The communications server is not configured to use PPP encapsulation and PPP authentication EAP for the async or AUX port used for dial in.

From Network Devices Security Technical Implementation Guide

Part of PPP authentication EAP not used for dial in

SV-19115r2_rule The communications server is not configured to use PPP encapsulation and PPP authentication EAP for the async or AUX port used for dial in.

Vulnerability discussion

A communications server (aka terminal server) can be used to provide interconnectivity between all managed network elements and the OOBM gateway router for administrative access to the device’s console port. In the event the OOBM network is not able to provide connectivity due to an outage, the communications server can provide a dial-up PPP connection to access a network element. The auxiliary port, consol port, as well as any slow-speed async serial port with an analog modem connected to the managed device also provides the capability for direct dial-up administrative access for infrastructures that do not have a communications server for management access.

Check content

Step 1: Issue the show line command to see the AUX port tty numbering for the communications server. The numbering varies based on the router model and modules installed. Step 2: Review the communications server configuration and verify that EAP is used for PPP authentication. Assuming that line 4 is bound to the AUX port, the configuration would look similar to the example shown below: interface async 4 encapsulation ppp ppp authentication eap

Fix text

Configure the communications server to use PPP encapsulation and PPP authentication EAP for the async or AUX port used for dial in.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer