Details

The network element must be configured to restrict the acceptance of any IP packets from the unspecified address, (0-0-0-0-0-0-0-0 or –/128).

The address 0-0-0-0-0-0-0-0, also defined –/128 is called the unspecified address. It must never be assigned to any node. It indicates the absence of an address. One example of its use is in the Source Address field of any IPv6 packets sent by an initializing host before it has learned its own address. The unspecified address must not be used as the destination address of IPv6 packets or in IPv6 Routing Headers. A router must never forward an IPv6 packet with a source address of unspecified.

NOTE: Change ‘IPV6_INGRESS_ACL’ to the access control list for IPv6 inbound connection filtering.

Solution

The administrator will configure the router ACLs to restrict IP addresses that contain any Unspecified address.

Supportive Information

The following resource is also helpful.

• https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R32_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Cisco.

References

• 800-53|SC-7(11)
• CAT|I
• Rule-ID|SV-15405r1_rule
• STIG-ID|NET-IPV6-028
• Vuln-ID|V-14696

Source

• Tenable.com/audits