STIGQter: STIG Summary: Cisco IOS XE Switch RTR Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Apr 2026:

The Cisco perimeter switch must be configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type.

DISA Rule

SV-237778r1132550_rule

Vulnerability Number

V-237778

Group Title

SRG-NET-000364-RTR-000206

Rule Version

CISC-RT-000398

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

Configure the switch to drop all inbound IPv6 packets containing destination option type values regardless of whether they appear in a Hop-by-Hop or Destination Option header as shown in the example below.

SW1(config)#ipv6 access-list FILTER_IPV6
SW1(config-ipv6-acl)#deny 60 any any dest-option log
SW1(config-ipv6-acl)#deny hbh any any dest-option log
SW1(config-ipv6-acl)#permit …
…
…
…
SW1(config-ipv6-acl)#deny ipv6 any any log
SW1(config-ipv6-acl)#exit
SW1(config)#int g1/0
SW1(config-if)#ipv6 traffic-filter FILTER_IPV6
SW1(config-if)#end

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the switch configuration to determine if it is compliant with this requirement.

Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

interface gigabitethernet1/0
ipv6 address 2001::1:0:22/64
ipv6 traffic-filter FILTER_IPV6 in

Step 2: Verify that the ACL drops IPv6 packets containing a Destination Option header as shown in the example below.

ipv6 access-list FILTER_IPV6
deny 60 any any dest-option log
deny hbh any any dest-option log
permit ipv6 …
…
…
…
deny ipv6 any any log

Note: Cisco has deprecated the dest-option-type command used to filter by option type within the Destination Option and Hop-by-Hop header. Therefore, all packets with the Destination Option header and Hop-by-Hop options must be dropped.

If the switch is not configured to drop IPv6 packets containing a Destination Option header, this is a finding.

Vulnerability Number

V-237778

Documentable

False

Rule Version

CISC-RT-000398

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the switch configuration to determine if it is compliant with this requirement.

Step 1: Verify that an inbound IPv6 ACL has been configured on the external interface.

interface gigabitethernet1/0
ipv6 address 2001::1:0:22/64
ipv6 traffic-filter FILTER_IPV6 in

Step 2: Verify that the ACL drops IPv6 packets containing a Destination Option header as shown in the example below.

ipv6 access-list FILTER_IPV6
deny 60 any any dest-option log
deny hbh any any dest-option log
permit ipv6 …
…
…
…
deny ipv6 any any log

Note: Cisco has deprecated the dest-option-type command used to filter by option type within the Destination Option and Hop-by-Hop header. Therefore, all packets with the Destination Option header and Hop-by-Hop options must be dropped.

If the switch is not configured to drop IPv6 packets containing a Destination Option header, this is a finding.

Check Content Reference

M

Target Key

4074