The system must ignore ICMP redirect messages.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-216137	SOL-11.1-050070	SV-216137r603268_rule		Low

Description
Ignoring ICMP redirect messages reduces the likelihood of denial of service attacks.

STIG	Date
Solaris 11 X86 Security Technical Implementation Guide	2021-11-23

Details

Check Text ( C-17375r372793_chk )
Determine if ICMP redirect messages are ignored. # ipadm show-prop -p _ignore_redirect -co current ipv4 # ipadm show-prop -p _ignore_redirect -co current ipv6 If the output of all commands is not "1", this is a finding.

Fix Text (F-17373r372794_fix)
The Network Management profile is required. Disable ignore redirects for IPv4 and IPv6. # pfexec ipadm set-prop -p _ignore_redirect=1 ipv4 # pfexec ipadm set-prop -p _ignore_redirect=1 ipv6