Teredo packets must be blocked inbound to the enclave and outbound from the enclave.

From Perimeter Router Security Technical Implementation Guide Cisco

Part of Teredo is not blocked by filtering UDP port 3544

Associated with IA controls: ECSC-1

SV-16075r5_rule Teredo packets must be blocked inbound to the enclave and outbound from the enclave.

Vulnerability discussion

Teredo (RFC 4380) is a tunneling mechanism that allows computers to encapsulate IPv6 packets inside IPv4 to traverse IPv4-only networks. It relies on UDP to allow the tunnel to traverse NAT devices. Teredo uses UDP port 3544 to communicate with Teredo relays which access the packet, decapsulated the packet, and route it to the appropriate IPv6 network. While Teredo was proposed by Microsoft, Linux versions do exist.By allowing Teredo tunneling mechanism to be uncontrolled, it can pass malicious IPv6 packets over IPv4 without further inspection of the packet by router and firewall ACLs.

Check content

Inspect the network device configuration to validate Teredo packets, UDP port 3544 is blocked both inbound to the enclave and outbound from the enclave. This requirement must be administered on either the perimeter router or firewall. If Teredo is not blocked one of these devices, this is a finding.

Fix text

Configure either the perimeter router or firewall to block UDP port 3544 traffic inbound and outbound.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.