The firewall must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223012	SRG-NET-000364-FW-000041	SV-223012r604133_rule		Medium

Description
IPv6 packets with unknown extension headers as well as out-of-order headers can create denial-of-service attacks for other networking components as well as host devices. IPv6 inspection can check conformance to RFC 2460 enforcing the order extension headers. While routers only need to examine the IPv6 destination address and the Hop-by-Hop Options header, firewalls should must recognize and parse through all existing extension headers since the upper-layer protocol information reside in the last header. An attacker is able to chain lots of extension headers in order to pass firewall- & intrusion detections. An attacker can cause a denial of service if an intermediary device or destination host is not capable of processing an extensive or out-of-order chaine of extension headers. Hence it is imperative, that the firewall is configured to drop packets with unknown or out-of-order headers.

Description

IPv6 packets with unknown extension headers as well as out-of-order headers can create denial-of-service attacks for other networking components as well as host devices. IPv6 inspection can check conformance to RFC 2460 enforcing the order extension headers. While routers only need to examine the IPv6 destination address and the Hop-by-Hop Options header, firewalls should must recognize and parse through all existing extension headers since the upper-layer protocol information reside in the last header. An attacker is able to chain lots of extension headers in order to pass firewall- & intrusion detections. An attacker can cause a denial of service if an intermediary device or destination host is not capable of processing an extensive or out-of-order chaine of extension headers. Hence it is imperative, that the firewall is configured to drop packets with unknown or out-of-order headers.

STIG	Date
Firewall Security Requirements Guide	2020-12-04

Details

Check Text ( C-24684r457851_chk )
Review the firewall configuration to verify that IPv6 inspection is being performed on all interfaces. If the firewall is not configujred to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers, this is a finding.

Fix Text (F-24673r457853_fix)
Configure the firewall to inspect all inbound and outbound traffic at the application layer.