Ensure packet fragments are restricted for untrusted interfaces

高レベル 1自動cisco-asa

説明

Sets the security appliance to drop fragmented packets received on the untrusted interface. Attackers use fragmentation to evade security systems such as firewalls or IPS because the checks are usually performed on the first fragment. They can then put malicious payload in the other fragments to perform DoS against internal systems. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

チェック方法

監査方法: 設定パターン

パターン: (?m)^fragment chain 1 \S+

修正方法

修正方法: ガイダンスまたは IaC パッチ

! - Step 1: Acquire the name of the untrusted interface <interface_name> - Step 2: Run the following command to deny fragments on the interface. fragment chain 1 <interface_name>

プロパティ

オペレーティングシステム: すべて
タグ: cisco-asanetworkmanagement-plane
参照: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 3.3 Ensure packet fragments are restricted for untrusted interfaces

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target cisco-asa