The router must block, deny, or drop inbound IP packets using a link-local address space (169.254.0.0/16) at the perimeter device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000205-RTR-000098	SRG-NET-000205-RTR-000098	SRG-NET-000205-RTR-000098_rule		Medium

Description
This type of IP address spoofing occurs when someone outside the network uses a link-local address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that information to perform destructive acts on or to the network.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000205-RTR-000098_chk )
Review the perimeter router configuration to verify filters are configured to block, deny, or drop inbound IP addresses using the link-local address space of 169.254.0.0/16. Depending on the security posture of the filter, this requirement may be met explicitly or inexplicitly. If there is not a filter configured to block, deny, or drop inbound IP addresses using the link-local address space of 169.254.0.0/16, this is a finding.

Check Text ( C-SRG-NET-000205-RTR-000098_chk )

Review the perimeter router configuration to verify filters are configured to block, deny, or drop inbound IP addresses using the link-local address space of 169.254.0.0/16. Depending on the security posture of the filter, this requirement may be met explicitly or inexplicitly. If there is not a filter configured to block, deny, or drop inbound IP addresses using the link-local address space of 169.254.0.0/16, this is a finding.

Fix Text (F-SRG-NET-000205-RTR-000098_fix)
Configure the perimeter router to apply filters that are configured to block, deny, or drop inbound IP addresses using the link-local address space of 169.254.0.0/16. Depending on the security posture of the filter, this requirement may be met explicitly or inexplicitly.