Perimeter Router STIG Cisco Version Comparison

There are 5 differences between versions v8 r30 (July 27, 2018) (the "left" version) and v8 r32 (Jan. 25, 2019) (the "right" version).

Check NET-IPV6-016 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

The network element must be configured so that ICMPv6 unreachable notifications and redirects are disabled on all external facing interfaces.

Check Content

Review the active configuration to determine if controls have been defined to ensure router has ICMPv6 unreachables or redirects disabled any external interfaces. interface FastEthernet 0/0 ipv6 address 2001::0:0:1/64 ip access-group 101 in no ipv6 redirects no ipv6 unreachables no ipv6 mask-reply In addition, host unreachable messages will be sent in reply to black-hole routes. Be sure that the Null0 interface also has no ip unreachable defined if there are static routes destined for this interface. interface null0 no ipv6 unreachables Alterative. The purpose of configuring no ip unreachables is to suppress the router from sending an ICMP unreachable message (i.e. Administratively Prohibited, Host Unreachable, etc) out an external interface when it receives a packet that is denied by an ACL or for which it has no route. The side effect of this configuration is breaking PMTUD. If a router receives a packet that must be forwarded to the next-hop out an interface whose MTU is too small and the Don’t Fragment bit is on, the normal behavior of the router is to send back a Packet Too Big (PTB) message (ICMP Type 3 Code 4) towards the originating host. Configuring no ip unreachbles on the interface in which the larger packet was received will suppress this normal behavior and therefore disrupt PMTUD. An alternative to configuring no ip unreachables is to filter Host Unreachable messages generated by the router and drop these messages using the following configuration steps: 1) Configure a named ACL with a deny icmp any any for type3 code 4 followed by a permit icmp any any. This ACL will exclude PTB messages from being dropped by the local policy. 2) Configure a route-map to match on this named ACL. 3) For any matches, set the interface to null0. 4) Apply the route-map as local policy (for router generated traffic) 5) Configure no ip unreachables on the null0 interface. ! interface Null0 no ipv6 unreachables ! ipv6 local policy route-map LOCAL_POLICY ! ipv6 access-list extended FILTER_ICMP deny icmp any any packet-too-big permit icmp any any deny ipv6 any any ! ! ! ! route-map LOCAL_POLICY permit 10 match ip address FILTER_ICMP set interface Null0 Note: To ensure that internal hosts receive the unreachable messages, you can configure a deny statement for any internal destination network prior to the permit icmp any any. This will exclude unreachable messages destined for internal hosts from matching the route map and being forwarded to the null interface.

Discussion

The Internet Control Message Protocol version 6 (ICMPv6) supports IPv6 traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMPv6 messages under a wide variety of conditions. ICMPv6 messages are commonly used by attackers for network mapping and diagnosis: Host unreachable, and Redirect.

Fix

The network element configuration must be changed to ensure ICMPv6 unreachables and redirects are disabled at all external interfaces.