The firewall must block or restrict inbound IP packets destined to the control plane of the firewall itself.

From Firewall Security Requirements Guide Requirements

Associated with: CCI-002403

SRG-NET-000364-FW-000034_rule The firewall must block or restrict inbound IP packets destined to the control plane of the firewall itself.

Vulnerability discussion

As a critical security system, perimeter firewalls must be safeguarded against direct attacks to the device. The firewall must have a filter that rejects requests for access or services where the source address received by the firewall specifies an external address and the destination address specifies the control plane of the firewall.

Check content

Review the device configuration to determine if filters are in place to block loopback addresses. Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure). If inbound IP packets destined to the control plane of the firewall itself are not blocked or restricted by an ingress firewall filter, this is a finding.

Fix text

Establish ingress filters to block or restrict inbound IP packets destined to the control plane of the firewall itself.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.