Control Plane ACL

높음레벨 1수동 검토arista-eos

설명

A default control plane ACL is provided and applied to the system control-plane. The default control-place ACL is read-only, but you can create and assign a different ACL to the system control-plane if customization is needed. However, it is strongly recommended to use the default control-plane ACL as a template for any custom ACL that you may apply to ensure protocol and management operations function correctly. The default control plane ACL filters all IP traffic inbound and outbound on any management interface. SSH, Telnet, NTP, SNMP, IP protocols, and logging/matching on management traffic are done by this ACL. CIS assessment: Manual. Reported as SKIP with review instructions.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

CIS assessment: Manual. Run the following command to check that either your custom ACL or the default ACL is applied switch#show running-config all section system control-plane system control-plane ip access-group custom-control-plane-acl in ip access-group default-control-plane-acl vrf MGMT in switch# The control plane ACL is referenced by the ip[v6] access-group <ACLNAME> in configuration.

조치 방법

조치 방식: 가이드 또는 인프라 패치

! Apply a control plane ACL to the default vrf and all non default vrfs system control-plane ip access-group custom-control-plane-acl in ip access-group custom-control-plane-acl vrf MGMT in

속성

운영 체제: 모두
태그: arista-eosnetworkhardening
참고 자료: CIS Arista EOS Benchmark v1.0.0 - 1.1.2 Control Plane ACL