From Perimeter Router Security Technical Implementation Guide Cisco
Part of IPv6 Undetermined transport is not blocked
One of the fragmentation weaknesses known in IPv6 is the undetermined transport packet. This is a packet that contains an undetermined protocol due to fragmentation. Depending on the length of the IPv6 extension header chain, the initial fragment may not contain the layer four port information of the packet.
Review the firewall filter or have the SA provide the router filter mitigating the vulnerability. IOS Procedure: Verify that an ACL for IPv6 has been defined to deny packets with unknown or invalid payload, and log all violations. The ACL should be defined on the ingress and egress filters and should look as shown in the following example: ipv6 access-list inbound-to-enclave remark prohibit unknown protocols deny ipv6 any any undetermined-trans log …
Ensure the undetermined transport command is implemented.
Lavender hyperlinks in small type off to the right (of CSS
id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header
Powered by sagemincer