Title

The Cisco ACI must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces. (Cat II impact)

Discussion

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.

Check Content

Review the router configuration and verify IP mask replies have been disabled on all external interfaces using any of the following options: 1. For contracts with external L3out traffic, verify specific allow statements do not allow any ICMP type 17 packets. 2. Verify the Filter for ICMP Type 17 and confirm that every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17. If IP mask replies are not disabled on all external interfaces, this is a finding.

Fix Text

Disable IP mash replies on all external interfaces using any of the following options. 1. ACI is a whitelist model by default, so all traffic is denied by default. When contracts are added, users can be specific with the allow statements to avoid allowing any ICMP type 17 packets. 2. Configure the filter for ICMP Type 17 and confirm every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17.

Additional Identifiers

Rule ID: SV-272087r1168151_rule

Vulnerability ID: V-272087

Group Title: SRG-NET-000362-RTR-000114

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.