Free DISA STIG and SRG Library | Vaulted

V-18545

The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

Finding ID
NET-VLAN-024
Rule ID
SV-20089r1_rule20089r2_rule
Severity
Cat II
CCE
(None)
Group Title
Upstream access not restricted for non-802.1x VLAN
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.

Fix Text

Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.

Check Content

AnTo verify compliance with this requirement, an ACL ormust firewallbe ruleconfigured seton canthe filterL3 networkswitch trafficVLAN withininterface assigned for the printer VLAN, or on the firewall interface connecting to onlythe expected printer protocolsVLAN. Exception to this requirement is traffic from RSD sensors connected to the VLAN. Note: The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typicallyports tcp port 515, 631, 1782, and tcp ports 9100, 9101, and 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents forto thedetermine filterwhat rule-set.ports Verifyshould thebe filterallowed. applied to the printer VLAN subnet.

Responsibility

Information Assurance Officer