3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 224.0.0.0'

Information

This command places the router in access-list configuration mode, where you must define the denied or permitted access conditions by using the deny and permit commands.

Rationale:

Configuring access controls can help prevent spoofing attacks. To reduce the effectiveness of IP spoofing, configure access control to deny any traffic from the external network that has a source address that should reside on the internal network. Include local host address or any reserved private addresses (RFC 1918).

Ensure the permit rule(s) above the final deny rule only allow traffic according to your organization's least privilege policy.

Impact:

Organizations should plan and implement enterprise security policies that explicitly separate internal from external networks. Adding 'ip access-list' explicitly permitting and denying internal and external networks enforces these policies.

Solution

Configure ACL for private source address restrictions from external networks.

hostname(config)#ip access-list extended {<span><em>name | number</em>}
</span><span>hostname(config-nacl)#deny ip {</span><em>internal_networks</em>} any log
hostname(config<span>-nacl</span>)#deny ip 127.0.0.0 0.255.255.255 any log
hostname(config<span>-nacl</span>)#deny ip 10.0.0.0 0.255.255.255 any log
hostname(config<span>-nacl</span>)#deny ip 0.0.0.0 0.255.255.255 any log
hostname(config<span>-nacl</span>)#deny ip 172.16.0.0 0.15.255.255 any log
hostname(config<span>-nacl</span>)#deny ip 192.168.0.0 0.0.255.255 any log
hostname(config<span>-nacl</span>)#deny ip 192.0.2.0 0.0.0.255 any log
hostname(config<span>-nacl</span>)#deny ip 169.254.0.0 0.0.255.255 any log
hostname(config<span>-nacl</span>)#deny ip 224.0.0.0 31.255.255.255 any log
hostname(config<span>-nacl</span>)#deny ip host 255.255.255.255 any log
hostname(config<span>-nacl</span>)#permit {protocol} {source_ip} {source_mask} {destination} {destination_mask} log
hostname(config<span>-nacl</span>)#deny any any log
hostname(config)#interface <external_<em>interface</em>>
hostname(config-if)#access-group <<em>access-list</em>> in


Default Value:

No access list defined

See Also

https://workbench.cisecurity.org/files/3829

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CM-6, 800-53|CM-7, 800-53|SC-23, CSCv7|11

Plugin: Cisco

Control ID: 603c5c7296584f6648c67bac88e04eb73f4aebf3b164b59d9f314fafe8be2bcb