Detections
Analytics

CASA-FW-000280 - The Cisco ASA must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

IPv6 packets with unknown extension headers as well as out-of-order headers can create Denial-of-Service attacks for other networking components as well as host devices. IPv6 inspection can check conformance to RFC 2460 enforcing the order extension headers. While routers only need to examine the IPv6 destination address and the Hop-by-Hop Options header, firewalls must recognize and parse through all existing extension headers since the upper-layer protocol information resides in the last header. An attacker is able to chain many extension headers in order to pass firewall and intrusion detections. An attacker can cause a denial of service if an intermediary device or destination host is not capable of processing an extensive or out-of-order chain of extension headers. Hence, it is imperative the firewall is configured to drop packets with unknown or out-of-order headers.

Solution

Configure the firewall to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.

Step 1 (optional): Configure an IPv6 inspect policy map.

ASA(config)# policy-map type inspect ipv6 IPV6_MAP
ASA(config-pmap)# parameters
ASA(config-pmap-p)# verify-header type
ASA(config-pmap-p)# verify-header order
ASA(config-pmap-p)# exit
ASA(config-pmap)# match header hop-by-hop
ASA(config-pmap-c)# drop log
ASA(config-pmap-c)# exit
ASA(config-pmap)# match header routing-type eq 0
ASA(config-pmap-c)# drop log
ASA(config-pmap-c)# exit
ASA(config-pmap)# match header routing-type eq 1
ASA(config-pmap-c)# drop log
ASA(config-pmap-c)# exit
ASA(config-pmap)# match header routing-type range 3 255
ASA(config-pmap-c)# drop log
ASA(config-pmap-c)# exit

Note: The verify-header type and verify-header order are enabled by default when the parameters command is configured.

Step 2: Include the inspect ipv6 command in the global policy-map as shown in the example below.

ASA(config)# policy-map global_policy
ASA(config-pmap)# class inspection_default
ASA(config-pmap-c)# inspect ipv6
ASA(config-pmap-c)# end

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_ASA_Y22M04_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-239870r665896_rule, STIG-ID|CASA-FW-000280, Vuln-ID|V-239870

Plugin: Cisco

Control ID: 782c9508857981fff00dd67bc67114cca51b096b76cefc38a2e94a5abb953d94