Skip to content
Networking
ASD ISMISM-1429

ASD ISM 1429 Block IPv6 tunnelling at externally connected network boundaries

What it says

IPv6 tunnelling is blocked by network security appliances at externally connected network boundaries.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Configure your network security appliances to block IPv6 tunnelling traffic at every point where your network connects to the outside world.

Computers use addressing systems called Internet Protocol (IP) to talk to each other, and there are two versions in use: the older IPv4 and the newer IPv6. "IPv6 tunnelling" is a trick that wraps newer IPv6 traffic inside older IPv4 traffic so it can sneak through equipment that was only set up to watch IPv4. This control says your firewalls and other security equipment that sit at the edge of your network (where it joins the internet or any outside network) must be set to block that kind of hidden tunnelling traffic. It matters because attackers and malware can use these tunnels to slip past your defences and quietly move data in or out without being seen.

Why it matters

If IPv6 tunnelling is not blocked at the network edge, attackers or malware can hide traffic inside permitted connections to bypass firewalls and silently steal data or maintain remote access.

How to implement

  1. The IT or network administrator should identify every place where your network connects to an external network (for example, the internet link, partner connections or a remote office link) and confirm a network security appliance such as a firewall sits at each of those boundaries.

  2. The network administrator should configure each boundary firewall with explicit rules that block known IPv6 tunnelling protocols, including 6to4, Teredo, ISATAP and 6in4, rather than relying on default settings that may quietly allow them.

  3. Where your organisation does not yet use IPv6 internally, the IT administrator should disable IPv6 tunnelling on workstations and servers and block the related protocol numbers (such as protocol 41) and UDP ports used by Teredo at the network edge.

  4. The network administrator should test the blocking by attempting to set up a tunnel from inside the network to an outside address and confirming the security appliance drops or rejects the attempt, then save the test result.

  5. The IT manager should add a check for IPv6 tunnelling rules to the regular firewall review schedule so the rules are reconfirmed after any change to network equipment, internet provider or firmware update.

Keep it running

Re-confirm the IPv6 tunnelling block whenever firewalls, internet providers or firmware change, and review the rules during scheduled firewall audits so they are not lost over time.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    the current firewall or network security appliance rule set covering each external network boundary.

    Look at

    explicit rules that deny IPv6 tunnelling protocols (6to4, Teredo, ISATAP, 6in4, protocol 41).

    Good evidence

    shows named rules that block these at every external boundary, not just a vague claim that the firewall handles it.

  2. Check 2 of 5What an auditor asks for

    Ask for

    the network administrator to show which connection points count as externally connected boundaries and how each is protected.

    Look at

    a simple network diagram.

    Good evidence

    accounts for every internet and external link, including remote sites and backup links, with a security appliance on each.

  3. Check 3 of 5What an auditor asks for

    Ask for

    evidence that the blocking actually works, such as a test record or a captured log showing a tunnelling attempt being dropped.

    Good evidence

    is a dated test result or appliance log, not just an assertion that the rules exist.

  4. Check 4 of 5What an auditor asks for

    Ask for

    how IPv6 tunnelling rules are kept in place after changes.

    Look at

    the firewall change or review log.

    Good evidence

    shows the rules are re-checked after firmware updates, provider changes or appliance replacements, with dates and who did it.

  5. Check 5 of 5What an auditor asks for

    Ask for

    whether IPv6 is used internally and how that affects the tunnelling controls.

    Look at

    a clear decision:.

    Good evidence

    either confirms IPv6 tunnelling is blocked because it is not needed, or explains how legitimate IPv6 is handled natively while still blocking unauthorised tunnels.

Mappings

Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.20Network and network devices securityPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.