Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Inbound IP packets using link-local address space (169.254.0.0/16) must be blocked, denied, or dropped at the perimeter device.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-14690 | NET0924 | SV-15387r2_rule | ECSC-1 | High |
| Description |
|---|
| This type of IP address spoofing occurs when someone outside the network uses a link-local address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that information to perform destructive acts on or to the network. |
| STIG | Date |
|---|---|
| Perimeter Router Security Technical Implementation Guide Cisco | 2016-01-04 |
Details
| Check Text ( C-12854r3_chk ) |
|---|
| Review the perimeter device configuration to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the link-local IP address space of 169.254.0.0/16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly. Config Example: ! interface FastEthernet 0/0 description to NIPRNet core router ip address 199.36.92.1 255.255.255.252 ip access-group 100 in ... access-list 100 deny ip 169.254.0.0 0.0.255.255 any log |
| Fix Text (F-14155r3_fix) |
|---|
| Configure the perimeter device to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the local host IP address space of 169.254.0.0/16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly. |