diff --git a/doc/source/developer-notes/V-38537.rst b/doc/source/developer-notes/V-38537.rst
new file mode 100644
index 00000000..beea151d
--- /dev/null
+++ b/doc/source/developer-notes/V-38537.rst
@@ -0,0 +1,2 @@
+Ubuntu already ignores ICMPv4 bogus error messages by default. The role will
+ensure that this default setting is maintained.
diff --git a/openstack-ansible-security/tasks/kernel.yml b/openstack-ansible-security/tasks/kernel.yml
index 467bad5f..a3cfe3ea 100644
--- a/openstack-ansible-security/tasks/kernel.yml
+++ b/openstack-ansible-security/tasks/kernel.yml
@@ -13,6 +13,18 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# This is the default in Ubuntu 14.04
+- name: V-38537 - The system must ignore ICMPv4 bogus error responses
+  sysctl:
+    name: net.ipv4.icmp_ignore_bogus_error_responses
+    value: 1
+    state: present
+    sysctl_set: yes
+  tags:
+    - kernel
+    - cat3
+    - V-38537
+
 # This is the default in Ubuntu 14.04
 - name: V-38596 - Enable virtual address space randomization
   sysctl: