The network element must be configured to restrict the acceptance of any IP packets from the unspecified address, (0:0:0:0:0:0:0:0 or ::/128).

From Perimeter Router Security Technical Implementation Guide Juniper

Part of IPv6 Unspecified ADDR is not blocked

SV-15406r1_rule The network element must be configured to restrict the acceptance of any IP packets from the unspecified address, (0:0:0:0:0:0:0:0 or ::/128).

Vulnerability discussion

The address 0:0:0:0:0:0:0:0, also defined ::/128 is called the unspecified address. It must never be assigned to any node. It indicates the absence of an address. One example of its use is in the Source Address field of any IPv6 packets sent by an initializing host before it has learned its own address.The unspecified address must not be used as the destination address of IPv6 packets or in IPv6 Routing Headers. A router must never forward an IPv6 packet with a source address of unspecified.

Check content

[edit interfaces] fe-2/0/10 { description "to NIPRNet core router"; speed 100m; link-mode full-duplex; unit 0 { family inet6 { filter { input ingress-filter; } address 2001:db8:60::f14b:65a1/64; } } } [edit firewall] family inet6 { filter ingress-filter { term term-1 { from { address { ::/128; } } then discard; } }

Fix text

The administrator will configure the router ACLs to restrict IP addresses that contain any Unspecified Address.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.