Home
Security Hardening
DISA STIG Cisco Firewall V8R25

DISA STIG Cisco Firewall V8R25

NET-IPV6-005 – The IAO must ensure firewalls deployed in an IPv6 enclave meet the requirements defined by DITO and NSA milestone objective 3
Details The IAO must ensure firewalls deployed in an IPv6 enclave meet the requirements defined by DITO and NSA milestone...
NET-IPV6-004 – Router advertisements must be suppressed on all external-facing IPv6-enabled interfaces.
Details Many of the known attacks in stateless autoconfiguration are defined in RFC 3756 were present in IPv4 ARP attacks....
NET-IPV6-024 – IPv6 6-to-4 addresses with a prefix of 2002::/16 must be filtered at the perimeter. – 2002 inbound
Details ‘6-to-4’ is a tunneling IPv6 transition mechanism [RFC 3056]. The guidance is the default case, which assumes that 6-to-4...
NET-IPV6-024 – IPv6 6-to-4 addresses with a prefix of 2002::/16 must be filtered at the perimeter. – 2002 outbound
Details ‘6-to-4’ is a tunneling IPv6 transition mechanism [RFC 3056]. The guidance is the default case, which assumes that 6-to-4...
NET-IPV6-025 – The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave
Details The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave,...
NET-IPV6-035 – IPv6 Jumbo Payload hop by hop header must be blocked.
Details The IPv6 Jumbo Payload allows IP packets to be larger than 65,535 bytes. This feature is only useful on...
NET-IPV6-047 – Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic. – inside IPv6 block in
Details Network Address Translation with Protocol Translation (NAT-PT), defined in [RFC2766], is a service that can be used to translate...
NET-IPV6-047 – Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic. – inside IPv6 block out
Details Network Address Translation with Protocol Translation (NAT-PT), defined in [RFC2766], is a service that can be used to translate...
NET-SRVFRM-003 – Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.
Details Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs...
NET-SRVFRM-004 – The IAO will ensure the Server Farm infrastructure is secured by ACLs on VLAN interfaces between server farms
Details The IAO will ensure the Server Farm infrastructure is secured by ACLs on VLAN interfaces that restrict data originating...

Prev Next

DISA STIG Cisco Firewall V8R25

NET-IPV6-005 – The IAO must ensure firewalls deployed in an IPv6 enclave meet the requirements defined by DITO and NSA milestone objective 3

NET-IPV6-004 – Router advertisements must be suppressed on all external-facing IPv6-enabled interfaces.

NET-IPV6-024 – IPv6 6-to-4 addresses with a prefix of 2002::/16 must be filtered at the perimeter. – 2002 inbound

NET-IPV6-024 – IPv6 6-to-4 addresses with a prefix of 2002::/16 must be filtered at the perimeter. – 2002 outbound

NET-IPV6-025 – The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave

NET-IPV6-035 – IPv6 Jumbo Payload hop by hop header must be blocked.

NET-IPV6-047 – Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic. – inside IPv6 block in

NET-IPV6-047 – Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic. – inside IPv6 block out

NET-SRVFRM-003 – Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.

NET-SRVFRM-004 – The IAO will ensure the Server Farm infrastructure is secured by ACLs on VLAN interfaces between server farms