STIGQter: STIG Summary: Cisco ACI Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

The Cisco ACI must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.

DISA Rule

SV-272087r1168151_rule

Vulnerability Number

V-272087

Group Title

SRG-NET-000362-RTR-000114

Rule Version

CACI-RT-000027

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Disable IP mash replies on all external interfaces using any of the following options.

1. ACI is a whitelist model by default, so all traffic is denied by default. When contracts are added, users can be specific with the allow statements to avoid allowing any ICMP type 17 packets.
2. Configure the filter for ICMP Type 17 and confirm every contract that allows ICMP has the type 17 explicit deny to prevent this request.
3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17.

Check Contents

Review the router configuration and verify IP mask replies have been disabled on all external interfaces using any of the following options:

1. For contracts with external L3out traffic, verify specific allow statements do not allow any ICMP type 17 packets.
2. Verify the Filter for ICMP Type 17 and confirm that every contract that allows ICMP has the type 17 explicit deny to prevent this request.
3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17.

If IP mask replies are not disabled on all external interfaces, this is a finding.

Vulnerability Number

V-272087

Documentable

False

Rule Version

CACI-RT-000027

Severity Override Guidance

Review the router configuration and verify IP mask replies have been disabled on all external interfaces using any of the following options:

1. For contracts with external L3out traffic, verify specific allow statements do not allow any ICMP type 17 packets.
2. Verify the Filter for ICMP Type 17 and confirm that every contract that allows ICMP has the type 17 explicit deny to prevent this request.
3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17.

If IP mask replies are not disabled on all external interfaces, this is a finding.

Check Content Reference

M

Target Key

5684