AD-SUB-06: Non-RFC1918 (public IP) subnets count should be retrievable
| ID | AD-SUB-06 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Sites and subnets |
| Security area | Infrastructure hardening |
| Resource type | AdSite |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Using public IP addresses internally can cause:
- Routing conflicts: If public IPs are also used on the internet
- Security risks: Internal resources may be exposed
- Compliance issues: Violation of IP address allocation standards
- Connectivity problems: NAT and firewall complications
RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) should be used for internal networks.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Use RFC1918 private IP ranges for internal networks
- If public IPs are required internally, ensure proper isolation
- Document any exceptions with business justification
- Review subnet assignments for compliance
How the Test Works
Section titled “How the Test Works”This test identifies subnets that use public IP address ranges outside of RFC1918 private ranges.
Related Tests
Section titled “Related Tests”Test-MtAdSubnetNonInternalDetails- Lists public IP subnetsTest-MtAdSubnetTotalCount- Counts total subnetsTest-MtAdSubnetCatchAllCount- Identifies overly broad subnets
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.