UCF STIG Viewer Logo

The network element must be configured from accepting any outbound IP packet that contains an illegitimate address in the source address field via egress ACL or by enabling Unicast Reverse Path Forwarding in an IPv6 enclave.


Overview

Finding ID Version Rule ID IA Controls Severity
V-14707 NET-IPV6-034 SV-15429r1_rule Medium
Description
Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interface appear in the routing table and match the interface on which the packet was received. If the packet was received from one of the best reverse path routes, the packet is forwarded as normal. If there is no reverse path route on the same interface from which the packet was received, it might mean that the source address was modified. If Unicast RPF does not find a reverse path for the packet, the packet is dropped. If internal nodes automatically configure an address based on a prefix from a bogus Router Advertisement a dangerous situation may exist. An internal host may contact an internal server which responds with a packet that could be routed outside of the network via default routing (because the routers do not recognize the destination address as an internal address). To prevent this, filtering should be applied to network interfaces between internal host LANs and internal server LANs to insure that source addresses have valid prefixes.
STIG Date
Perimeter L3 Switch Security Technical Implementation Guide - Cisco 2018-11-28

Details

Check Text ( C-12894r1_chk )
Unicast Strict mode: Review the router configuration to ensure uRPF has been configured on all internal interfaces.
Fix Text (F-14172r1_fix)
The network element must be configured to ensure that an ACL is configured to restrict the router from accepting any outbound IP packet that contains an external IP address in the source field.