Inbound IP packets using link-local address space (169.254.0.0/16) must be blocked, denied, or dropped at the perimeter device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-14690	NET0924	SV-15388r2_rule	ECSC-1	High

Description
This type of IP address spoofing occurs when someone outside the network uses a link-local address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that information to perform destructive acts on or to the network.

STIG	Date
Perimeter Router Security Technical Implementation Guide Juniper	2017-06-29

Details

Check Text ( C-12855r2_chk )
Review the perimeter device configuration to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the link-local IP address space of 169.254.0.0/16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly. [edit interfaces] fe-2/0/10 { description "to NIPRNet core router"; speed 100m; link-mode full-duplex; unit 0 { family inet { filter { input ingress-filter; } address 199.36.92.1/30; } } } [edit firewall] family inet { filter ingress-filter { term term-1 { from { source-address { 169.254.0.0/16; } } then discard; } } }

Check Text ( C-12855r2_chk )

Review the perimeter device configuration to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the link-local IP address space of 169.254.0.0/16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly.

[edit interfaces]
fe-2/0/10 {
description "to NIPRNet core router";
speed 100m;
link-mode full-duplex;
unit 0 {
family inet {
filter {
input ingress-filter;
}
address 199.36.92.1/30;
}
}
}

[edit firewall]
family inet {
filter ingress-filter {
term term-1 {
from {
source-address {
169.254.0.0/16;
}
}
then discard;
}
}
}

Fix Text (F-14155r3_fix)
Configure the perimeter device to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the local host IP address space of 169.254.0.0/16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly.