GEN007920 - The system must not forward IPv6 source-routed packets - 'net.ipv6.conf.all.forwarding'

Information

Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.

Solution

Configure the system to not forward IPv6 source-routed packets.

Procedure:
Edit the /etc/sysctl.conf file to include:
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.default.forwarding = 0

Reload the kernel parameters:
# sysctl -p

See Also

http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4, CAT|II, CCI|CCI-001551, Group-ID|V-22553, Rule-ID|SV-37618r1_rule, STIG-ID|GEN007920, Vuln-ID|V-22553

Plugin: Unix

Control ID: a653acfa97f44f6b68e3f3affaad4ad621707bad4b1e41366c0ebf9bbd703443