The Arista router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.

An XCCDF Rule

Description

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis.

ID: SV-256032r882438_rule
Version: ARST-RT-000530
Severity: Medium
References: CCI-002385
Updated: 3 days ago

Remediation Templates

Disable ICMP unreachable notifications on all external interfaces.

Step 1: The Arista router can be configured to filter out the ICMP Unreachable for (Type 3) code 0 (Network unreachable) IPv4 and IPv6 packets with the following command:

router(config)#ip icmp rate-limit-unreachable 0
router(config)#ipv6 icmp rate-limit-unreachable 0
Step 2: The Arista router can be configured to filter out the ICMP Unreachable for (Type 3) code 1 (Network unreachable) IPv4 and IPv6 packets with the following command:

router(config)#ip access-list BLK-ICMP-Unreachables
10 deny icmp any any host-unreachable
20 permit ip any any
!

Step 3: This would need to be applied on the egress interface (for example as in et1 below):

router(config)#interface ethernet1
no routerport
ip address 32.1.1.12/24
ip access-group BLK-ICMP-Unreachables out
!

The Arista router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.

Description

Remediation Templates

A Manual Procedure