The Cisco ACI must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.

The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.

Review the router configuration and verify IP mask replies have been disabled on all external interfaces using any of the following options:

1. For contracts with external L3out traffic, verify specific allow statements do not allow any ICMP type 17 packets. 2. Verify the Filter for ICMP Type 17 and confirm that every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17.

If IP mask replies are not disabled on all external interfaces, this is a finding.

Disable IP mash replies on all external interfaces using any of the following options.

1. ACI is a whitelist model by default, so all traffic is denied by default. When contracts are added, users can be specific with the allow statements to avoid allowing any ICMP type 17 packets. 2. Configure the filter for ICMP Type 17 and confirm every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17.