A dedicated management network must be implemented.

From Network Infrastructure Policy Security Technical Implementation Guide

Part of A separate management subnet is not being used

Associated with: CCI-000366

SV-18981r2_rule A dedicated management network must be implemented.

Vulnerability discussion

To deploy a management network for the purpose of controlling, monitoring, and restricting management traffic, a separate management subnet must be implemented. Define a large enough address block that will enable the management network to scale in proportion to the managed network.

Check content

Review the network topology diagram to determine if a management network has been implemented. Validate the IP address space documented for this network by verifying the IP addresses referenced for management access (SSH, NTP, AAA, SNMP manager, Syslog server, etc.) to the managed network elements. If a management network has not been implemented, this is a finding.

Fix text

Define a large enough address block that will enable the management network to scale in proportion to the managed network.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.