Detections
Analytics
CISC-RT-000180 - The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.
Information
The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Disable ip mask-reply on all external interfaces as shown below.R4(config)#int g0/1
R4(config-if)#no ip mask-reply
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_IOS_Router_Y20M07_STIG.zip
Item Details
Audit Name: DISA STIG Cisco IOS Router RTR v1r4
References: CAT|II, CCI|CCI-002385, Rule-ID|SV-105671r1_rule, STIG-ID|CISC-RT-000180, Vuln-ID|V-96533
Plugin: Cisco
Control ID: 8af4bfbfacabfe2bf6d725a76592d335aace3f292932d919421988200931927a