Cisco IPv6 IOS Hardening - DoD Style

***Updated on 14 May 2014 - regarding NET-IPv6-022, See below***

Thousands of network engineers in the DoD out there looking at implementing IPv6 now have to address a few Security and Technical Implementation Guidance (STIG) items that they used to just annotate as "Not Applicable - NA." Now, IPv6 security is important. If you are a vendor, it might be a good idea to look at what you will now absolutely have to address, or risk certification and accreditation of your products in an DoD enterprise.

The STIG Viewer

Whatever your feelings are with Java, the software engineers at DISA put together a great way to finally view, edit, and transmit those STIGs. It's called the DISA STIG Viewer (currently in version 1.1). It's available to everyone, regardless of operating system platform. Not all of the STIGs are available to the average "Joe", but a good majority are available. In this blog I will be using the Cisco Perimeter Router STIG as an example. The IPv6-secific STIG items are as follows. The parts in bold are the actual commands.

The IPv6 STIG Items

NET-IPv6-004 - IPv6 Router Advertisements must be suppressed on externally-facing links

-This is usually your BGP peering points, but it's good practice for all your Point-point router links:

ipv6 nd ra-supress

On an ASA it's ipv6 ra-supress

NET-IPv6-006 - IPv6 Undermined Transport

-This is for IPv6 packets with Next Headers that are totally not correct

ipv6 access-list inbound-to-enclave remark prohibit unknown protocols deny ipv6 any any undetermined-trans log

NET-IPv6-008 - IPv6 Bogons

-This is for IPv6 address you shouldn't see - like the old 6Bone

ipv6 access-list inbound-to-enclave remark prohibit IPv6 Bogons deny ipv6 3FFE::/16 any log deny ipv6 any 3FFE::/16 log

NET-IPv6-011 - IPv6 Outbound ICMPv6

-This is for all thing ICMPv6 related

ipv6 access-list inbound-to-enclave remark Filter ICMPv6 remark Allow outbound ping request from LAN subnet permit icmp 2001:db8:60::/44 2000::/3 echo-request remark Allow Path MTU to function permit icmp 2001:db8:60::/44 2000::/3 packet-too-big remark Allow flow control permit icmp 2001:db8:60::/44 2000::/3 source-quench remark Allow time exceeded messages for loops permit icmp 2001:db8:60::/44 2000::/3 time-exceeded remark Allow ND ICMP types generally, but not RD permit icmp any any nd-na permit icmp any any nd-ns remark Explicitly block all other ICMP packets deny icmp any any log-input

NET-IPv6-016 - Disable vulnerable ICMPv6 on external interface

-This is for the external interface and could be good on point-to-point, routed, untrusted interfaces

(config-int) no ipv6 redirects (config-int) no ipv6 unreachables (config-int) no ipv6 mask-reply

NET-IPv6-017 - IPv6 Routing Header (or just RH Type 0)

-This is for the IPv6 source routing header. If you are running Mobile IPv6 use the first one, if not use the second one.

With Mobile IPv6 (Routing Header Type 2):

ipv6 access-list inbound-to-enclave remark prohibit IPv6 routing header type0 deny ipv6 any any routing-type 0 log

Without Mobile IPv6 (Routing Header Type 2):

(config)no ipv6 source-routing

ipv6 access-list inbound-to-enclave remark prohibit IPv6 routing header type0 deny ipv6 any any routing

UPDATE! - 1 May 2014 - DISA Removes the below requirement as of Version 8, Release 17!NET-IPv6-022 - IPv6 Link-Local Unicast Addresses at perimeter-This is one I don't agree with and think DISA needs to remove this one. Even at the perimeter, Neighbor Discovery (ND) needs to happen. Plus routing updates use link-local. DISA gets a de-merit for this one :-)

***Don't do this unless you want to break IPv6 routing*** ipv6 access-list inbound-to-enclave remark prohibit use of link-local deny ipv6 fe80::/10 any log deny ipv6 any fe80::/10 log

