Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Arista perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-256041 | ARST-RT-000620 | SV-256041r882465_rule | Medium |
| Description |
|---|
| Bogons include IP packets on the public internet that contain addresses that are not in any range allocated or delegated by the Internet Assigned Numbers Authority (IANA) or a delegated regional internet registry (RIR) and allowed for public internet use. Bogons also include multicast, IETF reserved, and special purpose address space as defined in RFC 6890. Security of the internet's routing system relies on the ability to authenticate an assertion of unique control of an address block. Measures to authenticate such assertions rely on the validation the address block forms as part of an existing allocated address block, and must be a trustable and unique reference in the IANA address registries. The intended use of a Bogon address would only be for the purpose of address spoofing in denial-of-service attacks. Hence, it is imperative that IP packets with a source Bogon address are blocked at the network's perimeter. |
| STIG | Date |
|---|---|
| Arista MLS EOS 4.2x Router Security Technical Implementation Guide | 2023-01-17 |
Details
| Check Text ( C-59717r882463_chk ) |
|---|
| This requirement is not applicable for the DODIN backbone. Verify the ingress filter is blocking packets with Bogon source addresses. Review the Arista router configuration to verify it is configured to block IP packets with a Bogon source address with "show run | section prefix-list". IPv4 Bogon Prefixes 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24 192.168.0.0/16 198.18.0.0/15 | 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4 IPv6 Bogon Prefixes ::/128 ::1/128 0::/96 ::ffff:0:0/96 3ffe::/16 64:ff9b::/96 100::/64 2001:10::/28 2001:db8::/32 2001:2::/48 2001::/32 2001::/23 2002::/16 fc00::/7 fe80::/10 fec0::/10 ff00::/8 If the Arista router is not configured to block inbound IP packets containing a Bogon source address, this is a finding. Note: At a minimum, IP packets containing a source address from the special purpose address space as defined in RFC 6890 must be blocked. The 6Bone prefix (3ffe::/16) is also considered a Bogon address. Perimeter routers connected to commercial ISPs for internet or other non-DOD network sources must be reviewed for a full Bogon list. Step 1: Verify the ACL is configured to block the IPv4 Bogon prefixes. ip access-list BOGON_PREFIXES deny ip 0.0.0.0/8 any deny ip 10.0.0.0/8 any deny ip 100.64.0.0/10 any deny ip 127.0.0.0/8 any deny ip 169.254.0.0/16 any deny ip 172.16.0.0/12 any deny ip 192.0.0.0/24 any deny ip 192.0.2.0/24 any deny ip 192.88.99.0/24 any deny ip 192.168.0.0/16 any deny ip 198.18.0.0/15 any deny ip 198.51.100.0/24 any deny ip 203.0.113.0/24 any deny ip 224.0.0.0/4 any deny ip 240.0.0.0/4 any Step 2: Verify the ACL is configured to block the IPv6 Bogon prefixes. ipv6 access-list BOGON_PREFIXES deny ipv6 ::/128 any deny ipv6 ::1/128 any deny ipv6 0::/96 any deny ipv6 ::ffff:0:0/96 any deny ipv6 3ffe::/16 any deny ipv6 64:ff9b::/96 any deny ipv6 100::/64 any deny ipv6 2001:10::/28 any deny ipv6 2001:db8::/32 any deny ipv6 2001:2::/48 any deny ipv6 2001::/32 any deny ipv6 2001::/23 any deny ipv6 2002::/16 any deny ipv6 fc00::/7 any deny ipv6 fe80::/10 any deny ipv6 fec0::/10 any deny ipv6 ff00::/8 any Step 3: Verify the IPv4 and IPv6 access lists are applied to the external interface. interface ethernet 3 ip access-group BOGON_PREFIXES in ipv6 access-group BOGON_PREFIXES in |
| Fix Text (F-59660r882464_fix) |
|---|
| This requirement is not applicable for the DODIN backbone. Configure the Arista router to block inbound packets with Bogon source addresses. Step 1: Configure the ACL to block the IPv4 Bogon prefixes. LEAF-1A(config)#ip access-list BOGON_PREFIXES LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 0.0.0.0/8 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 10.0.0.0/8 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 100.64.0.0/10 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 127.0.0.0/8 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 169.254.0.0/16 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 172.16.0.0/12 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 192.0.0.0/24 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 192.0.2.0/24 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 192.88.99.0/24 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 192.168.0.0/16 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 198.18.0.0/15 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 198.51.100.0/24 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 203.0.113.0/24 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 224.0.0.0/4 any LEAF-1A(config-acl-BOGON_PREFIXES)#deny ip 240.0.0.0/4 any LEAF-1A(config-acl-BOGON_PREFIXES)#exit Step 2: Configure the ACL to block the ipv6 Bogon prefixes. LEAF-1A(config)#ipv6 access-list BOGON_PREFIXES LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 ::/128 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 ::1/128 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 0::/96 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 ::ffff:0:0/96 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 3ffe::/16 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 64:ff9b::/96 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 100::/64 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 2001:10::/28 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 2001:db8::/32 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 2001:2::/48 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 2001::/32 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 2001::/23 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 2002::/16 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 fc00::/7 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 fe80::/10 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 fec0::/10 any LEAF-1A(config-ipv6-acl-BOGON_PREFIXES)#deny ipv6 ff00::/8 any Step 3: Apply the IPv4 and IPv6 Bogon access lists to the external interface. LEAF-1A(config)#interface ethernet 3 LEAF-1A(config-if-Et3)#ip access-group BOGON_PREFIXES in LEAF-1A(config-if-Et3)#ipv6 access-group BOGON_PREFIXES in |