Ensure packet fragments are restricted for untrusted interfaces

AltaNivel 1Automatizadacisco-asa

Descripción

Sets the security appliance to drop fragmented packets received on the untrusted interface. Attackers use fragmentation to evade security systems such as firewalls or IPS because the checks are usually performed on the first fragment. They can then put malicious payload in the other fragments to perform DoS against internal systems. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?m)^fragment chain 1 \S+

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

! - Step 1: Acquire the name of the untrusted interface <interface_name> - Step 2: Run the following command to deny fragments on the interface. fragment chain 1 <interface_name>

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: cisco-asanetworkmanagement-plane
Referencia: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 3.3 Ensure packet fragments are restricted for untrusted interfaces

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target cisco-asa