Ensure DoS & Spoof Protection is enabled with the appropriate settings

보통레벨 1수동 검토sophos

설명

Enable SYN/TCP/UDP Flood protection for source and destination networks with appropriate threshold for Flood protection which depend highly on the environment and device used. Default packet/minutes or packet/seconds value may not be appropriate for all the environment and understanding of traffic patterns on the specific environment may be required to set accurate threshold. Enable Spoof protection to drop the packet if the source IP address of a packet does not match any entry on the firewall's routing table or if the packet is not from a direct subnet. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Verify that 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Verify that 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Verify that 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. (Full steps: CIS 5.7.)

조치 방법

조치 방식: 가이드 또는 인프라 패치

Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Set 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Set 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Set 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. Validate 'DoS bypass rule' is not added with wide range of source or destination networks that will reduce integrity of overall DoS protection.

속성

운영 체제: 모두
태그: sophoshardening
참고 자료: CIS Sophos Firewall v22 Benchmark v1.0.0 - 5.7 Ensure DoS & Spoof Protection is enabled with the appropriate settings