| Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the handling of source-routed traffic destined to the system itself, not to traffic forwarded by the system to another, such as when IPv6 forwarding is enabled and the system is functioning as a router. Applicable, but permanent finding - The hypervisor does not support this functionality (No ndd/ipf network tuning facility). The hypervisor's network segment must not be routed, except possibly to networks where other management-related entities are found. Production virtual machine traffic must not be routed to this network. |
