What changed in Cisco ACI Router STIG V1R2V1R2 changes

Check text

Review the switch configuration to verify that ACLscontracts are configured. 1. toTo allowcheck orcontract denyconfiguration, trafficnavigate forto specificTenants source>> and{{Your_Tenant}} destination>> addressesContracts as>> wellStandard as(whitelist)/Taboos ports(blacklist) and>> protocols{{Your_Contract}} >> {{your_subject}}. 2. ForTo example,check the configuration belowfor willthe allowProvider weband trafficConsumer (HTTP)of from the "WebServer"contract, EPGnavigate to theTenants "Database">> EPG. tenant{{Your_Tenant}} TENANT1 context>> Application filter WEB_TRAFFIC_FILTER filterProfiles ip>> permit{{ sourceyour_Application_Profile}} &ltweb_server_ip_range> destination &ltdatabase_ip_range> protocolApplication tcpEPGs port>> 80 contract{{Your_EPG}} WEBACCESS filter>> WEB_TRAFFIC_FILTERContracts. epg WebServer contract WEBACCESS epg Database contract WEBACCESS If the switch is not configured to use contract filters to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies, this is a finding.

Fix text

Configure "contracts" to define security policies that control traffic between different EPGs. 1.Contract Navigatesubjects must combine filters that will designate what traffic is allowed to pass through the desiredcontract, tenantbut for the contract to work it must be applied where the Provider contract is attached to the service side and contextthe Consumer is attached to createthe filtersuser side. apic(config)# tenantTraffic &lttenant_name>must contextbe &ltcontext_name> filterinitiated &ltfilter_name>from filterthe ipConsumer permitEPG sourceto &ltsource_IP_range>the destinationProvider &ltdest_IP_range>EPG, protocolincluding &ltprotocol>filters portand &ltport_number>security policies. 21. CreateConfigure orthe updatedetails anof existingeach contract. LinkNavigate theto previouslyTenants created>> filter{{Your_Tenant}} to>> aContracts named>> contract. apicStandard (configwhitelist)#/Taboos contract(blacklist) &ltcontract_name> filter> &ltfilter_name{{Your_Contract}} > > {{your_subject}}. 32. AssignConfigure the details of each Provider and Consumer of the contract. Navigate to EPGs.Tenants Associate>> the{{Your_Tenant}} created>> contractApplication withProfiles the>> specific{{ EPGs. apic(config)#your_Application_Profile}} epg>> &ltepg_nameApplication EPGs >> contract{{Your_EPG}} &ltcontract_name>> Contracts.

Discussion

Information flow control regulates where information is allowed to travel within a network and between interconnected networks. The flow of all network traffic must be monitored and controlled so it does not introduce any unacceptable risk to the network infrastructure or data. Information flow control policies and enforcement mechanisms are commonly employed by organizations to control the flow of information between designated sources and destinations (e.g., networks, individuals, and devices) within information systems. In Cisco ACI, the administrator uses "contracts" to define security policies that control traffic between different endpoint groups (EPGs), essentially acting as a more granular and flexible ACL mechanism by specifying source and destination addresses, ports, and protocols based on the desired network segmentation needs. Add multiple filter rules to create a comprehensive set of allowed traffic patterns. Satisfies: SRG-NET-000019-RTR-000005, SRG-NET-000715-RTR-000120

CCIs

CCI-001368CCI-001368,CCI-001414,CCI-004891

V-272061 in V1R2

Check text

Review the switch configuration to verify it will reject routes belonging to the local AS. 1. Verify a prefix list has been configured containing prefixes belonging to the local AS. route-map LOCAL_AS_FILTERNavigate permitto 10 matchTenants ip>> address{{your_Tenant}} prefix>> &ltlocal-AS-prefixNetworking > set> communityL3Outs no-advertise>> {{your_L3Outs}} >> Route Map for import and export route control. 2. Review the route-map to the inbound BGP policy. bgp neighborNavigate &ltpeer-IPto Tenants >> address-family{{your_Tenant}} ipv4>> unicast inboundNetworking route-map>> LOCAL_AS_FILTERL3Outs >> {{your_L3Outs}} >> External EPGs >> Policy >> General >> Route Control Profile. If the switch is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.

Fix text

Configure the router to reject inbound route advertisements for any prefixes belonging to the local AS. 1. From the relevant BGP peer configuration, create a route-map to filter local AS prefixes. Route-map LOCAL_AS_FILTER permit 10 match ip address prefix &ltlocal-AS-prefix> set community no-advertise 2. Apply the route-map to the inbound BGP policy. Within the inbound policy, add a prefix filter rule that explicitly rejects any routes with a prefix matching the local AS number. bgp1. neighborNavigate &ltpeer-IPto Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> Route Map for import and export route control. address-family2. ipv4Apply unicastthat route MAP to the external EPG in the following location: Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> External EPGs >> Policy >> General >> Route Control Profile. inbound Note: An alternative to route-map MY_LOCAL_AS_FILTERmaps is to use subnets under the External EPG with the correct route controls assigned as discussed in vendor documentation (Reference the L3 out white paper).

Discussion

Accepting route advertisements belonging to the local AS can result in traffic looping or being black holed, or at a minimum using a nonoptimized path. For Cisco APIC, the default setting is to prevent route loops from occurring. Sites mustare required to use different AS numbers. If this occurs, routing updates from one site is dropped when the other site receives them by defaultconfiguring. To prevent such a situation from occurring, sites must not enable the "BGP Autonomous System override" feature to override the default setting., Theyand must also not enable the "Disable Peer AS Check". An alternative to route maps is to use subnets under the External EPG with the correct route Controls assigned discussed in vendor documentation (Reference the L3 out white paper).

V-272062 in V1R2

Check text

Review the ACI configuration to verify it will reject routes belonging to the local AS. 1. Verify a prefix list has been configured containing prefixes belonging to the local AS. InNavigate theto exampleTenants below,>> x.13.1.0/24{{your_Tenant}} is>> theNetworking global>> addressL3Outs space>> allocated{{your_L3Outs}} to>> theRoute localMap AS. ipfor prefix-listimport PREFIX_FILTERand seqexport 74route deny xcontrol.13.1.0/24 le 32 2. Verify the prefix list has been applied to all external BGP peers. asNavigate shownto inTenants the>> example{{your_Tenant}} below: router>> bgpNetworking &ltAS_number>> neighborL3Outs &ltpeer_IP>> prefix-list{{your_L3Outs}} LOCAL_AS_PREFIX_FILTER>> outExternal EPGs >> Policy >> General >> Route Control Profile. If the ACI is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.

Fix text

Configure the router to reject outbound route advertisements for any prefixes belonging to the local AS. Use a prefix list containing the local AS prefixes and apply it as an outbound filter on the BGP neighbor configuration,. 1. asNavigate shownto inTenants the>> following{{your_Tenant}} examples>> Networking >> L3Outs >> {{your_L3Outs}} >> Route Map for import and export route control. 12. AddThen apply that route MAP to the prefixexternal filterEPG listin thosethe prefixesfollowing belonginglocation: toTenants the>> local{{your_Tenant}} autonomous>> system.Networking apci1(config)#>> ipL3Outs prefix-list>> LOCAL_AS_PREFIX_FILTER{{your_L3Outs}} seq>> 70External denyEPGs &ltlocal_AS_prefixes>> Policy >> General >> Route Control Profile. 2.Note: ApplyAn thealternative prefixto listroute filtermaps outboundis to eachuse externalsubnets BGPunder neighbor. apci1(config)#the routerExternal bgpEPG &ltAS_number>with neighborthe &ltpeer_IP>correct prefix-listroute LOCAL_AS_PREFIX_FILTERControls assigned as discussed in vendor documentation (Reference the L3 out white paper).

