Internet Control Message Types (ICMP) must be blocked outbound to external untrusted networks (e.g., ISP and other non-DoD networks).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3027	NET0912	SV-15368r2_rule	ECSC-1	Medium

Description
Using ICMP messages for information gathering is a process allowing malicious computer attackers to launch attacks against a targeted network. In this stage the malicious attacker will try to determine what the characteristics of the targeted network. Techniques, such as host detection, service detection, network topology mapping, and operating system fingerprinting are often used. The data collected will be used to identify those hosts running network services, which may have a known vulnerability. This vulnerability may allow the malicious attacker to exploit vulnerabilities in the network or gain unauthorized access to those systems. This unauthorized access may become the focal point to the whole targeted network.

Description

Using ICMP messages for information gathering is a process allowing malicious computer attackers to launch attacks against a targeted network. In this stage the malicious attacker will try to determine what the characteristics of the targeted network. Techniques, such as host detection, service detection, network topology mapping, and operating system fingerprinting are often used. The data collected will be used to identify those hosts running network services, which may have a known vulnerability. This vulnerability may allow the malicious attacker to exploit vulnerabilities in the network or gain unauthorized access to those systems. This unauthorized access may become the focal point to the whole targeted network.

STIG	Date
Perimeter L3 Switch Security Technical Implementation Guide - Cisco	2017-03-09

Details

Check Text ( C-12835r2_chk )
Review ACLs configured on network devices connected to untrusted networks (e.g., ISP and other non-DoD networks) are blocking outbound ICMP messages. The following are exceptions are allowed outbound. Exceptions: ICMP messages Packet-too-Big (type 3, code 4) Source Quench (type 4) Echo Request (type 8) If ICMP messages are not blocked outbound, this is a finding. Cisco IOS Example: interface FastEthernet 0/1 description link to Internal Network ip address 10.0.0.1 255.255.255.0 ip access-group 102 in … ! Allow outbound ping request from LAN subnet access-list 102 permit icmp 10.0.0.0 0.255.255.255 any echo-request ! Allow Path MTU to function access-list 102 permit icmp any any packet-too-big ! Allow flow control access-list 102 permit icmp any any source-quench ! And explicitly block all other ICMP packets access-list 102 deny icmp any any log

Check Text ( C-12835r2_chk )

Review ACLs configured on network devices connected to untrusted networks (e.g., ISP and other non-DoD networks) are blocking outbound ICMP messages. The following are exceptions are allowed outbound.

Exceptions:
ICMP messages Packet-too-Big (type 3, code 4)
Source Quench (type 4)
Echo Request (type 8)

If ICMP messages are not blocked outbound, this is a finding.

Cisco IOS Example:
interface FastEthernet 0/1
description link to Internal Network
ip address 10.0.0.1 255.255.255.0
ip access-group 102 in
…
! Allow outbound ping request from LAN subnet
access-list 102 permit icmp 10.0.0.0 0.255.255.255 any echo-request
! Allow Path MTU to function
access-list 102 permit icmp any any packet-too-big
! Allow flow control
access-list 102 permit icmp any any source-quench
! And explicitly block all other ICMP packets
access-list 102 deny icmp any any log

Fix Text (F-44086r1_fix)
Configure ACLs on network devices to block outbound ICMP messages. Exceptions to this rule are listed below. Exceptions: ICMP messages Packet-too-Big (type 3, code 4) Source Quench (type 4) Echo Request (type 8)