The system administrator will ensure the undetermined transport packet is blocked at the perimeter in an IPv6 enclave by the router.

From Perimeter L3 Switch Security Technical Implementation Guide

Part of IPv6 Undetermined transport is not blocked

SV-15361r1_rule The system administrator will ensure the undetermined transport packet is blocked at the perimeter in an IPv6 enclave by the router.

Vulnerability discussion

One of the fragmentation weaknesses known in IPv6 is the undetermined transport packet. This is a packet that contains an undetermined protocol due to fragmentation. Depending on the length of the IPv6 extension header chain, the initial fragment may not contain the layer four port information of the packet.

Check content

Review the firewall filter or have the SA provide the router filter mitigating the vulnerability. IOS Procedure: Verify that an ACL for IPv6 has been defined to deny packets with unknown or invalid payload, and log all violations. The ACL should be defined on the ingress and egress filters and should look as shown in the following example: ipv6 access-list inbound-to-enclave remark prohibit unknown protocols deny ipv6 any any undetermined-trans log …

Fix text

Ensure the undetermined transport command is implemented.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.