@@ -1519,7 +1519,9 @@ Management traffic in this context refers to command and control instructions th
***IM_SEGMENT-2** Available management APIs shall accept traffic only from reasonably limited known sources.
> EXAMPLE: A limited known source would be RFC 1918 [8] private subnet.
> EXAMPLE: A reasonably limited known source would be RFC 1918 [8] private subnet.
> NOTE: The requirement **IM_SEGMENT-2** is designed to be combined with **EMM_ROUTE-2** to reach the required level of protection.
**High**:
@@ -3365,7 +3367,7 @@ Assessments are defined in [Annex K](#annex-k-normative-generic-cryptographic-re
#### 6.11.1.1 IM_SEGMENT-1
**Objective:**Protect the interface on unclassified traffic.
**Objective:**Where applicable, management traffic is always separated from other traffic.
**Preparation:**
@@ -3378,7 +3380,7 @@ Assessments are defined in [Annex K](#annex-k-normative-generic-cryptographic-re
**Verdict:**
1. Pass the product **instructs** the product user how to deploy and use the provided product features to limit traffic to the management interfaces.
1. Pass the product **instructs** the product user how to deploy and communicate management traffic via a separated network segment.
2. Fail otherwise.
**Supporting Evidence:**
@@ -3427,12 +3429,16 @@ Assessments are defined in [Annex K](#annex-k-normative-generic-cryptographic-re
**Activities:**
1. Study the implementation of the product and determine if the management traffic would be possible to segregate to its own physical or virtual interface or subnet where a layer of authorisation could be used to segregate the traffic towards the product from other uses of the network served with the product.
2. Study the implementation of the product and determine if the management API is designed to reject unclassified network traffic.
3. Simulate unclassified network traffic on the management API.
**Verdict:**
1. Pass if the product **requires** utilising dedicated physical port for the management traffic or the product supports dedicated virtual subnet to be connected to the serving workload that is segregated from SRU traffic
1. and the product instructs the product user how to deploy and use the provided product features.
2. Fail otherwise.
1. Pass, if the product **requires** utilising dedicated physical port for the management traffic or the product supports dedicated virtual subnet to be connected to the serving workload that is segregated from other traffic
2. and the product reject network traffic that is not conformant to the connected networks and subnetworks
3. and the simulated unclassified network traffic is rejected.
4. and the product instructs the product user how to deploy and connect to the networks and subnetworks in classified ways.
