Inbound IP packets using RFC 1918 address space (10.0.0.0/8, 172.16.0.0 /12, and 192.168.0 /16) must be blocked, denied, or dropped at the perimeter device.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Inbound IP packets using RFC 1918 address space (10.0.0.0/8, 172.16.0.0 /12, and 192.168.0 /16) must be blocked, denied, or dropped at the perimeter device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-14692	NET0927	SV-15392r2_rule	ECSC-1	High

Description
This type of IP address spoofing occurs when someone outside the network uses an RFC1918 address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that information to perform destructive acts on or to the network.

STIG	Date
Perimeter Router Security Technical Implementation Guide	2015-07-01

Details

Check Text ( C-12859r2_chk )
Review the perimeter device configuration to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the RFC1918 IP address space of 10.0.0.0/8, 172.16.0.0 /12, and 192.168.0 /16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly.

Fix Text (F-14157r3_fix)
Configure the perimeter device to ensure access control lists are configured to block, deny, or drop inbound IP addresses using the RFC1918 IP address space of 10.0.0.0/8, 172.16.0.0 /12, and 192.168.0 /16. Depending on the security posture of the access control list, this requirement may be met explicitly or inexplicitly.