3.11 Ignore ICMP Redirect Messages - persistent ipv6 = 1

Information

These settings control whether Solaris will ignore ICMP redirect messages.

IP redirects should not be necessary in a well-designed and maintained network. Set to a
value of 1 if there is a high risk for a DoS attack. Otherwise, the default value of 0 is
sufficient.

Solution

To enforce this setting for IPv4 packets, use the command-# ipadm set-prop -p _ignore_redirect=1 ipv4To enforce this setting for IPv6 packets, use the command-# ipadm set-prop -p _ignore_redirect=1 ipv6

See Also

https://workbench.cisecurity.org/files/616

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(12), CSCv6|9.2

Plugin: Unix

Control ID: ad94f16cf85c8a884043bd4b147f2453af3432e8b578bbf20d5bb6fac64a7f06