Detections
Analytics
NET-IPV6-024 - IPv6 6-to-4 addresses with a prefix of 2002::/16 are dropped by ingress and egress filters - Ingress filter
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
'6-to-4' is a tunneling IPv6 transition mechanism [RFC 3056]. The guidance is the default case, which assumes that 6-to-4 is not being used as an IPv6 transition mechanism. If 6-to-4 is implemented, reference addition 6-to-4 guidance defined in the STIG.Drop all inbound IPv6 packets containing a source address of type 2002::/16. This assumes the 6-to-4 transition mechanism is not being used.
Drop all inbound IPv6 packets containing a destination address of type 2002::/16. This assumes the 6-to-4 transition mechanism is not being used.
Solution
Configure the device using filters to restrict IP addresses that contain any 6-to-4 addresses.See Also
https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R32_STIG.zip
Item Details
Audit Name: DISA STIG Juniper Perimeter Router V8R32
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7(11), CAT|II, Rule-ID|SV-20162r1_rule, STIG-ID|NET-IPV6-024, Vuln-ID|V-18608
Plugin: Juniper
Control ID: d9c4becc65a0340a381f71bf45528e7952ac66c701f87f204a597a6f31c59928