Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The firewall implementation must restrict the acceptance of any IP packets from the unspecified address (::/128).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| SRG-NET-000018-FW-000249 | SRG-NET-000018-FW-000249 | SRG-NET-000018-FW-000249_rule | Medium |
| Description |
|---|
| The address 0:0:0:0:0:0:0:0, also defined ::/128, is called the unspecified address. It must never be assigned to any node. It indicates the absence of an address. The unspecified address must not be used as the destination address of IPv6 packets or in IPv6 Routing Headers. A router must never forward an IPv6 packet with a source address of unspecified. |
| STIG | Date |
|---|---|
| Firewall Security Requirements Guide | 2014-07-07 |
Details
| Check Text ( C-SRG-NET-000018-FW-000249_chk ) |
|---|
| Review the firewall implementation configuration to verify filters are in place to restrict the IPv6 addresses. Verify that ingress and egress filters for IPv6 have been defined to deny the Unspecified Address (::/128), and log all violations. If the ingress and egress filters for IPv6 are not defined to deny the Unspecified Address (::/128) and log all violations, this is a finding. |
| Fix Text (F-SRG-NET-000018-FW-000249_fix) |
|---|
| Configure the firewall/ACL for IPv6 to deny the Unspecified Address (::/128). |