Discussion

Advertisement of routes by an autonomous system for networks that do not belong to any of its customers pulls traffic away from the authorized network. This causes a denial of service (DoS) on the network that allocated the block of addresses and may cause a DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the GIG IP core could redistribute IGP routes into BGP, thereby leaking internal routes. An alternative to route maps is to use subnets under the External EPG with the correct route Controls assigned as discussed in vendor documentation (Reference the L3 out white paper).

V-272063 in V1R2

Check text

By default, Cisco ACI enforces the first AS in the AS_PATH attribute for all route advertisements. Review the configuration to verify the default BGP configuration on the ACI fabric. 1. isNavigate doesto notTenants explicitly>> state:{{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> Route Map for import and export route control. no2. enforceApply first-asthat route MAP to the external EPG in the following location: Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> External EPGs >> Policy >> General >> Route Control Profile. If the device is not configured to reject updates from peers that do not list their AS number as the first AS in the AS_PATH attribute, this is a finding.

Fix text

Configure the device to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute. Remove1. Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> Route Map for import and export route control. 2. Apply that route MAP to the configurationexternal itemEPG "noin enforcethe first-as"following location: Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> External EPGs >> Policy >> General >> Route Control Profile. Note: An alternative to route maps is to use subnets under the External EPG with the correct route Controls assigned discussed in vendor documentation (Reference the L3 out white paper).

Discussion

Verifying the path a route has traversed will ensure the IP core is not used as a transit network for unauthorized or possibly even internet traffic. All autonomous system boundary routers (ASBRs) must ensure updates received from eBGP peers list their AS number as the first AS in the AS_PATH attribute. CiscoAn ACIalternative BGPto usuallyroute enforcesmaps is to use subnets under the "first-External EPG with the correct route Controls assigned as" rulediscussed byin defaultvendor documentation (Reference the L3 out white paper).

V-272064 in V1R2

Check text

1. Review the network's multicast topology diagram. 2. Review the switch configuration to verify only the PIM interfaces as shown in the multicast topology diagram are enabled for PIM. asNavigate shownto inTenants the>> example{{your_Tenants}} below: Example: configure>> terminal interfaceNetworking Ethernet1/1 ip>> pimVRFs >> {{Your_VRF}} >> multicast >> Configuration >> PIM settings >> Reserved Route MAP. If a multicast interface is required to support PIM and it is not enabled, this is a finding.

Fix text

FromConfigure the CLI,relevant usemulticast "ipenabled pim"interfaces withinby configuring a route map on the interfacePIM configurationsettings for the VRF on the relevantGUI. Navigate to Tenants >> {{your_Tenants}} >> Networking >> VRFs >> {{Your_VRF}} >> multicast enabled>> interfaces. Example: configureConfiguration terminal interface>> Ethernet1/1 ipPIM pimsettings >> Reserved Route MAP.

V-272069 in V1R2

Check text

View the configuration to check for PIM compliance. APIC1(config)#show running-configurationon pim Example: ipthe access-listrelevant extended PIM_REGISTER_FILTER deny ipmulticast anyenabled 232.0.0.0interfaces 0.255.255.255 permitby ipconfiguring hosta 10.1.2.6route any permitmap ipon hostthe 10PIM settings for the VRF on the GUI.1.2.7 any deny ipNavigate anyto any ipTenants pim>> accept-register{{your_Tenants}} list>> PIM_REGISTER_FILTERNetworking >> VRFs>> {{Your_VRF}} >> multicast >> Configuration >> PIM settings >> Reserved Route MAP. If the RPCISCO routerACI peering with PIM-SM routers is not configured with a policy to block registration messages for any undesirable multicast groups and sources, this is a finding.

Fix text

Configure an access list on the rendezvous point (RP) to explicitly deny PIM register messages originating from specific source-group combinations, effectively blocking the propagation of those multicast streams across the network; access this configuration. Configure through the APIC'srelevant CLImulticast usingenabled theinterfaces "accept-register"by commandconfiguring witha theroute desiredmap accesson list applied to the RP.PIM Specifysettings groupfor or group and source addresses with the matchVRF ipon multicast command. Perform the following for each interface that uses IP multicast: 1GUI. CreateNavigate anto extendedTenants access>> list{{your_Tenants}} with>> theNetworking desired>> filter criteria. # ip access-list extended &ltaccess-list-nameVRFs> permit> ip{{Your_VRF}} &ltsource-ip> &ltmulticast-group> &ltoptional:multicast protocol and port>> ...Configuration (add other allowed source-group combinations) deny ip any &ltundesirable-multicast-group>> 2. Access the PIM configurationsettings mode>> onReserved theRoute RPMAP. APIC1 (config-if)# ip pim sparse-mode 3. Apply the access list. # accept-register &ltaccess-list-name>

V-272073 in V1R2

Check text

View the configuration to verify PIM compliance. APIC1(config)#showConfigure running-configurationthe pim Example: !relevant ACLmulticast toenabled denyinterfaces specificby multicastconfiguring groups ipa access-listroute extendedmap PIM_JOIN_FILTER denyon ipthe multicastPIM groupsettings 224.0.0.1 denyfor ipthe multicastVRF groupon 224the GUI.0.0.2 permit ipNavigate anyto any !Tenants ACL>> to{{your_Tenants}} the>> L3OutNetworking interface>> onVRFs the>> border{{Your_VRF}} leaf>> switch interfacemulticast L3Out_to_External ip>> access-groupConfiguration PIM_JOIN_FILTER>> inPIM settings >> Reserved Route MAP. If the RPCisco ACI is not configured to filter join messages received from the DR for any undesirable multicast groups, this is a finding.

Fix text

Configure ACLs on the border leaf switches that act as the PIM DRs, specifically targeting the multicast group addresses to be blocked. This essentially prevents unwanted multicast traffic from entering the fabric by filtering the Join messages at the entry point. 1.Configure Createthe anrelevant ACLmulticast toenabled denyinterfaces specificby multicastconfiguring groups. ipa access-listroute extendedmap PIM_JOIN_FILTER denyon ipthe multicastPIM groupsettings 224.0.0.1 denyfor ipthe multicastVRF groupon 224the GUI.0.0.2 permit ipNavigate anyto any 2.Tenants Apply>> the{{your_Tenants}} ACL>> toNetworking the>> L3OutVRFs interface>> on{{Your_VRF}} the>> bordermulticast leaf>> switch. interfaceConfiguration L3Out_to_External ip>> access-groupPIM PIM_JOIN_FILTERsettings in>> Reserved Route MAP.

V-272074 in V1R2

Check text

Verify the CallACI Homeconfiguration featureunder is disabled: 1. Navigate to the "Admin" section>> inExternal theData GUI,Collectors then expand All >> Communicationmonitoring ManagementDestinations >> Callsmart Home. 2.callhome/callhome Inis thenot General tabsetup, verifyand thethat Adminno StateIntersight configuration is setsetup toat "Off"System >> System Settings >> Intersight Connectivity. If the Call Home feature is configured to send messages to unauthorized individuals such as Cisco TAC, this is a finding.

Fix text

Disable the Call Home feature: 1. Navigate to the "Admin" section>> inExternal theData GUI,Collectors then expand All >> Communicationmonitoring ManagementDestinations >> Callsmart Homecallhome. 2. In the General tab, set the Admin State to "Off". 3. Click "Save".

