JUNI-RT-000170 - The Juniper router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Information

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis.

Solution

[edit firewall family inet]
set filter FILTER_INBOUND term DENY_BY_DEFAULT then log discard

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_Router_Y24M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CAT|II, CCI|CCI-002385, Rule-ID|SV-217022r855890_rule, STIG-ID|JUNI-RT-000170, STIG-Legacy|SV-101039, STIG-Legacy|V-90829, Vuln-ID|V-217022

Plugin: Juniper

Control ID: 2203534940d84ea3454c80eafadc949d723715430541eaf477610ee3df510d8f