ARST-RT-000350 - The Arista router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Information

Fragmented ICMP packets can be generated by hackers for DoS attacks such as Ping O' Death and Teardrop. It is imperative that all fragmented ICMP packets are dropped.

Solution

Ensure all Arista routers have their receive path filter configured to drop all fragmented ICMP packets.

Step 1: Configure the ACL to filter the fragmented ICMP packets destined to itself.

LEAF-1A(config)#ip access-list ICMP_FRAGMENTS
LEAF-1A(config-acl-ICMP_FRAGMENTS)# 10 deny ip any any fragments
LEAF-1A(config-acl-ICMP_FRAGMENTS)# 20 permit ip any any
LEAF-1A(config-acl-ICMP_FRAGMENTS)# exit

Step 2: Apply the ACL to the external interfaces.

LEAF-1A(config)#interface ethernet 5
LEAF-1A(config-if-Et5)# ip access-group ICMP_FRAGMENTS in

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Arista_MLS_EOS_4-2x_Y24M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-256017r882393_rule, STIG-ID|ARST-RT-000350, Vuln-ID|V-256017

Plugin: Arista

Control ID: 045c670b2eb947d715d50b0b6298ecb22b521e6ffff02747d39695c4c35e3685