ICMP Timestamp Request Remote Data Disclosure on Catalyst 9300

[Jeff Horton]

From an ACAS scan, I am getting the "ICMP Timestamp Request Remote Data Disclosure" (Tenable 10114) from one of my Catalyst 9300 switches. I am currently on IOS XE version 17.13.1. I have five other catalyst 9300s that are not showing this issue. Any idea why one would and other would not? I have compared the configurations on multiple switches with the one that is having this issue and they are all the same.

[balaji.bandi]

First i would check the configuraiton between those 2 devices.

One of the suggestion to add ACL :

access-list 10 deny icmp any any timestamp-request
access-list 10 deny icmp any any timestamp-reply
access-list 10 permit ip any any

int gig x/x

ip access-group 10 in

[marce1000]

 - Verify ACL solution offered  from @balaji.bandi with for instance :
               #  hping3 switch-ip-address   --icmp --icmp-ts -V

  And look into latest advisory software version , if applicable and try again with the above command , 

 M.

[Jeff Horton]

I don't have that configuration on any of my other switches and they are not reporting this issue. All of them are running the same version (17.13.1).

[Georg Pauwen]

Hello,

if you compare the time on all switches, is it exactly the same ? Which version of the plugin are you using (version 1.53 being the latest I believe) ?

https://www.tenable.com/plugins/nessus/10114?_gl=1*by96ki*_ga*ODczMDk0Mjc3LjE3MTUyMDMwOTQ.*_ga_HSJ1XWV6ND*MTcxNTIwMzA5My4xLjEuMTcxNTIwMzcxNC42MC4xLjE3NDk0MTM4MjY.

[Jeff Horton]

I have no idea what version of plugin is being used as I don't do the scans.

I applied this version of ACL on my switch and applied it to my interface vlan that has the switch ip address. Waiting for CS team to rescan:

ip access-list extended 100
    deny icmp any any timestamp-request
    deny icmp any any timestamp-reply
    permit ip any any

int vlan x
    ip access-group 100 in

[balaji.bandi]

keep us how it goes when you have feedback from pen testing team.

[Mike H5]

Did that ACL work? I have the same thing going on with our security scanner. I added this access list:

ip access-list ICMP_Timestamp
10 deny icmp any any timestamp-reply
20 deny icmp any any timestamp-request
30 permit ip any any

Then applied it:

interface GigabitEthernet0
ip access-group ICMP_Timestamp in

This resulted in ALL pings matching the timestamp-reply line and being dropped.

It only allows pings when i add:

5 permit icmp any any echo

Which I have a feeling will allow the timestamp lines as well. Its a ISR4431, this seems like odd behavior to me.