Detections
Analytics

1.139 SOL-11.1-050470

Information

The operating system must prevent internal users from sending out packets which attempt to manipulate or spoof invalid IP addresses.

GROUP ID: V-216400
RULE ID: SV-216400r959010

Manipulation of IP addresses can allow untrusted systems to appear as trusted hosts, bypassing firewall and other security mechanism and resulting in system penetration.

Solution

Determine the name of the zone that you are currently securing.

# zonename

If the command output is "global", then only the "phys" and "SR-IOV" interfaces assigned to the global zone require configuration. If using a non-Global zone, then all "phys" and "SR-IOV" interfaces assigned to the zone require configuration.

The Network Link Security profile is required.

Determine which network interfaces are available and what protection modes are enabled and required.

Enable link protection based on each configured network interface type.

For InfiniBand:

# pfexec dladm set-linkprop -p protection=restricted,ip-nospoof,dhcp-nospoof [interface name]

For IP forwarding:

# pfexec dladm set-linkprop -p protection=mac-nospoof,restricted,dhcp-nospoof [interface name]

For SR-IOV:

# pfexec dladm set-linkprop -p protection=mac-nospoof,restricted,dhcp-nospoof [interface name]

For Ethernet without IP forwarding:

# pfexec dladm set-linkprop -p protection=mac-nospoof,restricted,ip-nospoof,dhcp-nospoof [interface name]

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216400r959010_rule, STIG-ID|SOL-11.1-050470, Vuln-ID|V-216400

Plugin: Unix

Control ID: a4fa04767e3acc88a32b5d7f5677554b1226f653f753410b3fb5b3b3565c2c83