Network Device Access Control policy

Document Summary:

Revision Number

Process ID

Effective Date

Owner

Approved By

Document Status

Document Label

Version History:

Version Version Reviewed

Type of Change PCR ID Author
Number Date By
V.0.1
V.1.0
V.1.1
V.1.2
V.1.3
Contents

1.0 INTRODUCTION............................................................................................................... 3

2.0 SCOPE.............................................................................................................................. 3

3.0 POLICY............................................................................................................................. 3

4.0 ENFORCEMENT............................................................................................................... 4

5.0 Definitions.......................................................................................................................... 4
 4(5)

1.0 Introduction
This document describes a required minimal security configuration for all network devices
connecting to a production network or used in a production capacity at or on behalf of XXXX.

2.0 Scope
All network devices connected to XXXX production networks are affected. Devices within
internal, secured labs are not affected.

3.0 Policy
Every router must meet the following configuration standards:
 Devices must use TACACS+/RADIUS for all user authentications.
 In case of TACACS+/RADIUS failure scenarios, the device accepts pre-configured local
user accounts.
 The enable password and the local user password on the router must be kept in a secure
encrypted form with in the device and .
 Disallow the following:
o IP directed broadcasts, unreachables & redirects.
o Incoming packets at the router sourced with invalid addresses such as RFC1918
address (in gateway devices connected to internet)
o TCP small services
o UDP small services
o All source routing
o All web services running on device
o Proxy ARP
 Use corporate standardized SNMP community strings.
 Access rules for SNMP and remote access are enabled restricted to Network
Management and monitoring subnets and are to be added as business needs arise.
 The device must be included in the corporate enterprise management and monitoring
systems with a designated point of contact.
 Each device must have the following statement posted in clear view:
UNAUTHORIZED ACCESS IS PROHIBITED. This is a private system operated for
XXXs company business. Authorization is required to use this system. Individuals using
this system without authority, or in excess of their authority, are subject to having all of
their activities on this system monitored and recorded by system personnel. In the
 5(5)

course of monitoring individuals improperly using this system, or in the course of

system maintenance, the activities of authorized users may also be monitored. Anyone
using this system expressly consents to such monitoring and is advised that if such
monitoring reveals possible evidence of criminal activity, system personnel may provide
the evidence of such monitoring to law enforcement officials.

4.0 Enforcement
Any employee found to have violated this policy may be subject to disciplinary action left to
the sole discretion of the management of the company.

5.0 Definitions

Terms Definitions
Production Network The "production network" is the network used in the daily business of
XXXX Any network connected to the corporate backbone, either directly or indirectly, which
lacks an intervening firewall device. Any network whose impairment would result in direct loss
of functionality to XXXX employees or impact their ability to do work.