The IAO/NSO will ensure IPv6 6-to-4 addresses with a prefix of 2002::/16 are dropped at the enclave perimeter by the ingress and egress filters.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18608	NET-IPV6-024	SV-20160r1_rule	ECSC-1	Medium

Description
“6-to-4” is a tunneling IPv6 transition mechanism [RFC 3056]. The guidance is the default case, which assumes that 6-to-4 is not being used as an IPv6 transition mechanism. If 6-to-4 is implemented, reference addition 6-to-4 guidance defined in the STIG. Drop all inbound IPv6 packets containing a source address of type 2002::/16. This assumes the 6-to-4 transition mechanism is not being used. Drop all inbound IPv6 packets containing a destination address of type 2002::/16. This assumes the 6-to-4 transition mechanism is not being used.

Description

“6-to-4” is a tunneling IPv6 transition mechanism [RFC 3056]. The guidance is the default case, which assumes that 6-to-4 is not being used as an IPv6 transition mechanism. If 6-to-4 is implemented, reference addition 6-to-4 guidance defined in the STIG. Drop all inbound IPv6 packets containing a source address of type 2002::/16. This assumes the 6-to-4 transition mechanism is not being used. Drop all inbound IPv6 packets containing a destination address of type 2002::/16. This assumes the 6-to-4 transition mechanism is not being used.

STIG	Date
Firewall Security Technical Implementation Guide - Cisco	2013-10-08

Details

Check Text ( C-22275r1_chk )
Base Procedure: Review the premise router and firewall configurations to ensure filters are in place to restrict the IP addresses explicitly, or inexplicitly. Verify that ingress and egress ACLs for IPv6 have been defined to deny 6-to-4 tunnel addresses and log all violations. source type: 2002::/16

Fix Text (F-19237r1_fix)
The administrator will configure the router ACLs to restrict IP addresses that contain any 6-to-4 addresses.