Detections
Analytics

1.77 CISC-RT-000391

Information

The Cisco perimeter switch must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.

GROUP ID: V-237760
RULE ID: SV-237760r999764

Many of the known attacks in stateless autoconfiguration are defined in RFC 3756 were present in IPv4 ARP attacks. To mitigate these vulnerabilities, links that have no hosts connected such as the interface connecting to external gateways must be configured to suppress router advertisements.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the switch to suppress Router Advertisements on all external IPv6-enabled interfaces as shown in the example below.

SW1(config)# interface e1/1
SW1(config-if-range)# ipv6 nd suppress-ra
SW1(config-if-range)# end

See Also

https://workbench.cisecurity.org/benchmarks/26426

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-7, 800-53|CM-6b., 800-53|SC-4, CCI|CCI-000366, CSCv7|13.3, Rule-ID|SV-237760r999764_rule, STIG-ID|CISC-RT-000391, Vuln-ID|V-237760

Plugin: Cisco

Control ID: 18115bb927aa7ad9d9f0d1b2ee115b4997ce17e1f782e9ca69182104569d3bec