1. Home
  2. Security Hardening
  3. DISA STIG Cisco IOS Switch RTR V2R1
  4. CISC-RT-000180 – The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.
Searching...

CISC-RT-000180 – The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Details

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Switches automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Disable ip mask-reply on all external interfaces as shown below:

SW1(config)#int g0/1
SW1(config-if)#no ip mask-reply

Supportive Information

The following resource is also helpful.

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Cisco.

References

Source

Updated on July 16, 2022
Was this article helpful?
Yes No

Related Articles