V-272076 in V1R2

Check text

Verify PSKs are configured: apic1(config-cloudsec)#. showNavigate cloudsecto summaryTenants >> {{your_tenants}} >> Networking >> L3Outs >> {{your_L3Out}} >> Logical Node Profiles >> {{your_node_profile}} >> Logical Interface Profiles >> {{your_interface_Profile} >> OSPF|EIGRP|BGP Interface profile. If PSKs are not configured to use encryption for routing protocol authentication, this is a finding.

Fix text

Configure one or more PSKs used to generate encryption keys for the routing protocol authentication process: apic1(config)#. templateNavigate cloudsecto default apic1(config-cloudsec)#Tenants sakexpirytime__&ltduration>__ apic1(config-cloudsec)#> pskindex__&ltpsk-index{{your_tenants}} >__ apic1(config-cloudsec)#> pskstring__&ltpsk-stringNetworking >__> L3Outs >> {{your_L3Out}} >> Logical Node Profiles >> {{your_node_profile}} >> Logical Interface Profiles >> {{your_interface_Profile} >> OSPF|EIGRP|BGP Interface profile.

V-272077 in V1R2

Check text

If EIGRP, RIP, and IS-IS protocols are used (these protocols only support MD5 authentication), this is a finding. Review the switch configuration using the show bgp and show ospf commands to verify BGP and OSPF. TheNavigate configurationto shouldTenants be>> similar{{your_tenants}} to>> theNetworking example>> below: Key-ChainL3Outs bgp_keys>> tcp {{your_L3Out}} Key>> 1Logical --Node textProfiles 0>> "070e234f" send-id{{your_node_profile}} 2 recv-id>> 2 cryptographic-algorithmLogical hmac-sha256 sendInterface lifetimeProfiles 3600>> {{your_interface_Profile}>> OSPF|EIGRP|BGP Interface profile. If authentication protocols that affectsaffect the routing or forwarding tables are not configured to use key chain (TCP-AO) authentication with 180 maximum lifetime, this is a finding.

Fix text

Configure authentication for every protocol that affects the routing or forwarding tables to use key chain (TCP-AO) authentication. UseConfigure the following command on all supported control plane protocols. This typically includes protocols such as BGP and OSPF. The following are examples. 1.Navigate Createto aTenants TCP-AO key chain. apic1(config)# ip tcp ao key chain &ltKEY_CHAIN_NAME>> apic1(config)#{{your_tenants}} key &ltKEY-ID> apic1(config-tcpkey> chain-tcpkey)#Networking key-string &ltKEY> apic1(config-tcpkey> chain-tcpkey)#L3Outs recv-id &ltID> apic1(config-tcpkey> chain-tcpkey)#{{your_L3Out}} send-id &ltID> apic1(config-tcpkey> chain-tcpkey)#Logical send-lifetimeNode &ltvalueProfiles in seconds> apic1(config-tcpkey> chain-tcpkey)#{{your_node_profile}} recv-lifetime &ltvalue in seconds> apic1(config-tcpkey> chain-tcpkey)#Logical cryptographic-algorithmInterface hmac-sha256 2.Profiles Configure BGP to use the key chain for authentication. apic1(config)# router bgp &ltAS_NUMBER> apic1(config-router)# neighbor &ltpeer-IP> remote-ao{{your_interface_Profile} &ltKEY-CHAIN-NAME> apic1(config-router)# ao &ltKEY_CHAIN_NAME> 3. Configure OSPF|EIGRP|BGP toInterface use the key chain for authenticationprofile. apic1(config)# interface Ethernet1/1 apic1(config-if)# ip address &ltaddress or range> apic1(config-if)# ip ospf authentication key-chain &ltOSPF_KEY_CHAIN>

Discussion

A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information about the site's network or used to disrupt the network's ability to communicate with other networks. This is known as a "traffic attraction attack" and is prevented by configuring neighbor router authentication for routing updates. However, using clear-text authentication provides little benefit since an attacker can intercept traffic and view the authentication key. This would allow the attacker to use the authentication key in an attack. Since MD5 is vulnerable to "birthday" attacks and may be compromised, routing protocol authentication must use FIPS 198-1 validated algorithms and modules to encrypt the authentication key. This requirement applies to all IPv4 and IPv6 protocols that are used to exchange routing or packet forwarding information; this includes all Interior Gateway Protocols (such as OSPF, EIGRP, and IS-IS) and Exterior Gateway Protocols (such as BGP), MPLS-related protocols (such as LDP), and multicast-related protocols. Satisfies: SRG-NET-000230-RTR-000002, SRG-NET-000230-RTR-000003

CCIs

CCI-000803CCI-000803,CCI-001184

V-272078 in V1R2

Check text

If this review is for the DODIN Backbone, mark as notNot applicableApplicable. ReviewWhen creating a contract, create a Deny statement that looks at all the externalfragmented bits and internaldenies ACLsonly tothose verifypackets. thatReview the routerfollowing istwo configuredlocations: Option 1: Review any standard contract (whitelist) with an explicit deny for the fragment bit to onlycounter allowact specificany managementallows. Tenant and>> controlContracts plane>> Standard >> {{your_Contract}} >> {{your_contract_Subject}} >> Policy >> General >> Filters >> create/ add a deny for ICMP traffic. fromThe specificfilter sourcesentries destinedshould include the following: Ethertype set to itselfIP/ipv6, IP Protocol set to ICMP/ICMPv6, and the Match Only Fragments box checked. 1.Option Navigate2: Review any taboo contract (blacklist) for the fragment bits: Tenant >> ContractContracts >> FilterTaboo >> {{your_Contract}} >> Policy >> General >> {{your_contract_Subject}} >> Filters >> create/ add a deny for ICMP traffic. 2. SelectThe filter entries should include the "Dropfollowing: FragmentedEthertype set to IP/ipv6, IP Protocol set to ICMP"/ICMPv6, filterand the Match Only Fragments box checked3. 3. Verify ICMP and Fragmented are selected to be denied. If all fragmented ICMP packets destined to Cisco ACI IP addresses are not dropped, this is a finding.

Fix text

EnsurePlace thisthe deny rule is placed before any permit rules for ICMP traffic to ensure fragmented ICMP packets are dropped first. When you are creating a contract you would want to create a Deny statement that looks at all the fragmented bits and denies only those packets. There are 2 ways to do this. Option 1: Create a standard contract (whitelist) with an explicit deny for the fragment bit to counter act any allows. Navigate to the following location and configure settings: Tenant >> ContractContracts >> Filter. 2.Standard Create>> or{{your_Contract}} edit>> a{{your_contract_Subject}} filter>> (e.g.,Policy "Drop>> FragmentedGeneral >> Filters >> create/ add a deny for ICMP") traffic. 3.The Setfilter Matchentries toshould include the following: Ethertype set to IP/ipv6, IP Protocol: set to ICMP/ICMPv6, and the Match Only Fragments box checked. Fragmentation Option 2: "Fragmented"Create a taboo contract (blacklist) for the fragment bits by navigating to the following location: 4Tenant >> Contracts >> Taboo >> {{your_Contract}} >> Policy >> General >> {{your_contract_Subject}} >> Filters >> create/ add a deny for ICMP traffic. Set The Actionfilter entries should include the following: Ethertype set to "Deny"IP/ipv6, IP Protocol set to ICMP/ICMPv6, and the Match Only Fragments box checked.

Discussion

Fragmented ICMP packets can be generated by hackers for denial-of-service (DoS) attacks such as Ping O' Death and Teardrop. It is imperative that all fragmented ICMP packets are dropped.

V-272079 in V1R2

Check text

UseTo setup the "show"OOB command to verifylimit thewhat contractdevices/ isnetworks attachedcan toaccess theit, managementuse interfacethe andcontracts thatin onlythe permittedfollowing management traffic is allowed.settings: IfTenant the>> routerTenant doesmgmt not>> restrictNode trafficManagement thatAddresses ingresses>> andStatic egressesNode theManagement management interface, this is a finding.Addresses 1.Tenant Verify>> theTenant OOBmgmt contract>> isNode configuredManagement toEPGs explicitly>> permitOut-of-Band onlyEPG management traffic.default apic1(config)#Tenant contract>> MGMT_OOB apic1(config)#Tenant filtermgmt ingress apic1(config)#>> protocolExternal icmp apic1(config)#Management protocolNetwork tcpInstance portProfiles 22,>> 80, 443{{YourInstanceProfile}} apic1(config)# protocol udp port 68, 67 apic1(config)#If filterthe egressCisco apic1(config)#ACI protocolis icmp apic1(config)#not protocolconfigured tcpto portonly 22,permit 80,management 443 apic1(config)#traffic protocolthat udpingresses portand 68,egresses 67 2. Verify the contractOOBM attached to the OOB Interface. apic1(config)# interface, &ltleaf_switch_name>/&ltoob_interface_number>this apic1(config-if)#is contracta mgmt_oobfinding.

Fix text

Create a dedicated "OOB" contract that explicitly permits necessary management protocols on the OOB subnet, then apply this contract to the relevant node management interface. 1. Navigate to the relevant tenant andto createsetup athe newOOB externalto networklimit instancewhat profiledevices/ fornetworks thecan OOBaccess subnetit. apic1(config)#Utilize tenantcontracts &lttenant_name>in 2. Create the OOBfollowing contract.settings: apic1(config)#Tenant contract>> MGMT_OOB apic1(config)#Tenant filtermgmt ingress apic1(config)#>> protocolNode icmp apic1(config)#Management protocolAddresses tcp>> portStatic 22,Node 80,Management 443Addresses apic1(config)# protocol udp port 68, 67 apic1(config)#Tenant filter>> egressTenant apic1(config)#mgmt protocol>> icmp apic1(config)#Node protocolManagement tcpEPGs port>> 22,Out-of-Band 80,EPG 443default apic1(config)# protocol udp port 68, 67 3.Tenant Apply>> theTenant Contractmgmt to>> theExternal OOBManagement Interface. apic1(config)#Network interfaceInstance &ltleaf_switch_nameProfiles >/&ltoob_interface_number> apic1(config-if)# contract mgmt_oob{{YourInstanceProfile}}

Discussion

To configure OOB management on an ACI fabric, use the Application Policy Infrastructure Controller (APIC), which is the central management point for the network. When setting up OOB access, a specific "contract" that controls which traffic is allowed on the OOB management network is typically defined. All management traffic is immediately forwarded into the management network,; it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.

V-272081 in V1R2

Check text

Verify secure communications and message authentication on all control plane protocols is configured. 1. Verify Secure Communication: - Navigate to Fabric >> Fabric Policies >> Pod Policies >> PoliciesPod >> Management. Access. - Verify SSH and SSL protocols are enabled for APIC management. 2. Verify Message Authentication: - Navigate to Fabric >> Fabric Policies >> Pod Policies >> Policies >> Interconnect. - Verify IPsec for FI communication is enabled. 3. Verify OpFlex for Southbound Communication is set to TLS. 4. Navigate to Fabric >> Fabric Policies >> Pod Policies >> Policies >> Trust Domain. - Verify the Trust Domain is enabled and configured. Verify BGP neighbor authentication keys on Cisco ACI border leaf switches are configured to use a different authentication key for each AS peer. 1. Navigate to Tenants >> All Tenants >> your_tenant >> Networking >> L3Outs >> your_l3out. 2. Expand Logical Node Profiles >> node_profile. 3. Select Logical Interface Profiles >> interface_profile (where the BGP peering is configured). 4. Within the Logical Interface Profile, review each BGP Peer Connectivity profiles for each individual BGP peer. 5. In the BGP Peer Connectivity Profile settings, review the Password to verify each peer has a unique password. If message authentication and secure communications is not configured for all control plane protocols, this is a finding.

Fix text

Configure secure communications and message authentication on all control plane protocols. 1. EnableVerify Secure Communication: - Navigate to Fabric >> Fabric Policies >> Pod Policies >> PoliciesPod >> Management. Access. Enable- Verify SSH and SSL protocols are enabled for APIC management. Configure the ports used for SSH and SSL connections as needed. 2. Configure Message Authentication: - Navigate to Fabric >> Fabric Policies >> Pod Policies >> Policies >> Interconnect. - Enable IPsec for FI communication to ensure secure communication between the APIC and the switches. - Configure the IPsec parameters, such as the encryption algorithm and authentication method. 3. Configure OpFlex for Southbound Communication to use TLS: Note: OpFlex is a southbound protocol designed to facilitate communications between the SDN Controller and the switches and routers. 4. Enable Trust Domain: - Navigate to Fabric >> Fabric Policies >> Pod Policies >> Policies >> Trust Domain. - Enable the Trust Domain to ensure that only trusted devices can communicate with the APIC. - Configure the Trust Domain parameters, such as the certificate authority and the trusted devices. To configure BGP neighbor authentication keys on Cisco ACI border leaf switches, using a different authentication key for each AS peer, you need to configure the BGP Peer Connectivity Profile within the L3Out configuration. 1. In the APIC GUI, go to Tenants >> All Tenants >> your_tenant >> Networking >> L3Outs >> your_l3out. 2. Expand Logical Node Profiles >> node_profile. 3. Select Logical Interface Profiles >> interface_profile (where the BGP peering is configured). 4. Within the Logical Interface Profile, locate or create the BGP Peer Connectivity Profile associated with the peer you want to authenticate. Edit or create a profile. 5. In the BGP Peer Connectivity Profile settings: - Remote Autonomous System Number: Specify the AS number of the peer. - Password: Enter the authentication key/password for this specific peer. - Confirm Password: Re-enter the same password. - Other settings, such as peer controls, address type controls, and route control profiles, can be adjusted as needed for yourthe BGP peering configuration. 6. Repeat the steps for each peer youthat needmust tobe configureconfigured. Create separate BGP Peer Connectivity profiles for each individual BGP peer, with different passwords for each. Ensure the peer devices have the matching authentication key/password configured for successful BGP peering.

V-272082 in V1R2

Check text

Review the router configuration and verify theIP ip mask-reply commandreplies ishave notbeen enableddisabled on anyall external interfaces asusing shownany inof the examplefollowing belowoptions: apic1(config)#1. interfaceFor Ethernet0/1contracts with external L3out traffic, verify specific allow statements do not allow any ICMP type 17 packets. apic2. Verify the Filter for ICMP Type 17 and confirm that every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (config-ifblacklist)# nothat ipexplicitly icmpdenies mask-replyICMP type 17. If theIP ip mask-reply commandreplies isare configurednot disabled on anyall external interfaceinterfaces, this is a finding.

Fix text

Disable ipIP mask-replymash replies on all external interfaces asusing shownany below:of the following options. apic1(config)#1. interfaceACI Ethernet0/1is a whitelist model by default, so all traffic is denied by default. When contracts are added, users can be specific with the allow statements to avoid allowing any ICMP type 17 packets. apic2. Configure the filter for ICMP Type 17 and confirm every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (config-ifblacklist)# nothat ipexplicitly icmpdenies mask-replyICMP type 17.

