Details

Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.

NOTE: Nessus did not perform this check as it requires manual verification as to whether or not server VLANS have ACLs defined with a deny-by-default security posture assigned to the appropriate interface(s) if applicable.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.

Supportive Information

The following resource is also helpful.

• https://iasecontent.disa.mil/stigs/zip/U_Network_Infrastructure_Router_L3_Switch_V8R29_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Juniper.

References

• 800-53|SC-7(5)
• CAT|II
• Rule-ID|SV-20061r3_rule
• STIG-ID|NET-SRVFRM-003
• Vuln-ID|V-18522

Source

• Tenable.com/audits