Title

The Cisco ACI must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces. (Cat II impact)

Discussion

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.

Check Content

Review the router configuration and verify the ip mask-reply command is not enabled on any external interfaces as shown in the example below: apic1(config)# interface Ethernet0/1 apic(config-if)# no ip icmp mask-reply If the ip mask-reply command is configured on any external interface, this is a finding.

Fix Text

Disable ip mask-reply on all external interfaces as shown below: apic1(config)# interface Ethernet0/1 apic(config-if)# no ip icmp mask-reply

Additional Identifiers

Rule ID: SV-272087r1064490_rule

Vulnerability ID: V-272087

Group Title: SRG-NET-000362-RTR-000114

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.