← Back to VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide

V-258892

CAT II (Medium)

The Photon operating system must use a reverse-path filter for IPv4 network traffic.

Rule ID

SV-258892r933737_rule

STIG

VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems that are routers for complicated networks but is helpful for end hosts and routers serving small networks.

Check Content

At the command line, run the following command to verify IPv4 traffic is using a reverse path filter:

# /sbin/sysctl -a --pattern "net.ipv4.conf.(all|default).rp_filter"

Expected result:

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

If the "rp_filter" kernel parameters are not set to "1", this is a finding.

Fix Text

Navigate to and open:

/etc/sysctl.d/zz-stig-hardening.conf

Add or update the following lines:

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

At the command line, run the following command to load the new configuration:

# /sbin/sysctl --load /etc/sysctl.d/zz-stig-hardening.conf

Note: If the file zz-stig-hardening.conf does not exist, it must be created.