Enable Limited TLS Versions for SSL VPN

HochStufe 2Automatisiertfortigate

Beschreibung

Enable and disable TLS versions and Cipher suites for more granular control of SSL VPN connections and enforcing more secure connections. PASS requires ssl-max-proto-ver tls1-3, ssl-min-proto-ver tls1-2 and algorithm high. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

So wird geprüft

Prüfmethode: Konfigurationsmuster

Muster: (?m)^config vpn ssl settings\n(?:(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-max-proto-ver tls1-3[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-min-proto-ver tls1-2[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set algorithm high[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-max-proto-ver tls1-3[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set algorithm high[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-min-proto-ver tls1-2[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-min-proto-ver tls1-2[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-max-proto-ver tls1-3[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set algorithm high[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-min-proto-ver tls1-2[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set algorithm high[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-max-proto-ver tls1-3[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set algorithm high[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-max-proto-ver tls1-3[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-min-proto-ver tls1-2[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set algorithm high[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-min-proto-ver tls1-2[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set ssl-max-proto-ver tls1-3[ \t]*$)

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

config vpn ssl settings set ssl-max-proto-ver tls1-3 set ssl-min-proto-ver tls1-2 set algorithm high end # CIS guidance: CLI: config vpn ssl settings set ssl-max-proto-ver tls1-3 set ssl-min-proto-ver tls1-2 set algorithm high

Eigenschaften

Betriebssysteme: Beliebig
Tags: fortigatecrypto
Referenz: CIS FortiGate 7.4.x Benchmark v1.0.1 - 6.1.2 Enable Limited TLS Versions for SSL VPN

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target fortigate --level 2