The firewall implementation must block, deny, or drop inbound IP packets using an RFC 1918 address space (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) at the perimeter device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000019-FW-000257	SRG-NET-000019-FW-000257	SRG-NET-000019-FW-000257_rule		Medium

Description
This type of IP address spoofing occurs when someone outside the network uses an RFC1918 address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that information to perform destructive acts on or to the network.

STIG	Date
Firewall Security Requirements Guide	2014-07-07

Details

Check Text ( C-SRG-NET-000019-FW-000257_chk )
Review the configuration of the firewall implementation. If there is not a filter configured to block, deny, or drop inbound IP addresses using the RFC1918 IP address spaces of 10.0.0.0/8, 172.16.0.0/12, and 192.168.0/16, this is a finding.

Fix Text (F-SRG-NET-000019-FW-000257_fix)
Configure the firewall implementation to block, deny, or drop inbound IP addresses using the RFC1918 IP address spaces of 10.0.0.0/8, 172.16.0.0 /12, and 192.168.0/16.