Skip to content

The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

An XCCDF Rule

Description

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Switches automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis.

ID
SV-221000r856405_rule
Version
CISC-RT-000170
Severity
Medium
References
Updated

Remediation Templates

A Manual Procedure

Step 1: Disable ip unreachables on all external interfaces.

SW1(config)#int g0/1
SW1(config-if)#no ip unreachables

Step 2: Disable ip unreachables on the Null0 interface if it is used to backhole packets.