OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco ASA must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-239870CASA-FW-000280SV-239870r665896_ruleCCI-000366medium
Description
IPv6 packets with unknown extension headers as well as out-of-order headers can create Denial-of-Service attacks for other networking components as well as host devices. IPv6 inspection can check conformance to RFC 2460 enforcing the order extension headers. While routers only need to examine the IPv6 destination address and the Hop-by-Hop Options header, firewalls must recognize and parse through all existing extension headers since the upper-layer protocol information resides in the last header. An attacker is able to chain many extension headers in order to pass firewall and intrusion detections. An attacker can cause a denial of service if an intermediary device or destination host is not capable of processing an extensive or out-of-order chain of extension headers. Hence, it is imperative the firewall is configured to drop packets with unknown or out-of-order headers.
STIGDate
Cisco ASA Firewall Security Technical Implementation Guide2024-06-06

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-01Configuration Management Program
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
MON-01Continuous Monitoring
1.00
MON-01.7File Integrity Monitoring (FIM)
1.00
CFG-02Secure Baseline Configurations
0.50
CFG-02.7Approved Configuration Deviations
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-16(1)Dynamic Attribute Association
1.00
AC-17(1)Monitoring and Control
1.00
AC-2Account Management
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-24(1)Transmit Access Authorization Information
1.00
AC-25Reference Monitor
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.4.1
1.00
3.4.2
1.00
CCI1 mapping
CCI-000366
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-09
1.00
PR.PS-01
1.00
PR.DS-10
0.50
PR.PSPlatform Security
0.50
PR.PS-05
0.50

Who does this work

10 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-239870r665896_chk)

Review the firewall configuration to verify that IPv6 inspection is being performed on all interfaces. Step 1: Verify that the inspect ipv6 command is configured under the global policy map as shown in the example below. policy-map global_policy class inspection_default … … … inspect ipv6 IPV6_MAP Step 2: If a policy map is specified for the inspect ipv6 command, verify the parameters command has been configured. Also verify that the “no verify-header order” and “no verify-header type” sub-command are not configured under the parameters command. policy-map type inspect ipv6 IPV6_MAP parameters match header hop-by-hop drop log match header routing-type eq 0 drop log match header routing-type eq 1 drop log match header routing-type range 3 255 drop log match header destination-option drop log Note: If policy map is not specified for the inspect ipv6 command, the default IPv6 inspection policy map is used and the following actions are taken: 1. Allows only known IPv6 extension headers. Non-conforming packets are dropped and logged. 2. Enforces the order of IPv6 extension headers as defined in the RFC 2460 specification. Non-conforming packets are dropped and logged. 3. Drops any packet with a routing type header. Note: This requirement is not applicable if IPv6 is not enabled on any interfaces. If the firewall is not configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers, this is a finding.

Fix Text (F-43062r665895_fix)

Configure the firewall to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers. Step 1 (optional): Configure an IPv6 inspect policy map. ASA(config)# policy-map type inspect ipv6 IPV6_MAP ASA(config-pmap)# parameters ASA(config-pmap-p)# verify-header type ASA(config-pmap-p)# verify-header order ASA(config-pmap-p)# exit ASA(config-pmap)# match header hop-by-hop ASA(config-pmap-c)# drop log ASA(config-pmap-c)# exit ASA(config-pmap)# match header routing-type eq 0 ASA(config-pmap-c)# drop log ASA(config-pmap-c)# exit ASA(config-pmap)# match header routing-type eq 1 ASA(config-pmap-c)# drop log ASA(config-pmap-c)# exit ASA(config-pmap)# match header routing-type range 3 255 ASA(config-pmap-c)# drop log ASA(config-pmap-c)# exit Note: The verify-header type and verify-header order are enabled by default when the parameters command is configured. Step 2: Include the inspect ipv6 command in the global policy-map as shown in the example below. ASA(config)# policy-map global_policy ASA(config-pmap)# class inspection_default ASA(config-pmap-c)# inspect ipv6 ASA(config-pmap-c)# end