Ensure packet fragments are restricted for untrusted interfaces

높음레벨 1자동cisco-asa

설명

Sets the security appliance to drop fragmented packets received on the untrusted interface. Attackers use fragmentation to evade security systems such as firewalls or IPS because the checks are usually performed on the first fragment. They can then put malicious payload in the other fragments to perform DoS against internal systems. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^fragment chain 1 \S+

조치 방법

조치 방식: 가이드 또는 인프라 패치

! - Step 1: Acquire the name of the untrusted interface <interface_name> - Step 2: Run the following command to deny fragments on the interface. fragment chain 1 <interface_name>

속성

운영 체제: 모두
태그: cisco-asanetworkmanagement-plane
참고 자료: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 3.3 Ensure packet fragments are restricted for untrusted interfaces

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cisco-asa