The firewall must establish ingress filters that block inbound packets where the destination is an IP address assigned to the management or loopback addresses of the enclave protection devices unless the packet has a source address assigned to the management network or network infrastructure.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79473	SRG-NET-000364-FW-000033	SV-94179r1_rule		Medium

Description
The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address. The loopback address is used by an Inter-Processor Control (IPC) mechanism that enables the client and server portion of an application running on the same machine to communicate, and so it is trusted. It should never be used as the source IP address of an inbound or outbound transmission. It is a best practice for the management network to use the loopback addresses.

Description

The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address. The loopback address is used by an Inter-Processor Control (IPC) mechanism that enables the client and server portion of an application running on the same machine to communicate, and so it is trusted. It should never be used as the source IP address of an inbound or outbound transmission. It is a best practice for the management network to use the loopback addresses.

STIG	Date
Firewall Security Requirements Guide	2018-03-21

Details

Check Text ( C-79089r1_chk )
Review the device configuration to determine if filters are in place to block loopback addresses. Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure). If loopback addresses are not being blocked by an ingress firewall filter, this is a finding.

Check Text ( C-79089r1_chk )

Review the device configuration to determine if filters are in place to block loopback addresses.

Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure).

If loopback addresses are not being blocked by an ingress firewall filter, this is a finding.

Fix Text (F-86245r1_fix)
Establish ingress filters to block any attempt from the firewall or any network to pass any packets claiming to be from a loopback address.