Perimeter Router Security Technical Implementation Guide

The Perimeter Router Security Technical Implementation Guide (V8 R32) has 132 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

132STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V8 · R32

CurrentPublished Fri Jan 25 2019

The IAO/NSO will ensure IPv6 6bone address space is blocked on the ingress and egress filter, (3FFE::/16).

Perimeter Router Security Technical Implementation Guide

Assessment Title

Rule Text

The IAO/NSO will ensure IPv6 6bone address space is blocked on the ingress and egress filter, (3FFE::/16).

Description

Discussion Text

The decommissioned 6bone allocation (3FFE::/16), RFC 3701 must be blocked. It is no longer a trusted source.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-18610

Rule

SV-20165r1_rule

Severity

medium

Rule Version

NET-IPV6-008

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Base Procedure: Review the premise router configuration to ensure filters are in place to restrict the IP addresses explicitly, or inexplicitly. Verify that ingress and egress ACLs for IPv6 have been defined to deny the 6bone address space and log all violations.

Implementation Procedure

Fix Text

The administrator will configure the router ACLs to restrict IP addresses that contain any 6bone addresses.

STIG check 59 of 132 in the Perimeter Router STIG checklist

← Previous · V-18608IPv6 6-to-4 addresses with a prefix of 2002::/16 must be filtered at the perimeter.Next · V-18633 →The network device must drop all inbound and outbound IPv4 and IPv6 packets being tunneled with outdated protocols.