NET-IPV6-006 - Undetermined transport is not blocked

Details

The system administrator will ensure the undetermined transport packet is blocked at the perimeter in an IPv6 enclave by the router.



One of the fragmentation weaknesses known in IPv6 is the undetermined transport packet. This is a packet that contains an undetermined protocol due to fragmentation. Depending on the length of the IPv6 extension header chain, the initial fragment may not contain the layer four port information of the packet.



NOTE: Change 'IPV6_INGRESS_ACL' to the access control list for IPv6 inbound connection filtering.


Solution

Ensure the undetermined transport command is implemented.


Supportive Information

The following resource is also helpful.

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Cisco.


References


Source