The network element must be configured so that ICMPv6 unreachable notifications and redirects are disabled on all external facing interfaces.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-14670	NET-IPV6-016	SV-30054r1_rule		Medium

Description
The Internet Control Message Protocol version 6 (ICMPv6) supports IPv6 traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMPv6 messages under a wide variety of conditions. ICMPv6 messages are commonly used by attackers for network mapping and diagnosis: Host unreachable, and Redirect.

STIG	Date
Perimeter L3 Switch Security Technical Implementation Guide - Cisco	2017-12-07

Details

Check Text ( C-39591r1_chk )
Review the active configuration to determine if controls have been defined to ensure router has ICMPv6 unreachables or redirects disabled any external interfaces. interface FastEthernet 0/0 ipv6 address 2001::0:0:1/64 ip access-group 101 in no ipv6 redirects no ipv6 unreachables no ipv6 mask-reply In addition, host unreachable messages will be sent in reply to black-hole routes. Be sure that the Null0 interface also has no ip unreachable defined if there are static routes destined for this interface. interface null0 no ipv6 unreachables Alterative. The purpose of configuring no ip unreachables is to suppress the router from sending an ICMP unreachable message (i.e. Administratively Prohibited, Host Unreachable, etc) out an external interface when it receives a packet that is denied by an ACL or for which it has no route. The side effect of this configuration is breaking PMTUD. If a router receives a packet that must be forwarded to the next-hop out an interface whose MTU is too small and the Don’t Fragment bit is on, the normal behavior of the router is to send back a Packet Too Big (PTB) message (ICMP Type 3 Code 4) towards the originating host. Configuring no ip unreachbles on the interface in which the larger packet was received will suppress this normal behavior and therefore disrupt PMTUD. An alternative to configuring no ip unreachables is to filter Host Unreachable messages generated by the router and drop these messages using the following configuration steps: 1) Configure a named ACL with a deny icmp any any for type3 code 4 followed by a permit icmp any any. This ACL will exclude PTB messages from being dropped by the local policy. 2) Configure a route-map to match on this named ACL. 3) For any matches, set the interface to null0. 4) Apply the route-map as local policy (for router generated traffic) 5) Configure no ip unreachables on the null0 interface. ! interface Null0 no ipv6 unreachables ! ipv6 local policy route-map LOCAL_POLICY ! ipv6 access-list extended FILTER_ICMP deny icmp any any packet-too-big permit icmp any any deny ipv6 any any ! ! ! ! route-map LOCAL_POLICY permit 10 match ip address FILTER_ICMP set interface Null0 Note: To ensure that internal hosts receive the unreachable messages, you can configure a deny statement for any internal destination network prior to the permit icmp any any. This will exclude unreachable messages destined for internal hosts from matching the route map and being forwarded to the null interface.

Check Text ( C-39591r1_chk )

Review the active configuration to determine if controls have been defined to ensure router has ICMPv6 unreachables or redirects disabled any external interfaces.

interface FastEthernet 0/0
ipv6 address 2001::0:0:1/64
ip access-group 101 in
no ipv6 redirects
no ipv6 unreachables
no ipv6 mask-reply

In addition, host unreachable messages will be sent in reply to black-hole routes. Be sure that the Null0 interface also has no ip unreachable defined if there are static routes destined for this interface.

interface null0
no ipv6 unreachables

Alterative. The purpose of configuring no ip unreachables is to suppress the router from sending an ICMP unreachable message (i.e. Administratively Prohibited, Host Unreachable, etc) out an external interface when it receives a packet that is denied by an ACL or for which it has no route. The side effect of this configuration is breaking PMTUD. If a router receives a packet that must be forwarded to the next-hop out an interface whose MTU is too small and the Don’t Fragment bit is on, the normal behavior of the router is to send back a Packet Too Big (PTB) message (ICMP Type 3 Code 4) towards the originating host. Configuring no ip unreachbles on the interface in which the larger packet was received will suppress this normal behavior and therefore disrupt PMTUD. An alternative to configuring no ip unreachables is to filter Host Unreachable messages generated by the router and drop these messages using the following configuration steps:

1) Configure a named ACL with a deny icmp any any for type3 code 4 followed by a permit icmp any any. This ACL will exclude PTB messages from being dropped by the local policy.
2) Configure a route-map to match on this named ACL.
3) For any matches, set the interface to null0.
4) Apply the route-map as local policy (for router generated traffic)
5) Configure no ip unreachables on the null0 interface.

!
interface Null0
no ipv6 unreachables
!
ipv6 local policy route-map LOCAL_POLICY
!
ipv6 access-list extended FILTER_ICMP
deny icmp any any packet-too-big
permit icmp any any
deny ipv6 any any
!
!
!
!
route-map LOCAL_POLICY permit 10
match ip address FILTER_ICMP
set interface Null0

Note: To ensure that internal hosts receive the unreachable messages, you can configure a deny statement for any internal destination network prior to the permit icmp any any. This will exclude unreachable messages destined for internal hosts from matching the route map and being forwarded to the null interface.

Fix Text (F-14131r1_fix)
The network element configuration must be changed to ensure ICMPv6 unreachables and redirects are disabled at all external interfaces.