Ensure firewall policy denying all traffic to/from Tor, malicious server, or scanner IP addresses using ISDB

HochStufe 1Automatisiertfortigate

Beschreibung

Firewall policies should include a deny rule for traffic going to/from Tor, malicious server, or scanner IP addresses using ISDB (Internet Service Database). PASS requires a policy using ISDB source Tor-Exit.Node (inbound) and a policy using ISDB destination Tor-Relay.Node (outbound); confirm both list all CIS ISDB objects and use action deny with logging. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

So wird geprüft

Prüfmethode: Konfigurationsmuster

Muster: (?m)^config firewall policy\n(?:(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-src-name [^\n]*"Tor-Exit\.Node"[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-name [^\n]*"Tor-Relay\.Node"[^\n]*[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-name [^\n]*"Tor-Relay\.Node"[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-src-name [^\n]*"Tor-Exit\.Node"[^\n]*[ \t]*$)

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

config firewall policy edit 0 set name "Block-Malicious-In" set srcintf "any" set dstintf "any" set internet-service-src enable set internet-service-src-name "Tor-Exit.Node" "Tor-Relay.Node" "Censys-Scanner" "Shodan-Scanner" "Botnet-C&C.Server" "Phishing-Phishing.Server" "Proxy-Proxy.Server" "Spam-Spamming.Server" "VPN-Anonymous.VPN" "Malicious-Malicious.Server" set dstaddr "all" set action deny set schedule "always" set service "ALL" set logtraffic all next edit 0 set name "Block-Malicious-Out" set srcintf "any" set dstintf "any" set srcaddr "all" set internet-service enable set internet-service-name "Tor-Relay.Node" "Botnet-C&C.Server" "Phishing-Phishing.Server" "Proxy-Proxy.Server" "Spam-Spamming.Server" "VPN-Anonymous.VPN" "Malicious-Malicious.Server" set action deny set schedule "always" set logtraffic all next end # CIS guidance: Review firewall policies and ensure there are: 1. A firewall policy created to block inbound connections with these settings: From: Any To: Any Source: "Tor-Exit.Node", "Tor-Relay.Node", "Censys-Scanner", "Shodan- Scanner", "Botnet-C&C.Server", "Phishing-Phishing.Server", "Proxy- Proxy.Server", "Spam-Spamming.Server", "VPN-Anonymous.VPN", and "Malicious- Malicious.Server" Destination: all Schedule: Always Services: All Action: Deny Log Violation Traffic: Enabled Enable this policy: Enabled 2. A firewall policy created to block outbound connections with these settings: From: Any To: Any Source: All Destination: "Tor-Relay.Node", "Botnet-C&C.Server", "Phishing- Phishing.Server", "Proxy-Proxy.Server", "Spam-Spamming.Server", "VPN- Anonymous.VPN", and "Malicious-Malicious.Server" Schedule: Always Action: Deny Log Violation Traffic: Enabled Enable this policy: Enabled

Eigenschaften

Betriebssysteme: Beliebig
Tags: fortigatefirewall-policy
Referenz: CIS FortiGate 7.4.x Benchmark v1.0.1 - 3.3 Ensure firewall policy denying all traffic to/from Tor, malicious server, or scanner IP addresses using ISDB

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target fortigate