Ensure packet fragments are restricted for untrusted interfaces

TinggiLevel 1Otomatiscisco-asa

Deskripsi

Sets the security appliance to drop fragmented packets received on the untrusted interface. Attackers use fragmentation to evade security systems such as firewalls or IPS because the checks are usually performed on the first fragment. They can then put malicious payload in the other fragments to perform DoS against internal systems. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Cara pemeriksaan

Metode audit: Pola konfigurasi

Pola: (?m)^fragment chain 1 \S+

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

! - Step 1: Acquire the name of the untrusted interface <interface_name> - Step 2: Run the following command to deny fragments on the interface. fragment chain 1 <interface_name>

Properti

Sistem operasi: Apa saja
Tag: cisco-asanetworkmanagement-plane
Referensi: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 3.3 Ensure packet fragments are restricted for untrusted interfaces

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target cisco-asa