V-272087 in V1R2

Check text

Verify the BGP configuration for each tenant: ipTenants route>> protocol{{your_Tenant}} BGP View>> theNetworking BGP>> peerL3Out configuration>> maximum{{your_l3out}} prefix>> value: neighborLogical 10Node Profiles >> {{your_Logical_node_Profile}} >> Logical Interface Profiles >> {{your_logical_interface_profile}} >> BGP peer x.0x.0x.1x maximum-prefix>> nnnnnnnPolicy >> BGP Peer Prefix Policy. If the router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix de-aggregation attacks, this is a finding.

Fix text

Configure the router to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks as shown in the example below: For each BGP peer, usenavigate theto commandTenants "neighbor>> &ltpeer-ip{{your_Tenant}} >> maximum-prefixNetworking &ltnumber>> ofL3Out prefixes>"> {{your_l3out}} >> Logical Node Profiles >> {{your_Logical_node_Profile}} >> Logical Interface Profiles >> {{your_logical_interface_profile}} >> BGP peer x.x.x.x >> Policy >> BGP Peer Prefix. Create a policy within the BGP configuration section, where &ltpeer-ip> is the IP address of the BGP peer and &ltnumber of prefixes> is the desired maximum prefix limit to be set; the default maximum prefix limit is typically 20,000 prefixes.

Discussion

The effects of prefix de-aggregation can degrade router performance due to the size of routing tables and also result in black-holing legitimate traffic. Initiated by an attacker or a misconfigured router, prefix de-aggregation occurs when the announcement of a large prefix is fragmented into a collection of smaller prefix announcements. Maximum prefix limits on peer connections combined with aggressive prefix-size filtering of customers' reachability advertisements will effectively mitigate the de-aggregation risk. BGP maximum prefix must be used on all eBGP routers to limit the number of prefixes that it should receive from a particular neighbor, whether customer or peering AS. Consider each neighbor and how many routes theythat shouldwill be advertisingadvertised and set a threshold slightly higher than the number expected.

V-272088 in V1R2

Check text

Review the configuration of the RP to verify it is rate limiting the number of PIM register messages. tenantVerify &lttenant_name>the prefix-listL3Out ALLOW_SUBNET ipoption prefixfor 10Route Control Enforcement Import is checked.0.0.0/24 permit match-ruleNavigate filter_ruleto matchTenants prefix>> allow_subnet tenant{{your_Tenant}} &lttenant_name>> l3extInstPNetworking &ltl3extInstP_name>> route-profileL3Out FILTER_PROFILE>> {{your_l3out}} >> Policy >> Main >> Route Control Enforcement. If the router is not configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer, this is a finding.

Fix text

Configure the router to limit the prefix size on any route advertisement to /24 or the least significant prefixes issued to the customer. Create a "match rule" within a "route profile" by specifying a prefix list, whichto isbe then applied to the desired L3Out (external routed network) to filter BGP routes based on the prefixes defined in the list. The route profile is applied to a specific L3Out (external routed network) to control which prefixes are advertised or accepted from external networks. 1. ConfigureRefer ato prefixthe listL3 toout rejectdocumentation anyon prefixsetting thatup isroute longermaps thanor /24. tenantusing &lttenant_name>the prefix-listimport ALLOW_SUBNET ipcontrols prefixon 10.0.0.0/24the permit 2.external CreateEPG asubnets routeon profilethis named "filter_profile"connection. tenantEnsure &lttenant_name>on route-profilethe FILTER_PROFILE match-ruleL3Out filter_rulethe matchoption prefixfor allow_subnetRoute Control Enforcement Import is checked. 3.Tenants Apply>> the{{your_Tenant}} route>> profileNetworking to>> an L3Out. tenant &lttenant_name>> l3extInstP{{your_l3out}} &ltl3extInstP_name>> route-profilePolicy FILTER_PROFILE>> Main >> Route Control Enforcement

V-272089 in V1R2

Check text

Review the PIM configuration: Tenants of>> the{{your_Tenant}} RP>> toNetworking verify>> thatVRF it>> is{{your_VRF}} rate>> limitingMulticast the>> numberConfiguration of>> PIMPattern registerPolicy messages: tenant &lttenant-name> vrf &ltvrf-name> ipunder pimRegister registerTraffic ratePolicy limitlook 10 for Max Rate (packets per second) If the RP router is not limitingconfigured to filter PIM register messages, rate limit the number of PIM register messages, and accept multicast packets only from known peers, this is a finding.

Fix text

Configure the RPswitch to filter PIM register messages, rate limit the number of PIM register messages, and accept multicast packets only from known peers. Use the command "ip pim register-rate-limit &ltrate>", where &ltrate> specifies the desired maximum number of register messages per second allowed to be sent. Navigate to the following location to configure: apic(config)#Tenants tenant>> &lttenant-name{{your_Tenant}} > apic(config)# vrf> &ltvrf-nameNetworking > > apic(config)#VRF ip>> pim{{your_VRF}} register>> rateMulticast limit>> 10Configuration >> Pattern Policy >> under Register Traffic Policy look for Max Rate (packets per second)

Discussion

When a new source starts transmitting in a PIM Sparse Mode network, the designated router (DR) will encapsulate the multicast packets into register messages and forward them to the RP using unicast. This process can be taxing on the CPU for both the DR and the RP if the source is running at a high data rate and there are many new sources starting at the same time. This scenario can potentially occur immediately after a network failover. The rate limit for the number of register messages should be set to a relatively low value based on the known number of multicast sources within the multicast domain. Satisfies: SRG-NET-000362-RTR-000120

V-272091 in V1R2

Check text

Review the configuration to verify it is limiting the number of mroute states via IGMP or MLD. Verify IGMP limits have been configured globally or on each host-facing interface via the ip igmp limit command as shown in the example: interface GigabitEthernet0/0 ip igmp limit nn Review the relevant Bridge Domain (BD) or interfaceconfiguration. Verify it is configured to limit the number of multicast routes (mroute states) generated by IGMP or MLD reports. tenantTenants &lttenant_name>> apic(config-tenant)# bridge-domain{{your_Tenant}} &ltBD_name> apic(config-bd)#> interfaceNetworking &ltinterface_name>> apic(config-if)#Bridge ipDomain mroute>> limit{{your_Bridge_Domain}} &ltmaximum_mroute_count>> Policy >> General >> IGMP Policy >> set the Maximum Multicast Entries If the ACI is not limiting multicast requests via IGMP or MLD on a global or interfaces basis, this is a finding.

Fix text

Configure a global or interface basis to limit the number of mroute states resulting from IGMP or MLD membership reports. NavigateTenants to>> the{{your_Tenant}} specific>> BDNetworking or>> interfaceBridge settingsDomain within>> the{{your_Bridge_Domain}} APIC>> configuration.Policy Use>> theGeneral CLI>> commandIGMP "ipPolicy igmp limit &ltnumber>"> inset global configuration mode, which sets a global limit on the number of mroute states allowed across the entire fabric. This limit cannot be configured on a per interface basis in ACI. To limit the number of mroute states created on a BD or interface by MLD reports on a Cisco APIC, configure the "Maximum Multicast Entries" parameter within the BD or interface settings. apic# Note: configureThis terminalsetting apic(config)#is ipused igmpto limit 100 orthe apic(config)#intmroute g0/0 apic(config-if)#ipstates igmpfor limit 2 On the relevant BD or interface, limitcreated the number of multicast routes (mroute states) generated by IGMP or MLD reports. NavigateDefault tois thedisabled, specificno BD and interface where the mroute limit is to be setenforced. apic(config)#Valid tenantrange &lttenant_name>is apic(config1-tenant)# bridge-domain &ltBD_name> apic(config-bd)# interface &ltinterface_name> apic(config-if)# ip mroute limit &ltmaximum_mroute_count> Note: Monitor multicast traffic on the network and adjust the "ip mroute limit" value as needed to balance performance and resource usage4294967295.

