The Juniper router must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.

An XCCDF Rule

Description

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.

ID: SV-254035r844138_rule
Version: JUEX-RT-000630
Severity: Medium
References: CCI-002385
Updated: 5 days ago

Remediation Templates

Disable ICMP mask replies on all external interfaces.

set policy-options prefix-list router-addresses-ipv4 <external interface address>/32
set policy-options prefix-list router-addresses-ipv4 <internal subnet>/<mask>

set firewall family inet filter <name> term 1 from source-prefix-list router-address-ipv4set firewall family inet filter <name> term 1 from protocol icmp
set firewall family inet filter <name> term 1 from icmp-type mask-reply
set firewall family inet filter <name> term 1 then log
set firewall family inet filter <name> term 1 then syslog
set firewall family inet filter <name> term 1 then discard
<additional terms>
set firewall family inet filter <name> term default then log
set firewall family inet filter <name> term default then syslog
set firewall family inet filter <name> term default then discard

set interfaces <interface name> unit <number> family inet filter output <filter name>
set interfaces <interface name> unit <number> family inet address <IPv4 address>.<mask>

The Juniper router must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.

Description

Remediation Templates

A Manual Procedure