From Perimeter Router Security Technical Implementation Guide Cisco
Part of Disable vulnerable ICMP messages on external int.
The Internet Control Message Protocol version 6 (ICMPv6) supports IPv6 traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMPv6 messages under a wide variety of conditions. ICMPv6 messages are commonly used by attackers for network mapping and diagnosis: Host unreachable, and Redirect.
Review the active configuration to determine if controls have been defined to ensure router has ICMPv6 unreachables or redirects disabled any external interfaces. interface FastEthernet 0/0 ipv6 address 2001::0:0:1/64 ip access-group 101 in no ipv6 redirects no ipv6 unreachables no ipv6 mask-reply In addition, host unreachable messages will be sent in reply to black-hole routes. Be sure that the Null0 interface also has no ip unreachable defined if there are static routes destined for this interface. interface null0 no ipv6 unreachables Alterative. The purpose of configuring no ip unreachables is to suppress the router from sending an ICMP unreachable message (i.e. Administratively Prohibited, Host Unreachable, etc) out an external interface when it receives a packet that is denied by an ACL or for which it has no route. The side effect of this configuration is breaking PMTUD. If a router receives a packet that must be forwarded to the next-hop out an interface whose MTU is too small and the Don’t Fragment bit is on, the normal behavior of the router is to send back a Packet Too Big (PTB) message (ICMP Type 3 Code 4) towards the originating host. Configuring no ip unreachbles on the interface in which the larger packet was received will suppress this normal behavior and therefore disrupt PMTUD. An alternative to configuring no ip unreachables is to filter Host Unreachable messages generated by the router and drop these messages using the following configuration steps: 1) Configure a named ACL with a deny icmp any any for type3 code 4 followed by a permit icmp any any. This ACL will exclude PTB messages from being dropped by the local policy. 2) Configure a route-map to match on this named ACL. 3) For any matches, set the interface to null0. 4) Apply the route-map as local policy (for router generated traffic) 5) Configure no ip unreachables on the null0 interface. ! interface Null0 no ipv6 unreachables ! ipv6 local policy route-map LOCAL_POLICY ! ipv6 access-list extended FILTER_ICMP deny icmp any any packet-too-big permit icmp any any deny ipv6 any any ! ! ! ! route-map LOCAL_POLICY permit 10 match ip address FILTER_ICMP set interface Null0 Note: To ensure that internal hosts receive the unreachable messages, you can configure a deny statement for any internal destination network prior to the permit icmp any any. This will exclude unreachable messages destined for internal hosts from matching the route map and being forwarded to the null interface.
The network element configuration must be changed to ensure ICMPv6 unreachables and redirects are disabled at all external interfaces.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer