---

- name: "3.2.1 | PATCH | Ensure IP forwarding is disabled"
  block:
      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
        notify:
            - update sysctl
            - sysctl flush ipv4 route table

      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
        notify:
            - update sysctl
            - sysctl flush ipv6 route table
        when: rhel9cis_ipv6_required
  when:
      - not rhel9cis_is_router
      - rhel9cis_rule_3_2_1
  tags:
      - level1-server
      - level1-workstation
      - automated
      - sysctl
      - patch
      - rule_3.2.1

- name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
  debug:
      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  notify:
      - update sysctl
      - sysctl flush ipv4 route table
  when:
      - not rhel9cis_is_router
      - rhel9cis_rule_3_2_2
  tags:
      - level1-server
      - level1-workstation
      - automated
      - patch
      - sysctl
      - rule_3.2.2