Detections
Analytics

1.8 CISC-RT-000140

Information

The Cisco switch must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

GROUP ID:V-221081
RULE ID:SV-221081r999690

Fragmented ICMP packets can be generated by hackers for DoS attacks such as Ping O' Death and Teardrop. It is imperative that all fragmented ICMP packets are dropped.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the external and internal ACLs to drop all fragmented ICMP packets destined to itself as shown in the example below:

SW1(config)# ip access-list EXTERNAL_ACL
SW1(config-acl)# 35 deny icmp any host x.11.1.2 fragments log
SW1(config-acl)# exit

SW1(config)# ip access-list INTERNAL_ACL
SW1(config-acl)# 25 deny icmp any host 10.1.12.2 fragments log
SW1(config-acl)# end

Note: Ensure the above statement is before any permit statements for ICMP.

See Also

https://workbench.cisecurity.org/benchmarks/26426

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, 800-53|SC-7a., CCI|CCI-001097, CSCv7|14.6, Rule-ID|SV-221081r999690_rule, STIG-ID|CISC-RT-000140, Vuln-ID|V-221081

Plugin: Cisco

Control ID: 6bdcae0e16d0d7ea2740f311a88697479f0b8cd345891d904c948b640f26f7c4