Ensure DoS & Spoof Protection is enabled with the appropriate settings

MoyenneNiveau 1Revue manuellesophos

Description

Enable SYN/TCP/UDP Flood protection for source and destination networks with appropriate threshold for Flood protection which depend highly on the environment and device used. Default packet/minutes or packet/seconds value may not be appropriate for all the environment and understanding of traffic patterns on the specific environment may be required to set accurate threshold. Enable Spoof protection to drop the packet if the source IP address of a packet does not match any entry on the firewall's routing table or if the packet is not from a direct subnet. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Verify that 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Verify that 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Verify that 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. (Full steps: CIS 5.7.)

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Set 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Set 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Set 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. Validate 'DoS bypass rule' is not added with wide range of source or destination networks that will reduce integrity of overall DoS protection.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: sophoshardening
Référence: CIS Sophos Firewall v22 Benchmark v1.0.0 - 5.7 Ensure DoS & Spoof Protection is enabled with the appropriate settings