Fortinet FortiGate
TMA-FORTIGATE-4.3.1
Enable Botnet C&C Domain Blocking DNS Filter
Beschreibung
Enable Botnet C&C domain blocking to block botnet access at the DNS name resolving stage. PASS requires a DNS filter profile with block-botnet enable; confirm it is applied to policies carrying DNS. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.
So wird geprüft
Prüfmethode: Konfigurationsmuster
- Muster
(?m)^config dnsfilter profile\n(?:[ \t]+[^\n]*\n)*?[ \t]+set block-botnet enable[ \t]*$
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
config dnsfilter profile edit "<profile>" set block-botnet enable next end # CIS guidance: On GUI: 1. Go to Security Profiles > DNS Filter. 2. On the relevant security profile name, double click. Enable "Redirect botnet C&C requests to Block Portal". 2. Ensure that firewall policies that have DNS traffic have a DNS Filter security profile applied with that option enabled.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- fortigatethreat-prevention
- Referenz
- CIS FortiGate 7.4.x Benchmark v1.0.1 - 4.3.1 Enable Botnet C&C Domain Blocking DNS Filter
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target fortigate --level 2