Detections
Analytics

1.75 CISC-RT-000236

Information

The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments.

GROUP ID: V-237754
RULE ID: SV-237754r999759

The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message being used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to the hop limit reaching zero before the packets sent by a host reached its destination.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the switch to advertise a hop limit of at least 32 in Router Advertisement messages as shown in the example.

SW1(config)# interface e2/1 - 2
SW1(config-if-range)# ipv6 nd hop-limit 32
SW1(config-if-range)# end

See Also

https://workbench.cisecurity.org/benchmarks/26426

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-7, 800-53|CM-6b., 800-53|SC-4, CCI|CCI-000366, CSCv7|13.3, Rule-ID|SV-237754r999759_rule, STIG-ID|CISC-RT-000236, Vuln-ID|V-237754

Plugin: Cisco

Control ID: 5ef2c41ee7bb19a508d85a4af6be45dd2dcf79db96357739ca1441ecfe3aa2c0