V-254035

Discussion

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.

Check Content

Review the device configuration to determine if controls have been defined to ensure the router does not send ICMP Mask Reply messages out to any external interfaces.

[edit policy-options]
prefix-list router-address-ipv4 {
    <external interface address>/32;
    <internal subnet>/<mask>;
}
[edit firewall family inet]
filter <name> {
    term 1 {
        from {
            source-prefix-list {
                router-address-ipv4; 
            }
            protocol icmp;
            icmp-type mask-reply;
        }
        then {
            log;
            syslog;
            discard;
        }
    }
    <additional terms>
    term default {
        then {
            log;
            syslog;
            discard;
        }
    }
}

[edit interfaces]
<external interface> {
    unit <number> {
        family inet {
            filter {
                output <filter name>;
            }
            address <IPv4 address>/<mask>;
        }
    }
}

Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If ICMP Mask Reply messages are enabled on any external interfaces, this is a finding.