The router must ensure that IPv6 addresses with embedded IPv4-mapped IPv6 addresses are blocked by ingress and egress filters.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000031-RTR-000034	SRG-NET-000031-RTR-000034	SRG-NET-000031-RTR-000034_rule		Low

Description
The IPv6 transition mechanisms include a technique for hosts and routers to dynamically tunnel IPv6 packets over IPv4 routing infrastructure. IPv6 nodes that use this technique are assigned special IPv6 unicast addresses that carry a global IPv4 address in the low-order 32 bits. IPv4-mapped IPv6 addresses should never appear as a source or destination address. These addresses begin with 0000 and have 'FFFF' in the 16-bit field preceding the IPv4 address. There is little use for the IPv4-mapped addresses and there has been some confusion over what their intended use was.

Description

The IPv6 transition mechanisms include a technique for hosts and routers to dynamically tunnel IPv6 packets over IPv4 routing infrastructure. IPv6 nodes that use this technique are assigned special IPv6 unicast addresses that carry a global IPv4 address in the low-order 32 bits. IPv4-mapped IPv6 addresses should never appear as a source or destination address. These addresses begin with 0000 and have 'FFFF' in the 16-bit field preceding the IPv4 address. There is little use for the IPv4-mapped addresses and there has been some confusion over what their intended use was.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000031-RTR-000034_chk )
Review the perimeter router configuration to ensure filters are in place to restrict the IP addresses explicitly, or inexplicitly. Verify that ingress and egress filters for IPv6 have been defined to deny the embedded IPv4-mapped IPv6 addresses and log all violations. If ingress and egress filters are not configured to deny embedded IPv4-mapped IPv6 addresses and log violations, this is a finding.

Check Text ( C-SRG-NET-000031-RTR-000034_chk )

Review the perimeter router configuration to ensure filters are in place to restrict the IP addresses explicitly, or inexplicitly. Verify that ingress and egress filters for IPv6 have been defined to deny the embedded IPv4-mapped IPv6 addresses and log all violations. If ingress and egress filters are not configured to deny embedded IPv4-mapped IPv6 addresses and log violations, this is a finding.

Fix Text (F-SRG-NET-000031-RTR-000034_fix)
Configure the router filters to restrict IP addresses that contain any embedded IPv4-mapped IPv6 addresses.