IP forwarding for IPv4 must not be enabled, unless the system is a router.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-12023	GEN005600	SV-28581r1_rule	ECSC-1	Medium

Description
If the system is configured for IP forwarding and is not a designated router, it could be used to bypass network security by providing a path for communication not filtered by network devices.

STIG	Date
Solaris 10 SPARC Security Technical Implementation Guide	2014-04-04

Details

Check Text ( C-28844r1_chk )
Determine if the system is configured for IPv4 forwarding. # svcs | grep svc:/network/ipv4-forwarding If the service is enabled, this is a finding.

Fix Text (F-25853r1_fix)
Disable IPv4 forwarding on the system. # svcadm disable svc:/network/ipv4-forwarding