Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic.

From Perimeter Router Security Technical Implementation Guide Juniper

Part of IPv4 Interfaces in NAT-PT receive IPv6

Associated with IA controls: ECSC-1

SV-16078r2_rule Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic.

Vulnerability discussion

Network Address Translation with Protocol Translation (NAT-PT), defined in [RFC2766], is a service that can be used to translate data sent between IP-heterogeneous nodes. NAT-PT translates IPv4 datagrams into a semantically equivalent IPv6 datagram or vice versa. For this service to work it has to be located in the connection point between the IPv4 network and the IPv6 network. The PT-part of the NAT-PT handles the interpretation and translation of the semantically equivalent IP header, either from IPv4 to IPv6 or from IPv6 to IPv4. Like NAT, NATPT also uses a pool of addresses which it dynamically assigns to the translated datagrams.The NAT-PT architecture is not one of the preferred DoD IPv6 transition paradigms due to the deprecation of NAT-PT within the DoD community. However, as described in the "DoD IPv6 Guidance for Information Assurance (IA) Milestone Objective 3 (MO3) Requirements, some services/agencies may choose to implement this transition mechanism within an enclave. The following sub-sections provide guidelines for the use of NAT-PT within a controlled enclave.In addition to the single point of failure, the reduced performance of an application level gateway, coupled with limitations on the kinds of applications that work, decreases the overall value and utility of the network. NAT-PT also inhibits the ability to deploy security at the IP layer.

Check content

Review network diagram in the STIG and ensure the architecture is designed correctly. The interface facing the IPv4 LAN network must not receive IPv6 traffic. This can be accomplished by not having IPv6 on the interface supporting the IPv4 network. In addition a filter can be added to deny IPv6 at this interface. If interfaces supporting IPv4 in NAT-PT receive IPv6 traffic, this is a finding.

Fix text

This can be accomplished by not having IPv6 enabled on the interface supporting the IPv4 network. In addition a filter can be added to deny IPv6 at the interface.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer