Skip to content

The router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.

An XCCDF Rule

Description

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis.

ID
SV-207153r856637_rule
Version
SRG-NET-000362-RTR-000113
Severity
Medium
References
Updated

Remediation Templates

A Manual Procedure

Disable ICMP unreachable notifications on all external interfaces.