Fortinet FortiGate
TMA-FORTIGATE-3.2
Ensure that policies do not use "ALL" as Service
Descripción
Ensure that all security policies in effect clearly state which protocols / services they are allowing. FAILs if an accept policy uses the "ALL" service (deny policies such as the CIS 3.3 ISDB rules may use ALL). Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.
Cómo se verifica
Método de auditoría: Patrón de configuración
- Patrón
(?m)^config firewall policy\n(?:[ \t]+[^\n]*\n)*?[ \t]+set action accept[ \t]*\n(?:[ \t]+(?:set|unset) [^\n]*\n)*?[ \t]+set service [^\n]*"ALL"
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
config firewall policy edit <id> set service "HTTPS" "DNS" next end # CIS guidance: This is an example showing how to modify policy with ID of 2 to change the service from "ALL" to FTP and SNMP. In CLI: config firewall policy edit 2 set service "FTP" "SNMP" end In the GUI, 1. Go to Policy & Objects. 2. Click on Firewall Policy. 3. Select the policy, click "Edit". 4. In the Service section, click on it and select FTP and SNMP. Click OK.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- fortigatefirewall-policy
- Referencia
- CIS FortiGate 7.4.x Benchmark v1.0.1 - 3.2 Ensure that policies do not use "ALL" as Service
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target fortigate