← Back to Solaris 11 X86 Security Technical Implementation Guide

V-216138

CAT II (Medium)

The system must set strict multihoming.

Rule ID

SV-216138r959010_rule

STIG

Solaris 11 X86 Security Technical Implementation Guide

Version

V3R5

CCIs

CCI-000366

Discussion

These settings control whether a packet arriving on a non-forwarding interface can be accepted for an IP address that is not explicitly configured on that interface. This rule is NA for documented systems that have interfaces that cross strict networking domains (for example, a firewall, a router, or a VPN node).

Check Content

Determine if strict multihoming is configured.

# ipadm show-prop -p _strict_dst_multihoming -co current ipv4
# ipadm show-prop -p _strict_dst_multihoming -co current ipv6

If the output of all commands is not "1", this is a finding.

Fix Text

The Network Management profile is required.

Disable strict multihoming for IPv4 and IPv6.

# pfexec ipadm set-prop -p _strict_dst_multihoming=1 ipv4
# pfexec ipadm set-prop -p _strict_dst_multihoming=1 ipv6