The administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-30736	NET-IPV6-066	SV-40539r1_rule	ECSC-1	Low

Description
An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in pairs and thus do not require manual configuration because they treat the IPv4 infrastructure as a virtual non-broadcast link, using an IPv4 address embedded in the IPv6 address to find the remote end of the tunnel. In other words, the tunnel destination is determined by the IPv4 address of the external interface of the 6to4 router that is concatenated to the 2002::/16 prefix in the format 2002: V4ADDR::/48. Hence, the imbedded V4ADDR of the 6to4 prefix must belong to the same ipv4 prefix as configured on the external-facing interface of the 6to4 router.

Description

An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in pairs and thus do not require manual configuration because they treat the IPv4 infrastructure as a virtual non-broadcast link, using an IPv4 address embedded in the IPv6 address to find the remote end of the tunnel. In other words, the tunnel destination is determined by the IPv4 address of the external interface of the 6to4 router that is concatenated to the 2002::/16 prefix in the format 2002: V4ADDR::/48. Hence, the imbedded V4ADDR of the 6to4 prefix must belong to the same ipv4 prefix as configured on the external-facing interface of the 6to4 router.

STIG	Date
Perimeter Router Security Technical Implementation Guide Cisco	2015-04-06

Details

Check Text ( C-39311r1_chk )
If the router is functioning as a 6to4 router, verify that an egress filter (inbound on the internal-facing interface) has been configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave. The examples below are using 2002:c612:1::/48 where c612:1 maps to 198.18.0.1 which is the imbedded V4ADDR. The subnet in this example is 2002:c612:1:1::/64. The IPV6 ACL will filter the source address of the IPv6 packets before they are forwarded to the 6to4 tunnel. ipv6 general-prefix 6TO4_PREFIX 6to4 FastEthernet0/1 ! interface Tunnel0 ipv6 address 2000:c0a8:6301::1/64 tunnel source FastEthernet0/0 tunnel mode ipv6ip 6to4 ! interface FastEthernet0/0 ip address 10.1.12.1 255.255.255.0 ipv6 address 6TO4_PREFIX ::1:0:0:0:1/64 ipv6 traffic-filter IPV6_EGRESS_FILTER in ! interface FastEthernet0/1 description DISN CORE facing ip address 198.18.0.1 255.255.255.0 ! ipv6 route 2002::/16 Tunnel0 ! ipv6 access-list IPV6_EGRESS_FILTER permit ipv6 2002:C612:1::/48 any deny ipv6 any any log Note: normally you would want to configure the internal interface dual stack, allthough IPv6 only is possible.

Check Text ( C-39311r1_chk )

If the router is functioning as a 6to4 router, verify that an egress filter (inbound on the internal-facing interface) has been configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

The examples below are using 2002:c612:1::/48 where c612:1 maps to 198.18.0.1 which is the imbedded V4ADDR. The subnet in this example is 2002:c612:1:1::/64. The IPV6 ACL will filter the source address of the IPv6 packets before they are forwarded to the 6to4 tunnel.

ipv6 general-prefix 6TO4_PREFIX 6to4 FastEthernet0/1
!
interface Tunnel0
ipv6 address 2000:c0a8:6301::1/64
tunnel source FastEthernet0/0
tunnel mode ipv6ip 6to4
!
interface FastEthernet0/0
ip address 10.1.12.1 255.255.255.0
ipv6 address 6TO4_PREFIX ::1:0:0:0:1/64
ipv6 traffic-filter IPV6_EGRESS_FILTER in
!
interface FastEthernet0/1
description DISN CORE facing
ip address 198.18.0.1 255.255.255.0
!
ipv6 route 2002::/16 Tunnel0
!
ipv6 access-list IPV6_EGRESS_FILTER
permit ipv6 2002:C612:1::/48 any
deny ipv6 any any log

Note: normally you would want to configure the internal interface dual stack, allthough IPv6 only is possible.

Fix Text (F-34421r1_fix)
If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.