NET-IPv6-025 & 26 - Block IPv6 Site-Local

-Site-Local was deprecated with Unique-Local Unicast. Block these.

ipv6 access-list inbound-to-enclave remark prohibit use of site-local deny ipv6 fec0::/10 any log deny ipv6 any fec0::/10 log

NET-IPv6-027 - Block IPv6 Loopback Address

-Loopback in IPv6 is ::1 just like IPv4's 127.0.0.1, and you shouldn't see these on any wire. Block these.

ipv6 access-list inbound-to-enclave remark block packets with local loopback address deny ipv6 ::1/128 any log

NET-IPv6-028 - Block IPv6 Unspecified Address

-Unspecified in IPv6 is ::/0 just like IPv4's 0.0.0.0, and you shouldn't see these on any wire. Block these. ipv6 access-list inbound-to-enclave remark block traffic with the unspecified address deny ipv6 ::/128 any log deny ipv6 any ::/128 log

NET-IPv6-029 - Block IPv6 Multicast Source Address

-You should never see an IPv6 multicast address as the source address anywhere. They will only be destination addresses. Block these. Of course, DISA messed up the example in their STIG. ***Only block the source - not destination!

ipv6 access-list inbound-to-enclave remark block packets with multicast source address deny ipv6 ff00::/8 any log

NET-IPv6-030 - Block IPv4-compatible Addresses

-You should never see an IPv4-compatible address on the wire. Block these.

ipv6 access-list inbound-to-enclave remark block packets with embedded IPv4-compatible IPv6 addresses deny ipv6 0::/96 any log deny ipv6 any 0::/96 log

NET-IPv6-031 - Block IPv4-mapped Addresses

-You should never see an IPv4-mapped address on the wire. Block these.

ipv6 access-list inbound-to-enclave remark block embedded IPv4-mapped IPv6 addresses deny ipv6 ::FFFF:0:0/96 any log deny ipv6 any ::FFFF:0:0/96 log

NET-IPv6-032 - Block IPv6 Unique Local Addresses (ULA)

-You should never see an IPv6 ULA on your border, it's OK for internal use, but never allow them in or out! Block these.

ipv6 access-list inbound-to-enclave remark block IPv6 Unique Local Unicast Addresses deny ipv6 FC00::/7 any log deny ipv6 any FC00::/7 log

NET-IPv6-033 - IPv6 CEF enabled

-Enable IPv6 CEF

(config) ipv6 cef

NET-IPv6-034 - Egrees Outbound Source Reachable

-Very similar to uRPF.

ipv6 verify unicast source reachable-via rx outbound-to-backbone

NET-IPv6-047 & 48- IPv6 NAT

-I don't recommend you do IPv6 NAT, but don't do what DISA recommends as it is the old NAT-PT. Most everyone has moved to the new standard: NAT64. There's a lot of commands so go here to see it: https://supportforums.cisco.com/docs/DOC-22619

NET-IPv6-060 - Packet with Invalid Hop-by-Hop Header

-Fun with Extension Headers! This is where is gets fun. Only some values are within spec. Block these.

ipv6 access-list inbound-to-enclave remark block IPv6 HbH Invalid Options deny 0 any any dest-option-type 4 deny 0 any any dest-option-type 195 deny 0 any any dest-option-type home-address

NET-IPv6-061 & 63 - Packet with Invalid Destination Options Header

-Fun with Extension Headers! This is where is gets fun. Only some values are within spec. Block these.

ipv6 access-list inbound-to-enclave remark block IPv6 DO Invalid Options deny 60 any any dest-option-type 5 deny 60 any any dest-option-type 194

deny 60 any any dest-option-type 195

NET-IPv6-062 - Packet with IPv6 Endpoint Identification

-Fun with Extension Headers! This is where is gets fun. Only some values are within spec. Block these.

