NET-IPV6-066 - 6-to-4 router not filtering invalid source address - 'ipv6 traffic-filter IPV6_EGRESS_ACL in'

Information

The administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002-V4ADDR--/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in pairs and thus do not require manual configuration because they treat the IPv4 infrastructure as a virtual non-broadcast link, using an IPv4 address embedded in the IPv6 address to find the remote end of the tunnel. In other words, the tunnel destination is determined by the IPv4 address of the external interface of the 6to4 router that is concatenated to the 2002--/16 prefix in the format 2002- V4ADDR--/48. Hence, the imbedded V4ADDR of the 6to4 prefix must belong to the same ipv4 prefix as configured on the external-facing interface of the 6to4 router.

NOTE: Change 'INTERNAL_INTERFACE' to the router's interface that connects to your LAN.
NOTE: Change 'IPV6_EGRESS_ACL' to the access control list for IPv6 inbound connection filtering and verify the ACL is applied to the proper interface.

Solution

If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002-V4ADDR--/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R32_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(11), CAT|III, Rule-ID|SV-40537r1_rule, STIG-ID|NET-IPV6-066, Vuln-ID|V-30736

Plugin: Cisco

Control ID: a757304598d844417fca8a48916da581079d4aaf86d51f2bd5bd71d0a8ec0e28