Ensure packet fragments are restricted for untrusted interfaces

VisokaNivo 1Automatskacisco-asa

Opis

Sets the security appliance to drop fragmented packets received on the untrusted interface. Attackers use fragmentation to evade security systems such as firewalls or IPS because the checks are usually performed on the first fragment. They can then put malicious payload in the other fragments to perform DoS against internal systems. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Kako se proverava

Metod provere: Obrazac konfiguracije

Obrazac: (?m)^fragment chain 1 \S+

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

! - Step 1: Acquire the name of the untrusted interface <interface_name> - Step 2: Run the following command to deny fragments on the interface. fragment chain 1 <interface_name>

Svojstva

Operativni sistemi: Bilo koji
Oznake: cisco-asanetworkmanagement-plane
Referenca: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 3.3 Ensure packet fragments are restricted for untrusted interfaces

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target cisco-asa