Detections
Analytics

1.6 CISC-RT-000140

Information

The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

GROUP ID: V-216744RULE ID: SV-216744r531087

Fragmented ICMP packets can be generated by hackers for DoS attacks such as Ping O' Death and Teardrop. It is imperative that all fragmented ICMP packets are dropped.

Solution

Configure the external and internal ACLs to drop all fragmented ICMP packets destined to itself as shown in the example below.

RP/0/0/CPU0:R3(config)#ipv4 access-list EXTERNAL_ACL_INBOUNDRP/0/0/CPU0:R2(config-ipv4-acl)#25 deny icmp any host x.11.1.2 fragments log

RP/0/0/CPU0:R3(config)#ipv4 access-list INTERNAL_ACL_INBOUNDRP/0/0/CPU0:R2(config-ipv4-acl)#5 deny icmp any host 10.1.12.2 fragments logNote: Ensure the above statement is before any permit statements for ICMP.

See Also

https://workbench.cisecurity.org/benchmarks/23599

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-216744r531087_rule, STIG-ID|CISC-RT-000140, Vuln-ID|V-216744

Plugin: Cisco

Control ID: 8512b4b572767953085930bd739c6e4317b78748bfee51b8183582e8ff1d5011