← Back to VMware NSX 4.x Tier-1 Gateway Router Security Technical Implementation Guide

V-265604

CAT III (Low)

The NSX Tier-1 Gateway router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

Rule ID

SV-265604r995285_rule

STIG

VMware NSX 4.x Tier-1 Gateway Router Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000366

Discussion

The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message being used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to the hop limit reaching zero before the packets sent by a host reached its destination.

Check Content

If IPv6 forwarding is not enabled, this is Not Applicable.

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-1 Gateways.

For every Tier-1 Gateway, expand Tier-1 Gateway >>Additional Settings.

Click on the ND profile name to view the hop limit.

If the hop limit is not configured to at least 32, this is a finding.

Fix Text

To configure the Neighbor Discovery hop limit, do the following:

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-1 Gateways >> edit the target Tier-1 gateway.

Expand Additional Settings and select an "ND Profile" from the drop down with a hop limit of 32 or more, then click "Close Editing".

Note: The default ND profile has a hop limit of 64 and cannot be edited. If required, create a new or edit another existing ND profile to use.