Ensure packet fragments are restricted for untrusted interfaces

ÉlevéeNiveau 1Automatiséecisco-asa

Description

Sets the security appliance to drop fragmented packets received on the untrusted interface. Attackers use fragmentation to evade security systems such as firewalls or IPS because the checks are usually performed on the first fragment. They can then put malicious payload in the other fragments to perform DoS against internal systems. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Méthode de vérification

Méthode d'audit: Motif de configuration

Motif: (?m)^fragment chain 1 \S+

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

! - Step 1: Acquire the name of the untrusted interface <interface_name> - Step 2: Run the following command to deny fragments on the interface. fragment chain 1 <interface_name>

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: cisco-asanetworkmanagement-plane
Référence: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 3.3 Ensure packet fragments are restricted for untrusted interfaces

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target cisco-asa