The system must not forward IPv6 source-routed packets.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
GEN007920-ESXI5-PF	GEN007920-ESXI5-PF	GEN007920-ESXI5-PF_rule		Medium

Description
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Applicable, but permanent finding - The hypervisor does not support this functionality (No ndd/ipf network tuning facility). The hypervisor's network segment must not be routed, except possibly to networks where other management-related entities are found. Production virtual machine traffic must not be routed to this network.

Description

Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Applicable, but permanent finding - The hypervisor does not support this functionality (No ndd/ipf network tuning facility). The hypervisor's network segment must not be routed, except possibly to networks where other management-related entities are found. Production virtual machine traffic must not be routed to this network.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-GEN007920-ESXI5-PF_chk )
ESXi does not support this requirement. This is a permanent finding.

Fix Text (F-GEN007920-ESXI5-PF_fix)
This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.