Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The Palo Alto Networks security platform must block outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages.
Description
Discussion Text
Internet Control Message Protocol (ICMP) messages are used to provide feedback about problems in the network. These messages are sent back to the sender to support diagnostics. However, some messages can also provide host information and network topology that may be exploited by an attacker.
Review the vendor documentation for more information about "How to Allow/Block ICMP Error Reporting Packets".
Note that this setting is only available in the Zone Protection profile option, not in the DoS protection profile. Thus, where IDS is part of the function of Palo Alto, a Zone Protection profile is required to comply with this requirement.
Review the vendor documentation for more information about "How to Allow/Block ICMP Error Reporting Packets".
Note that this setting is only available in the Zone Protection profile option, not in the DoS protection profile. Thus, where IDS is part of the function of Palo Alto, a Zone Protection profile is required to comply with this requirement.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.