Network devices must be configured to restrict the acceptance of any inbound IP packets with a local host loopback address, (0:0:0:0:0:0:0:1 or ::1/128).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-14695	NET-IPV6-027	SV-15401r2_rule	ECSC-1	High

Description
The unicast address 0:0:0:0:0:0:0:1, also defined ::1/128 is called the loopback address. A node could use it to send an IPv6 packet to itself. It should never be assigned to any physical interface. It is treated as having link-local scope, and may be thought of as the link-local unicast address of a virtual interface to an imaginary link that goes nowhere. The loopback address must not be used as the source address in IPv6 packets that are sent outside of a single node. An IPv6 packet with a destination address of loopback must never be sent outside of a single node and must never be forwarded by an IPv6 router. A packet received on an interface with destination address of loopback must be dropped.

Description

The unicast address 0:0:0:0:0:0:0:1, also defined ::1/128 is called the loopback address. A node could use it to send an IPv6 packet to itself. It should never be assigned to any physical interface. It is treated as having link-local scope, and may be thought of as the link-local unicast address of a virtual interface to an imaginary link that goes nowhere. The loopback address must not be used as the source address in IPv6 packets that are sent outside of a single node. An IPv6 packet with a destination address of loopback must never be sent outside of a single node and must never be forwarded by an IPv6 router. A packet received on an interface with destination address of loopback must be dropped.

STIG	Date
Perimeter L3 Switch Security Technical Implementation Guide	2016-07-07

Details

Check Text ( C-58981r1_chk )
Review the device configuration to ensure filters are in place to restrict inbound IP addresses explicitly, or inexplicitly. Verify that an ingress ACL for IPv6 has been defined to deny IPv6 Loopback, and log all violations. If the appropriate filters are not configured and applied, this is a finding.

Fix Text (F-63439r1_fix)
Configure and apply the filters to restrict IP addresses that contain any loopback addresses.