STIGQter: STIG Summary: Cisco IOS Switch RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Cisco perimeter switch must be configured drop IPv6 packets with a Routing Header type 0, 1, or 3-255.

DISA Rule

SV-237763r648802_rule

Vulnerability Number

V-237763

Group Title

SRG-NET-000364-RTR-000201

Rule Version

CISC-RT-000393

Severity

CAT II

CCI(s)

• CCI-002403 - The information system only allows incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

Configure the switch to drop IPv6 packets with Routing Header of type 0, 1, or 3-255 as shown in the example below.
SW1(config)#ipv6 access-list FILTER_IPV6
SW1(config-ipv6-acl)#permit ipv6 any host 2001:DB8::0:1:1:1234 routing-type 2
SW1(config-ipv6-acl)#deny ipv6 any any routing log
SW1(config-ipv6-acl)#permit …
…
…
…
SW1(config-ipv6-acl)#deny ipv6 any any log
SW1(config-ipv6-acl)#exit
SW1(config)#int g1/0
SW1(config-if)#ipv6 traffic-filter FILTER_IPV6

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the switch configuration to determine if it is configured to drop IPv6 packets containing a Routing Header of type 0, 1, or 3-255.

Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

interface gigabitethernet1/0
ipv6 address 2001::1:0:22/64
ipv6 traffic-filter FILTER_IPV6 in


Step 2: Verify that the ACL drops IPv6 packets with a Routing Header type 0, 1, or 3-255
as shown in the example below.

ipv6 access-list FILTER_IPV6
permit ipv6 any host 2001:DB8::1:1:1234 routing-type 2
deny ipv6 any any log routing
permit ipv6 …
…
…
…
deny ipv6 any any log

Note: The example above allows routing-type 2 in the event Mobility IPv6 is deployed.

If the switch is not configured to drop IPv6 packets containing a Routing Header of type 0, 1, or 3-255, this is a finding.

Vulnerability Number

V-237763

Documentable

False

Rule Version

CISC-RT-000393

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the switch configuration to determine if it is configured to drop IPv6 packets containing a Routing Header of type 0, 1, or 3-255.

Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

interface gigabitethernet1/0
ipv6 address 2001::1:0:22/64
ipv6 traffic-filter FILTER_IPV6 in


Step 2: Verify that the ACL drops IPv6 packets with a Routing Header type 0, 1, or 3-255
as shown in the example below.

ipv6 access-list FILTER_IPV6
permit ipv6 any host 2001:DB8::1:1:1234 routing-type 2
deny ipv6 any any log routing
permit ipv6 …
…
…
…
deny ipv6 any any log

Note: The example above allows routing-type 2 in the event Mobility IPv6 is deployed.

If the switch is not configured to drop IPv6 packets containing a Routing Header of type 0, 1, or 3-255, this is a finding.

Check Content Reference

M

Target Key

4065

Comments