RHEL9-CIS/tasks/section_3/cis_3.2.x.yml

---

- name: "3.2.1 | PATCH | Ensure IP forwarding is disabled"
  block:
      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding | Set Fact"
        ansible.builtin.set_fact:
            rhel9cis_sysctl_update: true
            rhel9cis_flush_ipv4_route: true

      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding"
        ansible.builtin.debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"

      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | IPv6"
        block:
            - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding | Set Fact"
              ansible.builtin.set_fact:
                  rhel9cis_flush_ipv6_route: true

            - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding"
              ansible.builtin.debug:
                  msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"

        when: rhel9cis_ipv6_required
  when:
      - not rhel9cis_is_router
      - rhel9cis_rule_3_2_1
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.2.1

- name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
  block:
      - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled | Set Fact"
        ansible.builtin.set_fact:
            rhel9cis_sysctl_update: true
            rhel9cis_flush_ipv4_route: true
      - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
        ansible.builtin.debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  when:
      - not rhel9cis_is_router
      - rhel9cis_rule_3_2_2
  tags:
      - level1-server
      - level1-workstation
      - patch
      - sysctl
      - rule_3.2.2