The Cisco ACI must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-272087	SRG-NET-000362-RTR-000114	CACI-RT-000027	SV-272087r1168151_rule	2025-12-11	1

Description
The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.

ℹ️ Check
Review the router configuration and verify IP mask replies have been disabled on all external interfaces using any of the following options: 1. For contracts with external L3out traffic, verify specific allow statements do not allow any ICMP type 17 packets. 2. Verify the Filter for ICMP Type 17 and confirm that every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17. If IP mask replies are not disabled on all external interfaces, this is a finding.

ℹ️ Check

Review the router configuration and verify IP mask replies have been disabled on all external interfaces using any of the following options: 1. For contracts with external L3out traffic, verify specific allow statements do not allow any ICMP type 17 packets. 2. Verify the Filter for ICMP Type 17 and confirm that every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17. If IP mask replies are not disabled on all external interfaces, this is a finding.

✔️ Fix
Disable IP mash replies on all external interfaces using any of the following options. 1. ACI is a whitelist model by default, so all traffic is denied by default. When contracts are added, users can be specific with the allow statements to avoid allowing any ICMP type 17 packets. 2. Configure the filter for ICMP Type 17 and confirm every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17.

✔️ Fix

Disable IP mash replies on all external interfaces using any of the following options. 1. ACI is a whitelist model by default, so all traffic is denied by default. When contracts are added, users can be specific with the allow statements to avoid allowing any ICMP type 17 packets. 2. Configure the filter for ICMP Type 17 and confirm every contract that allows ICMP has the type 17 explicit deny to prevent this request. 3. Configure a Taboo contract (blacklist) that explicitly denies ICMP type 17.