Details
The system administrator will ensure the undetermined transport packet is blocked at the perimeter in an IPv6 enclave by the router.
One of the fragmentation weaknesses known in IPv6 is the undetermined transport packet. This is a packet that contains an undetermined protocol due to fragmentation. Depending on the length of the IPv6 extension header chain, the initial fragment may not contain the layer four port information of the packet.
NOTE: Change 'IPV6_INGRESS_ACL' to the access control list for IPv6 inbound connection filtering.
Solution
Ensure the undetermined transport command is implemented.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Cisco.
References
- 800-53|SC-7(11)
- CAT|II
- Rule-ID|SV-15361r1_rule
- STIG-ID|NET-IPV6-006
- Vuln-ID|V-14683
Comments
Please sign in to leave a comment.