The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

From Infrastructure L3 Switch Secure Technical Implementation Guide - Cisco

Part of Upstream access not restricted for non-802.1x VLAN

SV-20089r1_rule The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

Vulnerability discussion

A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.

Check content

An ACL or firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set. Verify the filter applied to the printer VLAN subnet.

Fix text

Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.