# Non-RFC1918 (public IP) subnets details should be retrievable

Non-RFC1918 (public IP) subnets details should be retrievable. A Maester check for Active Directory, Sites and subnets.

Source: https://maester.dev/docs/tests/AD-SUB-07

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Sites and subnets · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-SUB-07
```

## Overview

Detailed information about public IP subnet usage helps:

- **Identify misconfigurations**: Find subnets that should use private ranges
- **Assess security posture**: Evaluate exposure of internal resources
- **Plan remediation**: Prioritize subnet renumbering efforts
- **Document exceptions**: Record legitimate uses of public IPs

Each public IP subnet should be reviewed for proper isolation and business justification.

#### Control Type

**Detective**

#### Security Recommendation

For each public IP subnet:
1. Verify if the use is intentional and justified
2. Ensure proper network isolation is in place
3. Document the business requirement
4. Plan migration to private ranges if appropriate
5. Review firewall and NAT configurations

#### How the Test Works

This test retrieves all subnets, identifies those using public IP ranges, and lists them with their site associations and descriptions.

#### Related Tests

- `Test-MtAdSubnetNonInternalCount` - Counts public IP subnets
- `Test-MtAdSubnetTotalCount` - Counts total subnets
- `Test-MtAdSubnetSiteAssociationCount` - Counts sites with subnets

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-SUB-07 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Sites and subnets |
| Area | Infrastructure hardening |
| Resource type | AdSite |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdSubnetNonInternalDetails](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-07.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty |

</details>

## Source

- Test: [`tests/ad/site/Test.AD-SUB-07.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-07.ps1)
- Documentation: [`tests/ad/site/Test.AD-SUB-07.md`](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-07.md)