The firewall implementation must block, deny, or drop inbound IPv4 packets using a link-local address space (169.254.0.0/16) at the perimeter device.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| SRG-NET-000019-FW-000256 | SRG-NET-000019-FW-000256 | SRG-NET-000019-FW-000256_rule | Medium |
| Description |
|---|
| This type of IPv4 address spoofing occurs when someone outside the network uses a link-local address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that information to perform destructive acts on or to the network. |
| STIG | Date |
|---|---|
| Firewall Security Requirements Guide | 2014-07-07 |
Details
| Check Text ( C-SRG-NET-000019-FW-000256_chk ) |
|---|
| Review the configuration of the firewall implementation. If there is not a filter configured to block, deny, or drop inbound IPv4 addresses using the link-local address space of 169.254.0.0/16, this is a finding. |
| Fix Text (F-SRG-NET-000019-FW-000256_fix) |
|---|
| Configure the firewall implementation to block, deny, or drop inbound IPv4 addresses using the link-local address space of 169.254.0.0/16. |