The network device must not accept any outbound IP packets that contain an illegitimate address in the source address field by enabling Unicast Reverse Path Forwarding (uRPF) Strict mode or via egress ACL.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3164	NET0950	SV-15423r2_rule	ECSC-1	High

Description
When Unicast Reverse Path Forwarding (uRPF) provides an IP address spoof protection capability. When uRPF is enabled in strict mode, the packet must be received on the interface that the router would use to forward the return packet.

STIG	Date
Perimeter Router Security Technical Implementation Guide Cisco	2016-07-07

Details

Check Text ( C-12890r3_chk )
Review the device configuration to validate uRPF or an egress ACL has been configured on all internal interfaces. URPF Example: interface FastEthernet 0/0 description downstream link to enclave LAN ip address 199.36.90.1 255.255.255.0 ip verify unicast source reachable-via rx 102 access-list 102 deny ip any any log ACL Example: interface FastEthernet 0/0 description downstream link to our network ip address 199.36.90.1 255.255.255.0 ip access-group 102 in . . . access-list 102 permit tcp any any established access-list 102 permit udp host [external DNS] any eq domain access-list 102 permit udp host [external DNS] any gt 1023 access-list 102 permit tcp [internal network] [wildcard mask] any eq ftp-data access-list 102 permit tcp [internal network] [wildcard mask] any eq ftp access-list 102 permit tcp [internal network] [wildcard mask] any eq http access-list 102 permit . . . . . . . access-list 102 deny any

Check Text ( C-12890r3_chk )

Review the device configuration to validate uRPF or an egress ACL has been configured on all internal interfaces.

URPF Example:
interface FastEthernet 0/0
description downstream link to enclave LAN
ip address 199.36.90.1 255.255.255.0
ip verify unicast source reachable-via rx 102

access-list 102 deny ip any any log

ACL Example:
interface FastEthernet 0/0
description downstream link to our network
ip address 199.36.90.1 255.255.255.0
ip access-group 102 in
.
.
.
access-list 102 permit tcp any any established
access-list 102 permit udp host [external DNS] any eq domain
access-list 102 permit udp host [external DNS] any gt 1023
access-list 102 permit tcp [internal network] [wildcard mask] any eq ftp-data
access-list 102 permit tcp [internal network] [wildcard mask] any eq ftp
access-list 102 permit tcp [internal network] [wildcard mask] any eq http
access-list 102 permit . . . . . . .
access-list 102 deny any

Fix Text (F-3189r5_fix)
Configure the network device from accepting any outbound IP packet that contains an illegitimate address in the source address field by enabling uRPF Strict mode or via egress ACL.