Cisco ASA
TMA-CISCO-ASA-3.3
Ensure packet fragments are restricted for untrusted interfaces
Description
Sets the security appliance to drop fragmented packets received on the untrusted interface. Attackers use fragmentation to evade security systems such as firewalls or IPS because the checks are usually performed on the first fragment. They can then put malicious payload in the other fragments to perform DoS against internal systems. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).
How it is checked
Audit method: Configuration pattern
- Pattern
(?m)^fragment chain 1 \S+
How it is fixed
Fix method: Guidance or infrastructure patch
! - Step 1: Acquire the name of the untrusted interface <interface_name> - Step 2: Run the following command to deny fragments on the interface. fragment chain 1 <interface_name>
Properties
- Operating systems
- Any
- Tags
- cisco-asanetworkmanagement-plane
- Reference
- CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 3.3 Ensure packet fragments are restricted for untrusted interfaces
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target cisco-asa