NET-IPV6-006 - Ensure the undetermined transport packet is blocked at the perimeter in an IPv6 enclave by the router.

Details

One of the fragmentation weaknesses known in IPv6 is the undetermined transport packet. This is a packet that contains an undetermined protocol due to fragmentation. Depending on the length of the IPv6 extension header chain, the initial fragment may not contain the layer four port information of the packet.



NOTE: Please review the benchmark to ensure target compliance.


Solution

Ensure the undetermined transport command is implemented.


Supportive Information

The following resource is also helpful.

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Juniper.


References


Source