The Juniper router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-217022 | JUNI-RT-000170 | SV-217022r855890_rule | Medium |
| Description |
| The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis. |
| STIG | Date |
| Juniper Router RTR Security Technical Implementation Guide | 2024-12-05 |
Details
| Check Text (C-18251r296934_chk) |
| Review the firewall hierarchy configuration to verify that all packets that are not permitted are silently dropped using the discard parameter as shown in the configuration example below. firewall { family inet { … … … } filter FILTER_INBOUND { term ALLOW_XYZ { from { protocol xyz; } then accept; } … … … } term DENY_BY_DEFAULT { then { log; discard; } } } } If ICMP unreachable notifications are sent for packets that are dropped, this is a finding. |
| Fix Text (F-18249r296935_fix) |
| [edit firewall family inet] set filter FILTER_INBOUND term DENY_BY_DEFAULT then log discard |