Ensure VPN traffic goes through the relevant ACL

높음레벨 2자동cisco-asa

설명

By default, the traffic going through IPSEC tunnel (policy-based) bypasses the ACL of the interface the VPN terminates on, often the outside ACL. VPN are used to interconnect sites, whether intra or inter companies. In many cases, these are seen to extensions of the local network and very little filtering is applied. CIS marks this Manual; automated because the non-default 'no sysopt connection permit-vpn' line is visible in the config. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^no sysopt connection permit-vpn\s*$

조치 방법

조치 방식: 가이드 또는 인프라 패치

Summary - Step 1: determine on which interface(s) the IPSEC tunnel ends - Step 2: determine the ACL applied to the interface - Step 3: add an ACE to the ACL to permit the traffic temporarily - Step 4: disable the bypass Step 1 show run full | grep crypto.map..*.interface. crypto map my_remote_sites interface outside In this example, the crypto map my_remote_sites is applied to the interface outside: the IPSEC tunnel terminates on the interface outside. Step 2 sh run access-group | grep interface.outside access-group outside_acl in interface outside The ACL outside_acl is applied to the interface outside. Step 3 Note: this considers that the remote site networks are defined in an object called obj-remote-site and the local site networks in an object called obj-local-site. The ACE is added as the first entry in this case but could be after an initial series of denies to known "bad" destinations. access-list outside_acl line 1 permit ip object obj-remote-site object obj-local-site log notifications access-list outside_acl line 2 remark Temporary permit from remote site. Restrict as soon as possible. Step 4 no sysopt connection permit-vpn

속성

운영 체제: 모두
태그: cisco-asanetworkhardening
참고 자료: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 3.13 Ensure VPN traffic goes through the relevant ACL

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cisco-asa --level 2