Ensure Firewall rules are configured to identify users before authorizing access

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Validate allowed firewall rules with source zone (LAN/DMZ) are configured with user identification. Source network where users are located must authenticate to Sophos Firewall first before accessing network resources. Verify that 'Protect > Rules and policies > Firewall rules' and within the firewall rule ensure 'Match known users' is checked and add authorized 'User or groups'. Captive portal redirects to unknown users by ensuring 'Use web authentication for unknown users' is checked.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

To enable user based firewall rule: Navigate to 'Protect > Rules and policies > Firewall rules' edit existing policies or when creating a new firewall policy 'match known users' is checked. 'Log firewall traffic' is checked to log for allowed traffic. Configure authentication server to use for firewall connections. Navigate to 'Configure > Authentication > Services > Firewall authentication methods' move the primary authentication server at the top. Configure Clientless users for devices such as printers and IoT devices that unable to authenticate with standard authentication options. To add the devices to clientless users, navigate to 'Configure > Authentication > Clientless users > Add or Add range' In Active directory environment AD SSO can be configured to allow unauthenticated web access. Sophos Firewall also supports Authentication using Microsoft Entra ID SSO Navigate to 'Configure > Authentication > Web Authentication > Authorize unauthenticated users for web access > Kerberos & NTLM' and 'show captive portal link' is checked. In Window only environment clientless SSO can be configured to authenticate with Sophos Firewall based on security logon events at the Domain Controllers. Navigate to 'Configure > Authentication > STAS > Enable Sophos Transparent Authentication Suite > Add new collector' and 'Restrict client traffic during identity probe > Yes'. Refer to the reference section for more information with the configuration.