Discussion

Limiting mroute states helps prevent excessive multicast traffic flooding on the network by controlling the number of multicast groups a segment can join. By limiting multicast routes, the APIC can better manage its internal resources and prevent potential performance issues due to excessive multicast traffic. Depending on the ACI configuration, set a global IGMP state limit whichthat would apply across all interfaces, or it may be necessary to configure limits on individual interfaces.

V-272092 in V1R2

Title

Cisco ACI must be configured toso enable the GeneralizedBGP TTLneighbor Securityis Mechanismdirectly (GTSM)connected forand will not connect a BGP sessionssession to a directly connected neighbor device's loopback address.

Check text

Review the BGP configuration to verify that TTL security has been configured forto eachthe externaldefault neighborsettings. Navigate asto shownTenants in>> {{your_Tenant}} >> Networking >> L3Out >> {{your_l3out}} >> Logical Node Profiles >> {{your_Logical_node_Profile}} >> Logical Interface Profiles >> {{your_logical_interface_profile}} >> BGP peer x.x.x.x >> Policy. Verify the examplefollowing belowin the policy: policyDisable BGP_Peer_Profile noConnected neighborCheck 10.1.1.1is ebgp-multihopunmarked neighborEBGP 10.1.1.1Multihop ttl-securityTTL = 1 If the Cisco ACI is not configured to use GTSM for all Exterior BGP peering sessions, this is a finding.

Fix text

ConfigureIf TTLACI securityis ondetermined allto externalbe BGPconfigured neighborsdifferently asthan shownthe indefault thesettings, examplereconfigure below: 1.to Accessdefault settings by performing the actions on the BGP Peerconnectivity Connectivityprofile Profile(path below). policy BGP_Peer_Profile 2.Navigate Disableto MultihopTenants for>> external{{your_Tenant}} neighbor. no>> neighborNetworking 10>> L3Out >> {{your_l3out}} >> Logical Node Profiles >> {{your_Logical_node_Profile}} >> Logical Interface Profiles >> {{your_logical_interface_profile}} >> BGP peer x.1x.1x.1x ebgp-multihop>> Policy. 3.Reset Enablethe TTLfollowing securityin on the neighbor.policy: neighborDisable 10.1.1.1Connected ttl-securityCheck is unmarked EBGP Multihop TTL = 1

Discussion

Generalized Time To Live Security Mechanism (GTSM) is designed to protect a router's IP-based control plane from denial-of-service (DoS) attacks. Many attacks focused on CPU load and line-card overload can be prevented by implementing GTSM on all Exterior Border Gateway Protocol speaking routers. GTSMACI ismitigates basedthis onrisk thein facta thatdifferent theway, vastas majoritycurrently ofthere controlis planeno peeringoption isfor establishedTTL-security betweenor adjacentGTSM routerssupport; however, that isACI, theby Exteriordefault, Borderis Gatewaysetup Protocolto peersvalidate arethat eitherthe betweenBGP connectingneighbor interfacesis ordirectly betweenconnected loopbackand interfaces.will Sincenot TTLeven spoofingconnect is considered nearly impossible, a mechanismBGP basedsession onto an expected TTL value provides a simpledirectly andconnected reasonablyneighbor robustdevices defenseloopback from infrastructure attacks based on forged control plane trafficaddress.

V-272094 in V1R2

Title

The Cisco ACI multicast must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups and only from sources that have been approved by the organization.

Check text

This requirement is only applicable to Source Specific Multicast (SSM) implementation. This requirement is not applicable to Any Source Multicast (ASM), since the filtering is being performed by the rendezvous point switch. Review the configuration of the designated router (DR) to verify that it is filtering IGMP or MLD Membership Report messages, allowing hosts to join only those groups that have been approved. Navigate to the following location to review the settings: Tenants >> {{your_Tenant}} >> Networking >> Bridge Domain >> {{your_Bridge_Domain}} >> Policy >> General If the Cisco ACI is not filtering IGMP or MLD Membership Report messages, this is a finding.

Fix text

Configure "IGMP Snooping". and Note: createThere accessare groupsa thatnumber defineof whichmethods multicastfor groupsmeeting arethis permittedrequirement; onhowever, specificit ports.is Forrecommended filteringto IPv6 multicast traffic (MLD), use similarfilter commandsDestinations withvia thecontracts "mld"and keywordPIM insteaddestination offilter "igmp". 1.route Navigatemaps towhen enabling the relevantBridge bridge domain, interfaceto orparticipate VLANin and enable IGMP snoopingand usingMLD the commandSnooping. apic(config)#All interfacebut &ltinterface_name> apicthe (config-if)#contract ipsettings igmpcan snooping orbe apic(config)# bd BD-1 apic(config-bd-1)#found ipat igmp snooping 2. Define a new access group with a name and specify the permittedfollowing multicastGUI groups.path: apic(config)# ipTenants igmp>> snooping{{your_Tenant}} vlan &ltvlan_id>> access-groupNetworking &ltaccess_group_name>> apic(config)#Bridge access-groupDomain &ltaccess_group_name>> apic(config)#{{your_Bridge_Domain}} permit ip multicast &ltmulticast_group_address>> 3.Policy Navigate to the specific port configuration where the filter is to be applied. apic(config)# ip igmp snooping access-group &ltgroup-name>> to associate the created access group with the port. apic(config)# interface Ethernet1/1 apic(config-if)# ip igmp snooping access-group allowed-groupsGeneral

Discussion

Real-time multicast traffic can entail multiple large flows of data. Large unicast flows tend to be fairly isolated (i.e., someoneoccasional doing a file download here or theredownloads), whereas multicast can have broader impact on bandwidth consumption, resulting in extreme network congestion. Hence, it is imperative that there is multicast admission control to restrict which multicast groups hosts are allowed to join via IGMP or MLD. Satisfies: SRG-NET-000364-RTR-000115

V-272095 in V1R2

Check text

Review the switch configuration to verify a loopback address has been configured. tenantTenants &lttenant-name>> networking{{your_Tenant}} l3out>> &ltl3out-nameL3Out >> protocol{{your_l3out}} >> Logical Node Profiles >> {{your_Logical_node_Profile}} >> Policy >> BGP neighborPeer 10.1.1.1Connectivity update-sourceadd Loopback0your loopback If the switch does not use its loopback address as the source address for all iBGP sessions, this is a finding.

Fix text

Configure the BGP configuration for the relevant L3Out to use the switch's loopback address as the source address for all iBGP peering. This configures the switch to use the loopback interface as the source IP for all BGP updates sent to the specified peer. tenant &lttenant-name Navigate to Tenants >> networking{{your_Tenant}} l3out>> &ltl3out-nameNetworking >> L3Out >> {{your_l3out}} >> Logical Node Profiles >> {{your_Logical_node_Profile}} >> Policy >> Node. protocol- Double click the Node(Leaf) and look for the option to select "use Router ID as loopback" or set the loopback address to which to build the BGP connection and unselect "use router ID as Loopback". neighbor After &ltpeer-ipsetting the loopback address, navigate to Tenants >> update-source{{your_Tenant}} Loopback0>> L3Out >> {{your_l3out}} >> Logical Node Profiles >> {{your_Logical_node_Profile}} >> Policy >> BGP Peer Connectivity. Add the loopback.

