Ensure that access restrictions on a dual-stack frontend apply to IPv6 clients as well as IPv4 clients.
Apply Source Restrictions to Every Address Family
CCC.LB.CN15 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP23 | Network Access Rules | The service restricts access to child or networked resources based on user-defined network parameters such as IP address, protocol, port, or source. |
| CCC.LB.CP08 | Dual-stack Load Balancing | The service can accept traffic originating from both IPv4 and IPv6 clients on the same frontend. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH14 | IPv6 Frontend Bypasses IPv4-Only Access Rules | A dual-stack frontend exposes the same backend targets over IPv6 while network access rules, firewall policies, or allowlists may be defined for IPv4 addresses only. Requests arriving over IPv6 are then accepted without the intended restrictions, compromising the confidentiality and integrity of the resources behind the load balancer. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN15.AR01 | When a listener accepts IPv6 traffic, each IPv4 source restriction applied to that listener MUST have a corresponding IPv6 source restriction. | tlp-clear, tlp-green, tlp-amber, tlp-red |