From Perimeter L3 Switch Security Technical Implementation Guide - Cisco
Part of RFC1918 addresses are not blocked
Associated with IA controls: ECSC-1
This type of IP address spoofing occurs when someone outside the network uses an RFC1918 address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that information to perform destructive acts on or to the network.
Review the perimeter device configuration to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the RFC1918 IP address space of 10.0.0.0/8, 172.16.0.0 /12, and 192.168.0 /16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly. Config Example: interface FastEthernet 0/0 description to NIPRNet core router ip address 199.36.92.1 255.255.255.252 ip access-group 100 in ….. access-list 100 deny ip 10.0.0.0 0.255.255.255 any log access-list 100 deny ip 172.16.0.0 0.15.255.255 any log access-list 100 deny ip 192.168.0.0 0.0.255.255 any log
Configure the perimeter device to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the RFC1918 IP address space of 10.0.0.0/8, 172.16.0.0 /12, and 192.168.0 /16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer