The VPN gateway will be configured to disallow remote endpoints to communicate directly with other DMZ hosts.

Part of SRC-VPN-020 VPN gateway is dual-homed

Associated with IA controls: ECSC-1

SV-23848r1_rule The VPN gateway will be configured to disallow remote endpoints to communicate directly with other DMZ hosts.

Vulnerability discussion

Pass through communications from remote endpoints may allow network attack through the remote access gateway. To mitigate this risk, the VPN gateway or host will be configured with two interfaces. Remote users use the external interface while internal communications are sent using the internal interface.

Check content

Visually inspect the VPN gateway to verify that the VPN device is configured. NOTE: The VPN device will be configured with two interfaces. Remote users use the external interface while internal communications are sent using the internal interface.

Fix text

Ensure the VPN gateway is configured with two interfaces and does not allow direct communication.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.