The router must restrict the acceptance of any IP packets from the unspecified address (::/128).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000205-RTR-000105	SRG-NET-000205-RTR-000105	SRG-NET-000205-RTR-000105_rule		Medium

Description
The address 0:0:0:0:0:0:0:0, also defined ::/128 is called the unspecified address. It must never be assigned to any node. It indicates the absence of an address. One example of its use is in the Source Address field of any IPv6 packets sent by an initializing host before it has learned its own address. The unspecified address must not be used as the destination address of IPv6 packets or in IPv6 Routing Headers. A router must never forward an IPv6 packet with a source address of unspecified.

Description

The address 0:0:0:0:0:0:0:0, also defined ::/128 is called the unspecified address. It must never be assigned to any node. It indicates the absence of an address. One example of its use is in the Source Address field of any IPv6 packets sent by an initializing host before it has learned its own address. The unspecified address must not be used as the destination address of IPv6 packets or in IPv6 Routing Headers. A router must never forward an IPv6 packet with a source address of unspecified.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000205-RTR-000105_chk )
Review the perimeter router configuration to verify filters are in place to restrict the IPv6 addresses explicitly, or inexplicitly. Verify that ingress and egress filters for IPv6 have been defined to deny the Unspecified Address (::/128), and log all violations. If the ingress and egress filters for IPv6 are not defined to deny the Unspecified Address (::/128), and log all violations, this is a finding.

Check Text ( C-SRG-NET-000205-RTR-000105_chk )

Review the perimeter router configuration to verify filters are in place to restrict the IPv6 addresses explicitly, or inexplicitly. Verify that ingress and egress filters for IPv6 have been defined to deny the Unspecified Address (::/128), and log all violations. If the ingress and egress filters for IPv6 are not defined to deny the Unspecified Address (::/128), and log all violations, this is a finding.

Fix Text (F-SRG-NET-000205-RTR-000105_fix)
Configure the perimeter router ingress and egress filters for IPv6 to deny the Unspecified Address (::/128).