Sophos Firewall
TMA-SOPHOS-5.7
Ensure DoS & Spoof Protection is enabled with the appropriate settings
Descrição
Enable SYN/TCP/UDP Flood protection for source and destination networks with appropriate threshold for Flood protection which depend highly on the environment and device used. Default packet/minutes or packet/seconds value may not be appropriate for all the environment and understanding of traffic patterns on the specific environment may be required to set accurate threshold. Enable Spoof protection to drop the packet if the source IP address of a packet does not match any entry on the firewall's routing table or if the packet is not from a direct subnet. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Como é verificado
Método de auditoria: Revisão manual
Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Verify that 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Verify that 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Verify that 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. (Full steps: CIS 5.7.)
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Set 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Set 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Set 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. Validate 'DoS bypass rule' is not added with wide range of source or destination networks that will reduce integrity of overall DoS protection.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- sophoshardening
- Referência
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 5.7 Ensure DoS & Spoof Protection is enabled with the appropriate settings