V-272098 in V1R2

Check text

Review the router configuration to ensure FEC0::/10 IP addresses are not defined. apic1(config)Tenants >> {{your_Tenant}} >> Networking >> VRF >> {{your_VRF}} >> Operational >> Route Table >> IPV6 Routes and Tenants >> {{your_Tenant}} >> Networking >> VRF >> {{your_VRF}} >> Operational >> Client Endpoints This will display all IPV6 address in this VRF and on which leaf they reside. If the CLI is preferred, the command is as follows when run from the APIC: fabric {{node_ID}} show ipv6 interface gigabitethernetbrief or 0/0/0from each node: show ipv6 interface brief If IPv6 site local unicast addresses are defined, this is a finding.

Fix text

Delete unauthorized addresses. Configure the IPv6 addresses on the ACI fabric's leaf switches and virtual network segments (bridge domains) within the desired tenant to use site local unicast addresses. ipv6Tenants unicast-routing>> {{your_Tenant}} >> Networking >> VRF >> {{your_VRF}} >> Operational >> Route Table >> IPV6 Routes interface Remove gigabitethernetunauthorized 0/0/0addresses. Remove unauthorized addresses from the Client Endpoints list. ipv6 Tenants address>> 2001:DB8:c18:1::/64{{your_Tenant}} eui-64>> Networking >> VRF >> {{your_VRF}} >> Operational >> Client Endpoints

V-272101 in V1R2

Check text

Review the SSP and the ACI configuration to verify logical separation using EPGs, bridge domains, and/or tenants is configured. There Theare followinga large number of places to validate that each EPG is using an exampleorganizational ofdefined anVLAN. That would be dependent on the VLAN pool associated with the Physical/ VMM Domains that the EPG: is using. apic1(config)#To leafcheck 1017the Physical domain in the GUI, use the following path: apic1(config-leaf)#Tenants interface>> ethernet{{your_Tenant}} 1/13>> Application Profiles >> {{your_application_profile}} >> Application EPGs >> {{your_EPG}} > Domains apic1(config-leaf-if)# After vlan-checking the domain, membercheck dom1the VLAN pool on the physical domains in the GUI: apic1(config-leaf-if)#Fabric switchport>> trunkAccess allowedPolicies >> Physical and External Domains >> Physical Domains >> {{your_domain}} For VMM Domain vlan 20pools, tenantcheck t1the applicationfollowing AP1GUI epglocation: EPG1 Virtual Networking >> VMware >> {{your_VMM_Domain}} >> Policy >> General If organization-defined alternate communication paths for system operations organizational command and control have not been established, this is a finding.

Fix text

Configure logical separation using EPGs, bridge domains, and/or tenants in accordance with the SSP. TheThere followingare isa anlarge examplenumber of anspots EPG: 1.to Configurevalidate athat VLANeach domain. Example: apic1(config)#EPG vlan-domainis dom1 apic1(config-vlan)#using vlanan 10-100 2organizational defined VLAN. CreateThat awould tenant. Example: apic1#be configure apic1(config)#dependent tenanton t1 3.the CreateVLAN apool privateassociated networkwith the Physical/VRF. Example: apic1(config-tenant)# vrfVMM contextDomains ctx1 apic1(config-tenant-vrf)#that exitthe EPG is using. 41. CreateEdit or create a bridgephysical domain. Example in the GUI using the following path: apic1(config-tenant)#Tenants bridge-domain>> bd1 apic1(config-tenant-bd)#{{your_Tenant}} vrf>> memberApplication ctx1 apic1(config-tenant-bd)#Profiles exit>> {{your_application_profile}} >> Application EPGs >> {{your_EPG}} > Domains 52. Create ana applicationVLAN profilepool andon anphysical applicationdomains EPG. Examplein the GUI: apic1(config-tenant)#Fabric application>> AP1 apic1(config-tenant-app)#Access epgPolicies EPG1 apic1(config-tenant-app-epg)#>> bridge-domainPhysical memberand bd1External apic1(config-tenant-app-epg)#Domains exit apic1(config-tenant-app)#>> exit apic1(config-tenant)#Physical exitDomains >> {{your_domain}} 63. AssociateFor theVMM EPGDomain withvlan apools, specificcreate port. Example: apic1(config)#a leafpolicy 1017 apic1(config-leaf)#at interfacethe ethernetfollowing 1/13 apic1(config-leaf-if)#GUI vlan-domainlocation: member dom1 apic1(config-leaf-if)#Virtual switchportNetworking trunk>> allowedVMware vlan>> 20{{your_VMM_Domain}} tenant>> t1Policy application>> AP1 epg EPG1General

V-272103 in V1R2

Check text

Review the configuration to verify Cisco ACI is configured to employ control plane protection. 1. Verify traffica types have been classified based on importance levels. The following is an example configuration: class-map match-all CoPP_CRITICAL match access-group name CoPP_CRITICAL class-map match-any CoPP_IMPORTANT match access-group name CoPP_IMPORTANT match protocol arp class-map match-all CoPP_NORMAL match access-group name CoPP_NORMAL class-map match-any CoPP_UNDESIRABLE match access-group name CoPP_UNDESIRABLE class-map match-all CoPP_DEFAULT match access-group name CoPP_DEFAULT 2. Review the Access Control ListsPlane Policing (ACLsCoPP) referencedpolicy byis theapplied class maps to determine if the trafficLeaf isand beingor classifiedinterface appropriately.policies The following is an example configurationaccordingly: ipFabric access-list>> extendedAccess CoPP_CRITICALPolicies remark>> ourPolicies control>> planeSwitch adjacencies>> areCoPP critical permit ospf host [OSPF neighbor A] any permit ospf host [OSPF neighbor B] any permit pim host [PIM neighbor A] any permit pim host [PIM neighbor B] any permit pim host [RP addr] any permit igmp any 224.0.0.0 15.255.255.255 permit tcp host [BGP neighbor] eq bgp host [local BGP addr] permit tcp host [BGP neighbor] host [local BGP addr] eq bgp deny ip any any ip accessPre-listFilter extendedfor CoPP_IMPORTANTLeaf permit/ tcpCoPP hostLeaf [TACACS server] eq tacacs any permit tcp [management subnet] 0.0.0.255 any eq 22 permitFabric udp>> hostAccess [SNMPPolicies manager]>> anyPolicies eq>> snmpInterface permit>> udpCoPP host [NTP server] eq ntp any Interface deny ip any any ipVerify access-listL3Out extendedcontracts CoPP_NORMALinclude remark we will want to rate limit ICMP traffic deny icmp any host x.x.x.x fragments permit icmp any any echo permit icmp any any echo-reply permit icmp any any time-exceeded permit icmp any any unreachable deny ip any any ip access-list extended CoPP_UNDESIRABLE remark other management plane traffic that should not be received permit udp any any eq ntp permit udp any any eq snmp permit tcp any any eq 22 permit tcp any any eq 23 remark other control plane traffic not configured on router permit eigrp any any permit udp any any eq rip deny ip any any ip access-list extended CoPP_DEFAULT permit ip any any Note: Explicitly defining undesirable traffic with ACL entries enables the networkCoPP operator to collect statisticspolicy. ExcessiveInspect ARP packets can potentially monopolize route processor resources, starving other important processes. Currently, ARP is the only layer 2 protocol that can be specifically classified using the match protocol command. 3. Review the policy-map toat determine if the traffic is being policed appropriately for each classification. The following is an example configurationlocation: policy-mapTenants CONTROL_PLANE_POLICY>> class{{your_Tenant}} CoPP_CRITICAL>> policeNetworking 512000>> 8000L3Outs conform-action>> transmit{{your_l3out}} exceed-action>> transmitExternal classEPGs CoPP_IMPORTANT>> police{{your_External_EPG}} 256000>> 4000Policy conform-action>> transmit exceed-action drop Contract class CoPP_NORMAL policeIf 128000 2000 conform-action transmit exceed-action drop class CoPP_UNDESIRABLE police 8000 1000 conform-action drop exceed-action drop class CoPP_DEFAULT police 64000 1000 conform-action transmit exceed-action drop 4. Verify that the CoPP policy is enabled. The following is an example configuration: (config)# leaf 101 (config-leaf)# int eth 1/10 (config-leaf-if)# service-policy type control-plane-if Note: Control Plane Protection (CPPr) can be used to filter as well as police control plane traffic destined to the RP. CPPr is very similar to CoPP and has the ability to filter and police traffic using finer granularity by dividing the aggregate control plane into three separate categories: (1) host, (2) transit, and (3) CEF-exception. Hence, a separate policy-map could be configured for each traffic category. If the Cisco router is not configured toon protectall againstLeaf knownand/or types of DoS attacks by employing organization-defined security safeguardsinterfaces, this is a finding.

