The Juniper router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-217022 | JUNI-RT-000170 | SV-217022r855890_rule | CCI-002385 | medium |
| Description | ||||
| The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis. | ||||
| STIG | Date | |||
| Juniper Router RTR Security Technical Implementation Guide | 2024-12-05 | |||
Details
Check Text (C-217022r855890_chk)
Review the firewall hierarchy configuration to verify that all packets that are not permitted are silently dropped using the discard parameter as shown in the configuration example below.
firewall {
family inet {
…
…
…
}
filter FILTER_INBOUND {
term ALLOW_XYZ {
from {
protocol xyz;
}
then accept;
}
…
…
…
}
term DENY_BY_DEFAULT {
then {
log;
discard;
}
}
}
}
If ICMP unreachable notifications are sent for packets that are dropped, this is a finding.
Fix Text (F-18249r296935_fix)
[edit firewall family inet]
set filter FILTER_INBOUND term DENY_BY_DEFAULT then log discard