AOS, when used as a WLAN bridge or controller, must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-266707 | ARBA-NT-001650 | SV-266707r1040611_rule | Medium |
| Description |
| The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. (Refer to SRG-NET-000205-RTR-000012.) Network boundaries, also known as managed interfaces, include, for example, gateways, routers, firewalls, guards, network-based malicious code analysis, and virtualization systems, or encrypted tunnels implemented within a security architecture (e.g., routers protecting firewalls or application gateways residing on protected subnetworks). Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones (DMZs). Methods used for prohibiting interfaces within organizational information systems include, for example, restricting external web traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses. |
| STIG | Date |
| HPE Aruba Networking AOS Wireless Security Technical Implementation Guide | 2024-10-29 |
Details
| Check Text (C-70631r1040609_chk) |
| Verify the AOS configuration with the following command: show ip route verbose If any the management traffic network is not configured with a route to the OOBM gateway, this is a finding. |
| Fix Text (F-70534r1040610_fix) |
| Configure AOS with the following commands: configure terminal ip default-gateway mgmt <A.B.C.D IPv4 address> ipv6 default-gateway mgmt <X:X:X:X::X IPv6 address> write memory |