The system must ignore ICMP redirect messages.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-216137 | SOL-11.1-050070 | SV-216137r959010_rule | Low |
| Description |
| Ignoring ICMP redirect messages reduces the likelihood of denial of service attacks. |
| STIG | Date |
| Solaris 11 X86 Security Technical Implementation Guide | 2024-11-25 |
Details
| Check Text (C-17375r372793_chk) |
| Determine if ICMP redirect messages are ignored. # ipadm show-prop -p _ignore_redirect -co current ipv4 # ipadm show-prop -p _ignore_redirect -co current ipv6 If the output of all commands is not "1", this is a finding. |
| Fix Text (F-17373r372794_fix) |
| The Network Management profile is required. Disable ignore redirects for IPv4 and IPv6. # pfexec ipadm set-prop -p _ignore_redirect=1 ipv4 # pfexec ipadm set-prop -p _ignore_redirect=1 ipv6 |