Ensure firewall policy denying all traffic to/from Tor, malicious server, or scanner IP addresses using ISDB

AltaNivel 1Automatizadafortigate

Descripción

Firewall policies should include a deny rule for traffic going to/from Tor, malicious server, or scanner IP addresses using ISDB (Internet Service Database). PASS requires a policy using ISDB source Tor-Exit.Node (inbound) and a policy using ISDB destination Tor-Relay.Node (outbound); confirm both list all CIS ISDB objects and use action deny with logging. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?m)^config firewall policy\n(?:(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-src-name [^\n]*"Tor-Exit\.Node"[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-name [^\n]*"Tor-Relay\.Node"[^\n]*[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-name [^\n]*"Tor-Relay\.Node"[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-src-name [^\n]*"Tor-Exit\.Node"[^\n]*[ \t]*$)

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

config firewall policy edit 0 set name "Block-Malicious-In" set srcintf "any" set dstintf "any" set internet-service-src enable set internet-service-src-name "Tor-Exit.Node" "Tor-Relay.Node" "Censys-Scanner" "Shodan-Scanner" "Botnet-C&C.Server" "Phishing-Phishing.Server" "Proxy-Proxy.Server" "Spam-Spamming.Server" "VPN-Anonymous.VPN" "Malicious-Malicious.Server" set dstaddr "all" set action deny set schedule "always" set service "ALL" set logtraffic all next edit 0 set name "Block-Malicious-Out" set srcintf "any" set dstintf "any" set srcaddr "all" set internet-service enable set internet-service-name "Tor-Relay.Node" "Botnet-C&C.Server" "Phishing-Phishing.Server" "Proxy-Proxy.Server" "Spam-Spamming.Server" "VPN-Anonymous.VPN" "Malicious-Malicious.Server" set action deny set schedule "always" set logtraffic all next end # CIS guidance: Review firewall policies and ensure there are: 1. A firewall policy created to block inbound connections with these settings: From: Any To: Any Source: "Tor-Exit.Node", "Tor-Relay.Node", "Censys-Scanner", "Shodan- Scanner", "Botnet-C&C.Server", "Phishing-Phishing.Server", "Proxy- Proxy.Server", "Spam-Spamming.Server", "VPN-Anonymous.VPN", and "Malicious- Malicious.Server" Destination: all Schedule: Always Services: All Action: Deny Log Violation Traffic: Enabled Enable this policy: Enabled 2. A firewall policy created to block outbound connections with these settings: From: Any To: Any Source: All Destination: "Tor-Relay.Node", "Botnet-C&C.Server", "Phishing- Phishing.Server", "Proxy-Proxy.Server", "Spam-Spamming.Server", "VPN- Anonymous.VPN", and "Malicious-Malicious.Server" Schedule: Always Action: Deny Log Violation Traffic: Enabled Enable this policy: Enabled

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: fortigatefirewall-policy
Referencia: CIS FortiGate 7.4.x Benchmark v1.0.1 - 3.3 Ensure firewall policy denying all traffic to/from Tor, malicious server, or scanner IP addresses using ISDB

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target fortigate