

CIS assessment: Manual. Run the following command to check that either your custom ACL or the default ACL is applied switch#show running-config all section system control-plane system control-plane ip access-group custom-control-plane-acl in ip access-group default-control-plane-acl vrf MGMT in switch# The control plane ACL is referenced by the ip[v6] access-group <ACLNAME> in configuration.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

! Apply a control plane ACL to the default vrf and all non default vrfs system control-plane ip access-group custom-control-plane-acl in ip access-group custom-control-plane-acl vrf MGMT in

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: arista-eosnetworkhardening
Referencia: CIS Arista EOS Benchmark v1.0.0 - 1.1.2 Control Plane ACL