NET0911 - Inbound ICMP messages are not blocked - 'permit icmp any any source-quench'

Information

Internet Control Message Types (ICMP) must be blocked inbound from external untrusted networks (e.g., ISP and other non-DoD networks).

Using ICMP messages for information gathering is a process allowing malicious computer attackers to launch attacks against a targeted network. In this stage the malicious attacker will try to determine what the characteristics of the targeted network. Techniques, such as host detection, service detection, network topology mapping, and operating system fingerprinting are often used. The data collected will be used to identify those hosts running network services, which may have a known vulnerability. This vulnerability may allow the malicious attacker to exploit vulnerabilities in the network or gain unauthorized access to those systems. This unauthorized access may become the focal point to the whole targeted network.

NOTE: Change 'AG_INGRESS_ACL_1' to the access-list IP standard access list number for your organization.

Solution

Configure ACLs on external interfaces of network devices connected to untrusted networks (e.g., ISP and other non-DoD networks) to block inbound ICMP messages. Exceptions to this rule are listed below.

Exceptions-

ICMP messages Echo Reply (type 0)
ICMP Destination Unreachable - fragmentation needed (type 3 - code 4)
Source Quench (type 4)
Parameter Problem (type 12)

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R32_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CAT|II, Rule-ID|SV-3026r2_rule, STIG-ID|NET0911, Vuln-ID|V-3026

Plugin: Cisco

Control ID: f8750b2198d337dda60313005d16e966aeaf64f7a4faefc6dbfd5946efb89f87