Ensure SSL/TLS inspection rules is enabled to all relevant firewall policies

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Navigate to 'Protect > Rules and policies > SSL/TLS inspection rules > SSL/TLS inspection settings'. Verify that 'Non-decryptable traffic > SSL 2.0 and SSL 3.0' is set to 'Reject' or 'Drop'. Verify that 'SSL compression' is set to 'Reject' or 'Drop'. Verify that 'When SSL/TLS connections exceed limit' is set to 'Drop' or 'Reject'. Verify that 'TLS 1.3 decryption' is set to 'Decrypt as 1.3'. Verify that 'Advanced settings > SSL/TLS engine' is set to 'Enabled'. (Full steps: CIS 5.2.)

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Navigate to 'Rules and policies > SSL/TLS inspection rules > SSL/TLS inspection settings'. Set 'Non-decryptable traffic > SSL 2.0 and SSL 3.0' to 'Reject' or 'Drop'. Set 'SSL compression' to 'Reject' or 'Drop'. Set 'When SSL/TLS connections exceed limit' to 'Drop' or 'Reject'. Set 'TLS 1.3 decryption' to 'Decrypt as 1.3'. Set 'Advanced settings > SSL/TLS engine' to 'Enabled'. Navigate to configured 'SSL/TLS inspection rule' and set the 'Action' to 'Decrypt' and 'Log connections' is checked. Set the rule position to above rules configured with 'Action' set to 'Don't decrypt'. Navigate to the configured Firewall rules. Set 'Scan HTTP and decrypted HTTPS' and 'Use zero-day protection' is checked.