Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-3164 | NET0950 | SV-15423r2_rule | ECSC-1 | High |
Description |
---|
When Unicast Reverse Path Forwarding (uRPF) provides an IP address spoof protection capability. When uRPF is enabled in strict mode, the packet must be received on the interface that the router would use to forward the return packet. |
STIG | Date |
---|---|
Perimeter Router Security Technical Implementation Guide Cisco | 2018-02-27 |
Check Text ( C-12890r3_chk ) |
---|
Review the device configuration to validate uRPF or an egress ACL has been configured on all internal interfaces. URPF Example: interface FastEthernet 0/0 description downstream link to enclave LAN ip address 199.36.90.1 255.255.255.0 ip verify unicast source reachable-via rx 102 access-list 102 deny ip any any log ACL Example: interface FastEthernet 0/0 description downstream link to our network ip address 199.36.90.1 255.255.255.0 ip access-group 102 in . . . access-list 102 permit tcp any any established access-list 102 permit udp host [external DNS] any eq domain access-list 102 permit udp host [external DNS] any gt 1023 access-list 102 permit tcp [internal network] [wildcard mask] any eq ftp-data access-list 102 permit tcp [internal network] [wildcard mask] any eq ftp access-list 102 permit tcp [internal network] [wildcard mask] any eq http access-list 102 permit . . . . . . . access-list 102 deny any |
Fix Text (F-3189r5_fix) |
---|
Configure the network device from accepting any outbound IP packet that contains an illegitimate address in the source address field by enabling uRPF Strict mode or via egress ACL. |