Control Plane ACL

YüksekDüzey 1Manuel incelemearista-eos

Açıklama

A default control plane ACL is provided and applied to the system control-plane. The default control-place ACL is read-only, but you can create and assign a different ACL to the system control-plane if customization is needed. However, it is strongly recommended to use the default control-plane ACL as a template for any custom ACL that you may apply to ensure protocol and management operations function correctly. The default control plane ACL filters all IP traffic inbound and outbound on any management interface. SSH, Telnet, NTP, SNMP, IP protocols, and logging/matching on management traffic are done by this ACL. CIS assessment: Manual. Reported as SKIP with review instructions.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

CIS assessment: Manual. Run the following command to check that either your custom ACL or the default ACL is applied switch#show running-config all section system control-plane system control-plane ip access-group custom-control-plane-acl in ip access-group default-control-plane-acl vrf MGMT in switch# The control plane ACL is referenced by the ip[v6] access-group <ACLNAME> in configuration.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

! Apply a control plane ACL to the default vrf and all non default vrfs system control-plane ip access-group custom-control-plane-acl in ip access-group custom-control-plane-acl vrf MGMT in

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: arista-eosnetworkhardening
Referans: CIS Arista EOS Benchmark v1.0.0 - 1.1.2 Control Plane ACL