Ensure Site-to-Site IPSec VPN is not configured with "Aggressive Mode"

높음레벨 2수동 검토sophos

설명

IKEv1 Aggressive Mode does not provide Peer Identity Protection. They are vulnerable to offline dictionary or brute force attack. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Navigate to 'System > Profiles > IPsec profiles'. Verify that active 'IPsec Profile' in used is not configured with 'Key exchange' 'IKEv1' and 'Authentication mode' 'Aggressive mode'.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Navigate to 'System > Profiles > IPsec profiles'. Remove any active 'IPsec Profiles' configured with 'Key exchange' 'IKEv1' and 'Authentication mode' 'Aggressive mode' and replace with 'IKEv2' or 'Main mode'.

속성

운영 체제: 모두
태그: sophoshardening
참고 자료: CIS Sophos Firewall v22 Benchmark v1.0.0 - 3.6 Ensure Site-to-Site IPSec VPN is not configured with "Aggressive Mode"