Perimeter Router Security Technical Implementation Guide

The Perimeter Router Security Technical Implementation Guide (V8 R32) has 132 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

132STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V8 · R32

CurrentPublished Fri Jan 25 2019

The network device must block IPv6 multicast addresses used as a source address.

Perimeter Router Security Technical Implementation Guide

Assessment Title

Rule Text

The network device must block IPv6 multicast addresses used as a source address.

Description

Discussion Text

IPv6 multicast addresses should never be a source address. They should only be destination addresses.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-14697

Rule

SV-15407r3_rule

Severity

medium

Rule Version

NET-IPV6-029

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the perimeter router configuration to ensure filters are in place to restrict the IP addresses. Verify that ingress and egress ACLs for IPv6 have been defined to deny the multicast source addresses and log all violations.

Implementation Procedure

Fix Text

Configure the perimeter router access control lists to deny any IPv6 multicast address used as a source address.

STIG check 29 of 132 in the Perimeter Router STIG checklist

← Previous · V-14696Network devices must be configured to restrict the acceptance of any IP packets from the unspecified address, (0:0:0:0:0:0:0:0 or ::/128).Next · V-14698 →The IAO/NSO will ensure IPv6 addresses with embedded IPv4-compatible IPv6 addresses are blocked on the ingress and egress filters, (0::/96).