The Cisco router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.
An XCCDF Rule
Description
Fragmented ICMP packets can be generated by hackers for DoS attacks such as Ping O' Death and Teardrop. It is imperative that all fragmented ICMP packets are dropped.
- ID
- SV-216744r531087_rule
- Version
- CISC-RT-000140
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the external and internal ACLs to drop all fragmented ICMP packets destined to itself as shown in the example below.
RP/0/0/CPU0:R3(config)#ipv4 access-list EXTERNAL_ACL_INBOUND
RP/0/0/CPU0:R2(config-ipv4-acl)#25 deny icmp any host x.11.1.2 fragments log
RP/0/0/CPU0:R3(config)#ipv4 access-list INTERNAL_ACL_INBOUND