ipv6 access-list inbound-to-enclave remark block IPv6 DO Invalid Options deny any any dest-option-type 138

NET-IPv6-064 - Filter Undefined Extension Header Types

-Fun with Extension Headers! This is where is gets fun. Only some values are within spec. Block these.

ipv6 access-list inbound-to-enclave remark block IPv6 Invalid Extension Header Types deny any any dest-option-type 2 deny any any dest-option-type 3 deny any any dest-option-type 6 deny any any dest-option-type 7 deny any any dest-option-type 8 deny any any dest-option-type 137 deny any any dest-option-type 139 deny any any dest-option-type 193 deny any any dest-option-type 196 deny any any dest-option-type 197 deny any any dest-option-type 198 deny any any dest-option-type 199 deny any any dest-option-type 200 deny any any dest-option-type 202 deny any any dest-option-type 255

NET-IPv6-066 - 6in4 or 6to4 Filtering

-Seems odd that DISA would block the whole address space just to add filtering guidance. Many of you out there will have IPv6 over IPv4 tunnels. So use this as guidance.

ipv6 general-prefix 6TO4_PREFIX 6to4 FastEthernet0/1

interface Tunnel0 ipv6 address 2001:db8::1/64 tunnel source FastEthernet0/0 tunnel mode ipv6ip 6to4 **or no 6to4 ! interface FastEthernet0/0 ip address 10.1.12.1 255.255.255.0 ipv6 address 6TO4_PREFIX ::1:0:0:0:1/64 ipv6 traffic-filter IPV6_EGRESS_FILTER in ! interface FastEthernet0/1 description DISN CORE facing ip address 198.18.0.1 255.255.255.0 ! ipv6 route 2002::/16 Tunnel0 ! ipv6 access-list IPV6_EGRESS_FILTER permit ipv6 2002:C612:1::/48 any deny ipv6 any any log

NET-TUNL-001, 2, 20 & 33 - Block Legacy Tunneling

-Some of these may be in use in your network so read carefully. Only block what's not being used.

ip access-list inbound-to-enclave remark block Legacy Tunneling deny 4 any any log deny 41 any any log **only if you aren't doing 6in4 tunneling deny 47 any any log **only if you aren't doing GRE tunneling deny 42 any any log deny 93 any any log

deny 97 any any log deny tcp any any eq 1723 log deny udp any any eq 1723 log

deny udp any any eq 3544 log **Teredo

deny 98 any any log

deny 97 any any log deny tcp any any eq 1723 log deny udp any any eq 1723 log

deny 98 any any log

NET-MCAST-001 - Block PIM - If not useing**

-Some of these may be in use in your network so read carefully. Only block what's not being used.

interface FastEthernet0/1 description DISN CORE facing no ipv6 pim

NET-MCAST-002 - If using IPv6 PIM - filter

-If you are using PIM make sure to be specific about whom you are allowing to be a PIM neighbor

ipv6 pim neighbor-filter list PIM_NEIGHBORS

ipv6 access-list PIM_NEIGHBORS permit host FE80::1 any permit host FE80::3 any deny any any log

NET-MCAST-009 & 10 - IPv6 Administrative Multicast Restrictions

-Be very careful with this one, especially if you are allowing IPv6 multicast routing in and out of the enterprise.

ipv6 multicast-routing ! interface FastEthernet0/1 description DISN CORE facing ipv6 address 2001:db8::1/64 ipv6 multicast boundary scope 8

***(this only allows for any type over 8 - like global - if you have an admin or organization local IPv6 multicast infrastructure then modify this value!)

NET-MCAST-020 - IPv6 Source-Specific Multicast Groups

-If you aren't configuring IPv6 SSM don't worry about this one. However, if you are do this.

ipv6 access-list SSM_RANGE permit any ff3e::1:0:0/96 ipv6 pim ssm range SSM_RANGE

ipv6 pim ssm default *

**"default" means it will only use FF3x::/32 - where "x" is any valid scope value.