Ensure DoS & Spoof Protection is enabled with the appropriate settings

OrtaDüzey 1Manuel incelemesophos

Açıklama

Enable SYN/TCP/UDP Flood protection for source and destination networks with appropriate threshold for Flood protection which depend highly on the environment and device used. Default packet/minutes or packet/seconds value may not be appropriate for all the environment and understanding of traffic patterns on the specific environment may be required to set accurate threshold. Enable Spoof protection to drop the packet if the source IP address of a packet does not match any entry on the firewall's routing table or if the packet is not from a direct subnet. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Verify that 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Verify that 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Verify that 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. (Full steps: CIS 5.7.)

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Set 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Set 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Set 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. Validate 'DoS bypass rule' is not added with wide range of source or destination networks that will reduce integrity of overall DoS protection.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: sophoshardening
Referans: CIS Sophos Firewall v22 Benchmark v1.0.0 - 5.7 Ensure DoS & Spoof Protection is enabled with the appropriate settings