The network device must not accept any outbound IP packets that contain an illegitimate address in the source address field by enabling Unicast Reverse Path Forwarding (uRPF) Strict mode or via egress ACL.

From Perimeter Router Security Technical Implementation Guide Cisco

Part of uRPF strict mode or ACL not enabled on egress interface.

Associated with IA controls: ECSC-1

SV-15423r2_rule The network device must not accept any outbound IP packets that contain an illegitimate address in the source address field by enabling Unicast Reverse Path Forwarding (uRPF) Strict mode or via egress ACL.

Vulnerability discussion

When Unicast Reverse Path Forwarding (uRPF) provides an IP address spoof protection capability. When uRPF is enabled in strict mode, the packet must be received on the interface that the router would use to forward the return packet.

Check content

Review the device configuration to validate uRPF or an egress ACL has been configured on all internal interfaces. URPF Example: interface FastEthernet 0/0 description downstream link to enclave LAN ip address 199.36.90.1 255.255.255.0 ip verify unicast source reachable-via rx 102 access-list 102 deny ip any any log ACL Example: interface FastEthernet 0/0 description downstream link to our network ip address 199.36.90.1 255.255.255.0 ip access-group 102 in . . . access-list 102 permit tcp any any established access-list 102 permit udp host [external DNS] any eq domain access-list 102 permit udp host [external DNS] any gt 1023 access-list 102 permit tcp [internal network] [wildcard mask] any eq ftp-data access-list 102 permit tcp [internal network] [wildcard mask] any eq ftp access-list 102 permit tcp [internal network] [wildcard mask] any eq http access-list 102 permit . . . . . . . access-list 102 deny any

Fix text

Configure the network device from accepting any outbound IP packet that contains an illegitimate address in the source address field by enabling uRPF Strict mode or via egress ACL.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.