Ensure firewall policy denying all traffic to/from Tor, malicious server, or scanner IP addresses using ISDB

TinggiLevel 1Otomatisfortigate

Deskripsi

Firewall policies should include a deny rule for traffic going to/from Tor, malicious server, or scanner IP addresses using ISDB (Internet Service Database). PASS requires a policy using ISDB source Tor-Exit.Node (inbound) and a policy using ISDB destination Tor-Relay.Node (outbound); confirm both list all CIS ISDB objects and use action deny with logging. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

Cara pemeriksaan

Metode audit: Pola konfigurasi

Pola: (?m)^config firewall policy\n(?:(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-src-name [^\n]*"Tor-Exit\.Node"[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-name [^\n]*"Tor-Relay\.Node"[^\n]*[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-name [^\n]*"Tor-Relay\.Node"[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set internet-service-src-name [^\n]*"Tor-Exit\.Node"[^\n]*[ \t]*$)

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

config firewall policy edit 0 set name "Block-Malicious-In" set srcintf "any" set dstintf "any" set internet-service-src enable set internet-service-src-name "Tor-Exit.Node" "Tor-Relay.Node" "Censys-Scanner" "Shodan-Scanner" "Botnet-C&C.Server" "Phishing-Phishing.Server" "Proxy-Proxy.Server" "Spam-Spamming.Server" "VPN-Anonymous.VPN" "Malicious-Malicious.Server" set dstaddr "all" set action deny set schedule "always" set service "ALL" set logtraffic all next edit 0 set name "Block-Malicious-Out" set srcintf "any" set dstintf "any" set srcaddr "all" set internet-service enable set internet-service-name "Tor-Relay.Node" "Botnet-C&C.Server" "Phishing-Phishing.Server" "Proxy-Proxy.Server" "Spam-Spamming.Server" "VPN-Anonymous.VPN" "Malicious-Malicious.Server" set action deny set schedule "always" set logtraffic all next end # CIS guidance: Review firewall policies and ensure there are: 1. A firewall policy created to block inbound connections with these settings: From: Any To: Any Source: "Tor-Exit.Node", "Tor-Relay.Node", "Censys-Scanner", "Shodan- Scanner", "Botnet-C&C.Server", "Phishing-Phishing.Server", "Proxy- Proxy.Server", "Spam-Spamming.Server", "VPN-Anonymous.VPN", and "Malicious- Malicious.Server" Destination: all Schedule: Always Services: All Action: Deny Log Violation Traffic: Enabled Enable this policy: Enabled 2. A firewall policy created to block outbound connections with these settings: From: Any To: Any Source: All Destination: "Tor-Relay.Node", "Botnet-C&C.Server", "Phishing- Phishing.Server", "Proxy-Proxy.Server", "Spam-Spamming.Server", "VPN- Anonymous.VPN", and "Malicious-Malicious.Server" Schedule: Always Action: Deny Log Violation Traffic: Enabled Enable this policy: Enabled

Properti

Sistem operasi: Apa saja
Tag: fortigatefirewall-policy
Referensi: CIS FortiGate 7.4.x Benchmark v1.0.1 - 3.3 Ensure firewall policy denying all traffic to/from Tor, malicious server, or scanner IP addresses using ISDB

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target fortigate