Detections
Analytics
1.39 CISC-RT-000397
Information
The Cisco perimeter router must be configured to drop IPv6 packets containing the NSAP address option within Destination Option header.GROUP ID: V-230157RULE ID: SV-230157r856673
The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize, and hence could cause a Denial-of-Service on the target device. In addition, the type, length, value (TLV) formatting provides the ability for headers to be very large. This option type from RFC 1888 (OSI NSAPs and IPv6) has been deprecated by RFC 4048.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Configure the router to drop IPv6 packets containing a Destination Option header with option type value of 0xC3 (NSAP address) as shown in the example below.RP/0/0/CPU0:R3(config)# ipv6 access-list FILTER_IPV6RP/0/0/CPU0:R3(config-ipv6-acl)# deny 60 any any dest-option-type 195 logRP/0/0/CPU0:R3(config-ipv6-acl)# permit ipv6 ............RP/0/0/CPU0:R3(config-ipv6-acl)# deny ipv6 any any logRP/0/0/CPU0:R3(config-ipv6-acl)# exitRP/0/0/CPU0:R3(config)# interface gigabitethernet 0/2/0/2RP/0/0/CPU0:R3(config-if)# ipv6 access-group FILTER_IPV6 ingressRP/0/0/CPU0:R3(config-if)# end
See Also
Item Details
Audit Name: CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT II
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7(11), CAT|II, CCI|CCI-002403, Rule-ID|SV-230157r856673_rule, STIG-ID|CISC-RT-000397, Vuln-ID|V-230157
Plugin: Cisco
Control ID: 29078c88d71361a0238d9b6130734ec69897d0e977a1e264ab48b2e8e85ffd5f