The IDPS must prevent discovery of specific system components or devices comprising a managed interface.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34714	SRG-NET-000199-IDPS-00146	SV-45607r1_rule		Medium

Description
Allowing neighbor discovery messages to reach external network nodes is dangerous as it provides an attacker a method of obtaining information about the network infrastructure that can be useful to plan an attack. In addition, responding to the sending node that a packet cannot be forwarded as the destination host is unreachable provides network mapping information. Furthermore, if a router receives a large number of packets that cannot be forwarded, the router processor could be overloaded if it must generate a high volume of unreachable messages. To mitigate the risk of reconnaissance or a Denial of Service (DoS) attack, all external-facing interfaces must be configured to silently drop unreachable traffic, not announce network address information, and to ignore neighbor solicitation messages. IDPS sensors are installed in stealth mode with one interface installed on the management network. This interface is used for communications with the management console and other network elements. The management console is installed on the management network.

Description

Allowing neighbor discovery messages to reach external network nodes is dangerous as it provides an attacker a method of obtaining information about the network infrastructure that can be useful to plan an attack. In addition, responding to the sending node that a packet cannot be forwarded as the destination host is unreachable provides network mapping information. Furthermore, if a router receives a large number of packets that cannot be forwarded, the router processor could be overloaded if it must generate a high volume of unreachable messages. To mitigate the risk of reconnaissance or a Denial of Service (DoS) attack, all external-facing interfaces must be configured to silently drop unreachable traffic, not announce network address information, and to ignore neighbor solicitation messages. IDPS sensors are installed in stealth mode with one interface installed on the management network. This interface is used for communications with the management console and other network elements. The management console is installed on the management network.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42973r1_chk )
Inspect the sensor rules installed on the sensors to block or ignore activity that would result in discovery of network devices by an unauthorized attacker by performing the following actions. Verify sensor rules exist that monitor for and drop unreachable traffic. Verify sensors do not announce network address information. Verify sensors ignore neighbor solicitation messages. If the IDPS is not configured to prevent discovery of network devices and components, this is a finding.

Check Text ( C-42973r1_chk )

Inspect the sensor rules installed on the sensors to block or ignore activity that would result in discovery of network devices by an unauthorized attacker by performing the following actions.
Verify sensor rules exist that monitor for and drop unreachable traffic.
Verify sensors do not announce network address information.
Verify sensors ignore neighbor solicitation messages.

If the IDPS is not configured to prevent discovery of network devices and components, this is a finding.

Fix Text (F-39005r1_fix)
Implement sensor rules that monitor for and drop unreachable traffic and ignore neighbor solicitation messages. Configure rules or signatures so network address information is not announced.