Inbound IP packets using link-local address space (169.254.0.0/16) must be blocked, denied, or dropped at the perimeter device.

From Perimeter L3 Switch Security Technical Implementation Guide

Part of IPv4 Link-local address is not blocked

Associated with IA controls: ECSC-1

SV-15386r2_rule Inbound IP packets using link-local address space (169.254.0.0/16) must be blocked, denied, or dropped at the perimeter device.

Vulnerability discussion

This type of IP address spoofing occurs when someone outside the network uses a link-local address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that information to perform destructive acts on or to the network.

Check content

Review the perimeter device configuration to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the link-local IP address space of 169.254.0.0/16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly.

Fix text

Configure the perimeter device to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the local host IP address space of 169.254.0.0/16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.