The router must check inbound traffic to ensure the communications are coming from an authorized source and are routed to an authorized destination.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000195-RTR-000083	SRG-NET-000195-RTR-000083	SRG-NET-000195-RTR-000083_rule		Medium

Description

Spoofing source addresses occurs when a malicious user outside the network has created packets with a source address belonging to the private address space of the target network. This is an attempt to slip through the perimeter as a member host to gain access to internal resources or to conceal one's identity to perform an attack. It is imperative that all inbound and outbound traffic with spoofed or invalid source addresses is blocked.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000195-RTR-000083_chk )

If this function is performed by another network element, (e.g., firewall, or IDS/IPS), this is not a finding. Verify router filters exist that monitor inbound traffic to ensure the communications are coming from an authorized source and are routed to an authorized destination. If filters do not exist to monitor inbound traffic to ensure communications are coming from an authorized source and routed to an authorized destination, this is a finding.

Fix Text (F-SRG-NET-000195-RTR-000083_fix)
Implement router filters to monitor inbound traffic to ensure the communications are coming from an authorized source and are routed to an authorized destination.