Fix text

Protect against known types of DoS attacks on the route processor. Implementingby implementing a CoPP policy,. asTo shownmeet inthis the example belowrequirement, isconfigure a best practice method: 1. Configure the ACL'sCOPP specificpolicy trafficon types. Apic1(config)#ipeach access-listdevice, extendedQOS CoPP_CRITICAL Apic1(config-ext-nacl)#remarkto ourensure controlthe planecorrect adjacenciestraffic areis critical Apic1(config-ext-nacl)#permitbeing ospfdropped, hostand x.x.x.xverify any Apic1(config-ext-nacl)#permitall ospfl3 hostouts x.x.x.xhave any Apic1(config-ext-nacl)#permitthe pimcorrect hostcontracts x.x.x.xapplied any Apic1(config-ext-nacl)#permitto pim host xthem.x.x.x any Apic1(config-ext-nacl)#permit igmp any 224.0.0.0 15.255.255.255 Apic1(config-ext-nacl)#permitThese tcppolicies hostmust x.x.x.xbe eqapplied bgp host x.x.x.x Apic1(config-ext-nacl)#deny ip any any Apic1(config-ext-nacl)#exit Apic1(config)#ip access-list extended CoPP_IMPORTANT Apic1(config-ext-nacl)#permit tcp host x.x.x.x eq tacacs any Apic1(config-ext-nacl)#permit tcp x.x.x.x 0.0.0.255 any eq 22 Apic1(config-ext-nacl)#permit udp host x.x.x.x any eq snmp Apic1(config-ext-nacl)#permit udp host x.x.x.x eq ntp any Apic1(config-ext-nacl)#deny ip any any Apic1(config-ext-nacl)#exit Apic1(config)#ip access-list extended CoPP_NORMAL Apic1(config-ext-nacl)#remark we will want to ratethe limitLeaf ICMPand traffic Apic1(config-ext-nacl)#denyor icmpinterface anypolicies host xaccordingly.x.x.x fragments Apic1(config-ext-nacl)#permit icmp any any echo Apic1(config-ext-nacl)#permitCoPP icmpPolicy: any any echo-reply Apic1(config-ext-nacl)#permitFabric icmp>> anyAccess anyPolicies time-exceeded Apic1(config-ext-nacl)#permit>> icmpPolicies any>> anySwitch unreachable Apic1(config-ext-nacl)#deny>> ipCoPP any any Apic1(configPre-ext-nacl)#exit Apic1(config)#ipFilter access-listfor extendedLeaf CoPP_UNDESIRABLE Apic1(config-ext-nacl)#remark/ managementCoPP planeLeaf traffic that should not be received Apic1(config-ext-nacl)#permit udp any any eq ntp Apic1(config-ext-nacl)#permitFabric udp>> anyAccess anyPolicies eq>> snmp Apic1(config-ext-nacl)#permitPolicies tcp>> anyInterface any>> eqCoPP 22Interface Apic1(config-ext-nacl)#permit tcp any any eq 23 Apic1(config-ext-nacl)#remarkQOS: controlSince planethere trafficare notso configuredmany onlocations router Apic1(config-ext-nacl)#permitand eigrpsettings anyrequired any Apic1(config-ext-nacl)#permitfor udpthis anyaspect, anyreference eqthe rip Apic1(config-ext-nacl)#denyQOS ipdocumentation anyto any Apic1(config-ext-nacl)#exit Apic1(config)#ip access-list extendedthese CoPP_DEFAULT Apic1(config-ext-nacl)#permitsettings: ip any any Apic1(config-ext-nacl)#exit 2https://www. Configure class maps referencing each of the ACLscisco. Apic1(config)#classcom/c/en/us/td/docs/switches/datacenter/aci/apic/sw/kb/Cisco-map matchAPIC-all CoPP_CRITICAL Apic1(configand-cmap)#match access-group name CoPP_CRITICALQoS.html Apic1(config-cmap)#class-map match-any CoPP_IMPORTANT Apic1(config-cmap)#matchConfigure access-groupL3Out namecontracts CoPP_IMPORTANT Apic1(config-cmap)#matchinclude protocolthe arp Apic1(config-cmap)#class-mapCoPP match-all CoPP_NORMAL Apic1(config-cmap)#match access-group name CoPP_NORMAL Apic1(config-cmap)#class-map match-any CoPP_UNDESIRABLE Apic1(config-cmap)#match access-group name CoPP_UNDESIRABLE Apic1(config-cmap)#class-map match-all CoPP_DEFAULT Apic1(config-cmap)#match access-group name CoPP_DEFAULT Apic1(config-cmap)#exit 3policy. ConfigureInspect athe policy mapat referencing the configuredfollowing class maps and apply appropriate bandwidth allowance and policing attributes.location: Apic1(config)#policy-mapTenants CONTROL_PLANE_POLICY Apic1(config-pmap)#class>> CoPP_CRITICAL Apic1(config-pmap-c)#police{{your_Tenant}} 512000>> 8000Networking conform-action>> transmitL3Outs exceed-action>> transmit Apic1(config-pmap-c-police)#class{{your_l3out}} CoPP_IMPORTANT Apic1(config-pmap-c)#police>> 256000External 4000EPGs conform-action>> transmit{{your_External_EPG}} exceed-action>> drop Apic1(config-pmap-c-police)#classPolicy CoPP_NORMAL Apic1(config-pmap-c)#police>> 128000 2000 conform-action transmit exceed-action drop Apic1(config-pmap-c-police)#class CoPP_UNDESIRABLE Apic1(config-pmap-c)#police 8000 1000 conform-action drop exceed-action drop Apic1(config-pmap-c-police)#class CoPP_DEFAULT Apic1(config-pmap-c)#police 64000 1000 conform-action transmit exceed-action drop Apic1(config-pmap-c-police)#exit apic(config-pmap-c)#exit apic(config-pmap)#exit 4. Apply the policy map applying the configuration to an interface on the leaf. apic(config)# leaf 101 (config-leaf)# int eth 1/10 (config-leaf-if)# service-policy type CONTROL-PLANE-POLICYContract

V-272104 in V1R2