Disable ICMP Redirects on all Layer 3 Interfaces

MediumLevel 1Automatedcisco-nxos

Description

A redirect packet basically informs the host that there is a better way to get to the destination host or network. This route is then cached on the (victim) host. For instance, if the default gateway of a host is the NX-OS switch, and the victim host sends a packet to an internet or WAN IP, the NX-OS switch will inform the host that the firewall or WAN router will be a better path. Fails if any Vlan/Ethernet/port-channel interface with an IP address lacks 'no ip redirects'. Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all', which adds default values).

How it is checked

Audit method: Configuration pattern

Pattern: (?m)^interface (?:[Vv]lan|Ethernet|port-channel)[^\n]*\n(?:[ \t]+(?:$|[^n \t\n]|n(?:$|[^o\n]|o(?:$|[^ \n]| (?:$|[^i\n]|i(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^t\n]|t(?:$|[^s\n])))))))))))))))[^\n]*\n)*[ \t]+ip address [^\n]*\n(?:[ \t]+(?:$|[^n \t\n]|n(?:$|[^o\n]|o(?:$|[^ \n]| (?:$|[^i\n]|i(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^t\n]|t(?:$|[^s\n])))))))))))))))[^\n]*\n)*(?:[^ \t]|\z)

How it is fixed

Fix method: Guidance or infrastructure patch

It is recommended that you perform this task on all Layer 3 Interfaces which have both a primary and a backup routed path to any destination. In particular, the next hop will need to be in the same subnet as the potential victim hosts. The corollary to this is that if the network is architected such that all layer 3 egress paths are on dedicated or "point to point" segments (with no other hosts on those segments), then the ip redirect issue will never arise. switch(config-if) no ip redirects

Properties

Operating systems: Any
Tags: cisco-nxosnetworkhardening
Reference: CIS Cisco NX-OS Benchmark v1.2.0 - 3.2.2 Disable ICMP Redirects on all Layer 3 Interfaces

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target cisco-nxos