Sophos Firewall
TMA-SOPHOS-3.6
Ensure Site-to-Site IPSec VPN is not configured with "Aggressive Mode"
HighLevel 2Manual reviewsophos
Description
IKEv1 Aggressive Mode does not provide Peer Identity Protection. They are vulnerable to offline dictionary or brute force attack. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Navigate to 'System > Profiles > IPsec profiles'. Verify that active 'IPsec Profile' in used is not configured with 'Key exchange' 'IKEv1' and 'Authentication mode' 'Aggressive mode'.
How it is fixed
Fix method: Guidance or infrastructure patch
Navigate to 'System > Profiles > IPsec profiles'. Remove any active 'IPsec Profiles' configured with 'Key exchange' 'IKEv1' and 'Authentication mode' 'Aggressive mode' and replace with 'IKEv2' or 'Main mode'.
Properties
- Operating systems
- Any
- Tags
- sophoshardening
- Reference
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 3.6 Ensure Site-to-Site IPSec VPN is not configured with "Aggressive Mode"