The IDPS must prevent discovery of specific system components or devices comprising a managed interface.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000199-IDPS-000206	SRG-NET-000199-IDPS-000206	SRG-NET-000199-IDPS-000206_rule		Medium

Description
Allowing neighbor discovery messages to reach external network nodes is dangerous as it provides an attacker a method to obtain information of the network infrastructure that can be useful to plan an attack. In addition, responding to the sending node that a packet cannot be forwarded as the destination host is unreachable provides network mapping information. Furthermore, if a router receives a large number of packets that cannot be forwarded, the router processor could be overloaded if it must generate a high volume of unreachable messages. To mitigate the risk of reconnaissance or a Denial of Service (DoS) attack, all external-facing interfaces must be configured to silently drop unreachable traffic, not announce network address information, and to ignore neighbor solicitation messages. IDPS sensors are installed in stealth mode with one interface installed on the management network. This interface is used for communications with the management console and other network elements. The management console is installed on the management network.

Description

Allowing neighbor discovery messages to reach external network nodes is dangerous as it provides an attacker a method to obtain information of the network infrastructure that can be useful to plan an attack. In addition, responding to the sending node that a packet cannot be forwarded as the destination host is unreachable provides network mapping information. Furthermore, if a router receives a large number of packets that cannot be forwarded, the router processor could be overloaded if it must generate a high volume of unreachable messages. To mitigate the risk of reconnaissance or a Denial of Service (DoS) attack, all external-facing interfaces must be configured to silently drop unreachable traffic, not announce network address information, and to ignore neighbor solicitation messages. IDPS sensors are installed in stealth mode with one interface installed on the management network. This interface is used for communications with the management console and other network elements. The management console is installed on the management network.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43365_chk )
Inspect the signatures installed on the sensors to block or ignore activity that would result in discovery of network devices by an unauthorized attacker by performing the following actions. Verify signatures exist that monitor for and drop unreachable traffic. Verify sensors do not announce network address information. Verify the sensors ignore neighbor solicitation messages. If the IDPS is not configured to prevent discovery of network devices and components, this is a finding.

Check Text ( C-43365_chk )

Inspect the signatures installed on the sensors to block or ignore activity that would result in discovery of network devices by an unauthorized attacker by performing the following actions.
Verify signatures exist that monitor for and drop unreachable traffic. Verify sensors do not announce network address information. Verify the sensors ignore neighbor solicitation messages.

If the IDPS is not configured to prevent discovery of network devices and components, this is a finding.

Fix Text (F-43365_fix)
Implement signatures or rules that monitor for and drop unreachable traffic and ignore neighbor solicitation messages. Configure rules or signature so network address information is not announced.