Internet Control Message Types (ICMP) must be blocked inbound from external untrusted networks (e.g., ISP and other non-DoD networks).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3026	NET0911	SV-15366r2_rule	ECSC-1	Medium

Description
Using ICMP messages for information gathering is a process allowing malicious computer attackers to launch attacks against a targeted network. In this stage the malicious attacker will try to determine what the characteristics of the targeted network. Techniques, such as host detection, service detection, network topology mapping, and operating system fingerprinting are often used. The data collected will be used to identify those hosts running network services, which may have a known vulnerability. This vulnerability may allow the malicious attacker to exploit vulnerabilities in the network or gain unauthorized access to those systems. This unauthorized access may become the focal point to the whole targeted network.

Description

Using ICMP messages for information gathering is a process allowing malicious computer attackers to launch attacks against a targeted network. In this stage the malicious attacker will try to determine what the characteristics of the targeted network. Techniques, such as host detection, service detection, network topology mapping, and operating system fingerprinting are often used. The data collected will be used to identify those hosts running network services, which may have a known vulnerability. This vulnerability may allow the malicious attacker to exploit vulnerabilities in the network or gain unauthorized access to those systems. This unauthorized access may become the focal point to the whole targeted network.

STIG	Date
Perimeter Router Security Technical Implementation Guide Cisco	2015-04-06

Details

Check Text ( C-12833r4_chk )
Interfaces peering with commercial ISPs or other non-DoD network sources: Review ACLs configured on external interfaces of network devices connected to untrusted networks (e.g., ISP and other non-DoD networks) are blocking inbound ICMP messages. The following are exceptions are allowed inbound. Exceptions: ICMP messages Echo Reply (type 0) ICMP Destination Unreachable – fragmentation needed (type 3 - code 4) Source Quench (type 4) Parameter Problem (type 12). External Interfaces peering with NIPRNet or SIPRNet: This rule is NA. If ICMP messages are not blocked inbound on external facing interfaces to an ISP and other non-DoD network, this is a finding. Cisco IOS Example: interface FastEthernet 0/0 description external interface peering with ISP or non-DoD network ip address 199.36.92.1 255.255.255.252 ip access-group 100 in … ! Specifically block ICMP fragments access-list 100 deny icmp any any fragments log ! Allow inbound ping response to edge router interface access-list 100 permit icmp any host 199.36.92.1 echo-reply ! Allow inbound ping response to public server interface access-list 100 permit icmp any host 199.36.90.10 echo-reply ! Allow Path MTU to function access-list 100 permit icmp any any packet-too-big ! Allow flow control access-list 100 permit icmp any any source-quench ! Allow bad header message to return access-list 100 permit icmp any any parameter-problem ! And explicitly block all other ICMP packets access-list 100 deny icmp any any log

Check Text ( C-12833r4_chk )

Interfaces peering with commercial ISPs or other non-DoD network sources:
Review ACLs configured on external interfaces of network devices connected to untrusted networks (e.g., ISP and other non-DoD networks) are blocking inbound ICMP messages. The following are exceptions are allowed inbound.

Exceptions:
ICMP messages Echo Reply (type 0)
ICMP Destination Unreachable – fragmentation needed (type 3 - code 4)
Source Quench (type 4)
Parameter Problem (type 12).

External Interfaces peering with NIPRNet or SIPRNet:
This rule is NA.

If ICMP messages are not blocked inbound on external facing interfaces to an ISP and other non-DoD network, this is a finding.

Cisco IOS Example:
interface FastEthernet 0/0
description external interface peering with ISP or non-DoD network
ip address 199.36.92.1 255.255.255.252
ip access-group 100 in
…
! Specifically block ICMP fragments
access-list 100 deny icmp any any fragments log
! Allow inbound ping response to edge router interface
access-list 100 permit icmp any host 199.36.92.1 echo-reply
! Allow inbound ping response to public server interface
access-list 100 permit icmp any host 199.36.90.10 echo-reply
! Allow Path MTU to function
access-list 100 permit icmp any any packet-too-big
! Allow flow control
access-list 100 permit icmp any any source-quench
! Allow bad header message to return
access-list 100 permit icmp any any parameter-problem
! And explicitly block all other ICMP packets
access-list 100 deny icmp any any log

Fix Text (F-44084r4_fix)
Configure ACLs on external interfaces of network devices connected to untrusted networks (e.g., ISP and other non-DoD networks) to block inbound ICMP messages. Exceptions to this rule are listed below. Exceptions: ICMP messages Echo Reply (type 0) ICMP Destination Unreachable – fragmentation needed (type 3 - code 4) Source Quench (type 4) Parameter Problem (type 12)