← Back to Cisco IOS XR Router RTR Security Technical Implementation Guide

V-216747

CAT II (Medium)

The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule ID

SV-216747r856438_rule

STIG

Cisco IOS XR Router RTR Security Technical Implementation Guide

Version

V3R3

CCIs

CCI-002385

Discussion

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.

Check Content

Review the router configuration and verify that ipv4 mask-reply command is not enabled on any external interfaces as shown in the example below. 

interface GigabitEthernet0/0/0/1
 ipv4 address x.11.1.2 255.255.255.252
 ipv4 mask-reply 

If the router configuration has the ipv4 mask-reply command is enabled on any external interfaces, this is a finding.

Fix Text

Disable ipv4 mask-reply on all external interfaces as shown below.

RP/0/0/CPU0:R3(config)#int g0/0/0/1
RP/0/0/CPU0:R3(config-if)#no ipv4 mask-reply