The Juniper router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.

An XCCDF Rule

Description

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis.

ID: SV-254034r844135_rule
Version: JUEX-RT-000620
Severity: Medium
References: CCI-002385
Updated: 15 days ago

Remediation Templates

Disable ICMP unreachable notifications on all external interfaces.

set policy-options prefix-list router-addresses-ipv4 <external interface address>/32
set policy-options prefix-list router-addresses-ipv4 <internal subnet>/<mask>

set firewall family inet filter <name> term 1 from source-prefix-list router-address-ipv4set firewall family inet filter <name> term 1 from protocol icmp
set firewall family inet filter <name> term 1 from icmp-type unreachable
set firewall family inet filter <name> term 1 then log
set firewall family inet filter <name> term 1 then syslog
set firewall family inet filter <name> term 1 then discard
<additional terms>
set firewall family inet filter <name> term default then log
set firewall family inet filter <name> term default then syslog
set firewall family inet filter <name> term default then discard

set interfaces <interface name> unit <number> family inet filter output <filter name>
set interfaces <interface name> unit <number> family inet address <IPv4 address>.<mask>

The Juniper router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.

Description

Remediation Templates

A Manual Procedure