STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.

DISA Rule

SV-239870r665896_rule

Vulnerability Number

V-239870

Group Title

SRG-NET-000364-FW-000041

Rule Version

CASA-FW-000280

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Configure the firewall to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.

Step 1 (optional): Configure an IPv6 inspect policy map.

ASA(config)# policy-map type inspect ipv6 IPV6_MAP
ASA(config-pmap)# parameters
ASA(config-pmap-p)# verify-header type
ASA(config-pmap-p)# verify-header order
ASA(config-pmap-p)# exit
ASA(config-pmap)# match header hop-by-hop
ASA(config-pmap-c)# drop log
ASA(config-pmap-c)# exit
ASA(config-pmap)# match header routing-type eq 0
ASA(config-pmap-c)# drop log
ASA(config-pmap-c)# exit
ASA(config-pmap)# match header routing-type eq 1
ASA(config-pmap-c)# drop log
ASA(config-pmap-c)# exit
ASA(config-pmap)# match header routing-type range 3 255
ASA(config-pmap-c)# drop log
ASA(config-pmap-c)# exit

Note: The verify-header type and verify-header order are enabled by default when the parameters command is configured.

Step 2: Include the inspect ipv6 command in the global policy-map as shown in the example below.

ASA(config)# policy-map global_policy
ASA(config-pmap)# class inspection_default
ASA(config-pmap-c)# inspect ipv6
ASA(config-pmap-c)# end

Check Contents

Review the firewall configuration to verify that IPv6 inspection is being performed on all interfaces.

Step 1: Verify that the inspect ipv6 command is configured under the global policy map as shown in the example below.

policy-map global_policy
class inspection_default
…
…
…
inspect ipv6 IPV6_MAP

Step 2: If a policy map is specified for the inspect ipv6 command, verify the parameters command has been configured. Also verify that the “no verify-header order” and “no verify-header type” sub-command are not configured under the parameters command.

policy-map type inspect ipv6 IPV6_MAP
parameters
match header hop-by-hop
drop log
match header routing-type eq 0
drop log
match header routing-type eq 1
drop log
match header routing-type range 3 255
drop log
match header destination-option
drop log

Note: If policy map is not specified for the inspect ipv6 command, the default IPv6 inspection policy map is used and the following actions are taken:

1. Allows only known IPv6 extension headers. Non-conforming packets are dropped and logged.
2. Enforces the order of IPv6 extension headers as defined in the RFC 2460 specification. Non-conforming packets are dropped and logged.
3. Drops any packet with a routing type header.

Note: This requirement is not applicable if IPv6 is not enabled on any interfaces.

If the firewall is not configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers, this is a finding.

The Cisco ASA must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key