Disable ICMP Redirects on all Layer 3 Interfaces

보통레벨 1자동cisco-nxos

설명

A redirect packet basically informs the host that there is a better way to get to the destination host or network. This route is then cached on the (victim) host. For instance, if the default gateway of a host is the NX-OS switch, and the victim host sends a packet to an internet or WAN IP, the NX-OS switch will inform the host that the firewall or WAN router will be a better path. Fails if any Vlan/Ethernet/port-channel interface with an IP address lacks 'no ip redirects'. Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all', which adds default values).

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^interface (?:[Vv]lan|Ethernet|port-channel)[^\n]*\n(?:[ \t]+(?:$|[^n \t\n]|n(?:$|[^o\n]|o(?:$|[^ \n]| (?:$|[^i\n]|i(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^t\n]|t(?:$|[^s\n])))))))))))))))[^\n]*\n)*[ \t]+ip address [^\n]*\n(?:[ \t]+(?:$|[^n \t\n]|n(?:$|[^o\n]|o(?:$|[^ \n]| (?:$|[^i\n]|i(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^t\n]|t(?:$|[^s\n])))))))))))))))[^\n]*\n)*(?:[^ \t]|\z)

조치 방법

조치 방식: 가이드 또는 인프라 패치

It is recommended that you perform this task on all Layer 3 Interfaces which have both a primary and a backup routed path to any destination. In particular, the next hop will need to be in the same subnet as the potential victim hosts. The corollary to this is that if the network is architected such that all layer 3 egress paths are on dedicated or "point to point" segments (with no other hosts on those segments), then the ip redirect issue will never arise. switch(config-if) no ip redirects

속성

운영 체제: 모두
태그: cisco-nxosnetworkhardening
참고 자료: CIS Cisco NX-OS Benchmark v1.2.0 - 3.2.2 Disable ICMP Redirects on all Layer 3 Interfaces

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cisco-nxos