Non-RFC1918 (public IP) subnets count should be retrievable
AD-SUB-06InfoActive DirectorySites and subnets
Part of Active Directory · Active Directory · Sites and subnets · All checks
Invoke-Maester -TestId AD-SUB-06Overview
Section titled “Overview”Using public IP addresses internally can cause:
- Routing conflicts: If public IPs are also used on the internet
- Security risks: Internal resources may be exposed
- Compliance issues: Violation of IP address allocation standards
- Connectivity problems: NAT and firewall complications
RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) should be used for internal networks.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Use RFC1918 private IP ranges for internal networks
- If public IPs are required internally, ensure proper isolation
- Document any exceptions with business justification
- Review subnet assignments for compliance
How the Test Works
Section titled “How the Test Works”This test identifies subnets that use public IP address ranges outside of RFC1918 private ranges.
Related Tests
Section titled “Related Tests”Test-MtAdSubnetNonInternalDetails- Lists public IP subnetsTest-MtAdSubnetTotalCount- Counts total subnetsTest-MtAdSubnetCatchAllCount- Identifies overly broad subnets
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SUB-06 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Sites and subnets |
| Area | Infrastructure hardening |
| Resource type | AdSite |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdSubnetNonInternalCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/site/Test.AD-SUB-06.ps1 - Documentation:
tests/ad/site/Test.AD-SUB-06.md