Sophos Firewall
TMA-SOPHOS-3.6
Ensure Site-to-Site IPSec VPN is not configured with "Aggressive Mode"
VisokaNivo 2Ručni pregledsophos
Opis
IKEv1 Aggressive Mode does not provide Peer Identity Protection. They are vulnerable to offline dictionary or brute force attack. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Kako se proverava
Metod provere: Ručni pregled
Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.
Navigate to 'System > Profiles > IPsec profiles'. Verify that active 'IPsec Profile' in used is not configured with 'Key exchange' 'IKEv1' and 'Authentication mode' 'Aggressive mode'.
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Navigate to 'System > Profiles > IPsec profiles'. Remove any active 'IPsec Profiles' configured with 'Key exchange' 'IKEv1' and 'Authentication mode' 'Aggressive mode' and replace with 'IKEv2' or 'Main mode'.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- sophoshardening
- Referenca
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 3.6 Ensure Site-to-Site IPSec VPN is not configured with "Aggressive Mode"