Detections
Analytics

1.77 CISC-RT-000391

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Cisco perimeter switch must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.

GROUP ID: V-237760
RULE ID: SV-237760r999764

Many of the known attacks in stateless autoconfiguration are defined in RFC 3756 were present in IPv4 ARP attacks. To mitigate these vulnerabilities, links that have no hosts connected such as the interface connecting to external gateways must be configured to suppress router advertisements.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the switch to suppress Router Advertisements on all external IPv6-enabled interfaces as shown in the example below.

SW1(config)# interface e1/1
SW1(config-if-range)# ipv6 nd suppress-ra
SW1(config-if-range)# end

See Also

https://workbench.cisecurity.org/benchmarks/22581

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, CSCv7|13.3, Rule-ID|SV-237760r999764_rule, STIG-ID|CISC-RT-000391, Vuln-ID|V-237760

Plugin: Cisco

Control ID: 18115bb927aa7ad9d9f0d1b2ee115b4997ce17e1f782e9ca69182104569d3bec