The NSX Tier-0 Gateway router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-265479 | NT0R-4X-000102 | SV-265479r994787_rule | CCI-000366 | low |
| Description | ||||
| The Neighbor Discovery (ND) protocol allows a hop limit value to be advertised by routers in a Router Advertisement message being used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to the hop limit reaching zero before the packets sent by a host reached its destination. | ||||
| STIG | Date | |||
| VMware NSX 4.x Tier-0 Gateway Router Security Technical Implementation Guide | 2024-12-13 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · V1R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · V1R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · V1R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · V1R2 · disa_xccdf · related
Details
Check Text (C-265479r994787_chk)
If IPv6 forwarding is not enabled, this is Not Applicable.
From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways.
For every Tier-0 Gateway, expand Tier-0 Gateway >>Additional Settings.
Click on the ND profile name to view the hop limit.
If the hop limit is not configured to at least 32, this is a finding.
Fix Text (F-69304r994786_fix)
To configure the Neighbor Discovery hop limit, do the following:
From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways >> edit the target Tier-0 gateway.
Expand Additional Settings and select an "ND Profile" from the drop down with a hop limit of 32 or more, then click "Close Editing".
Note: The default ND profile has a hop limit of 64 and cannot be edited. If required, create a new or edit another existing ND profile to use.