Ensure VPN traffic goes through the relevant ACL

CaoCấp 2Tự độngcisco-asa

Mô tả

By default, the traffic going through IPSEC tunnel (policy-based) bypasses the ACL of the interface the VPN terminates on, often the outside ACL. VPN are used to interconnect sites, whether intra or inter companies. In many cases, these are seen to extensions of the local network and very little filtering is applied. CIS marks this Manual; automated because the non-default 'no sysopt connection permit-vpn' line is visible in the config. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Cách kiểm tra

Phương pháp kiểm tra: Mẫu cấu hình

Mẫu khớp: (?m)^no sysopt connection permit-vpn\s*$

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Summary - Step 1: determine on which interface(s) the IPSEC tunnel ends - Step 2: determine the ACL applied to the interface - Step 3: add an ACE to the ACL to permit the traffic temporarily - Step 4: disable the bypass Step 1 show run full | grep crypto.map..*.interface. crypto map my_remote_sites interface outside In this example, the crypto map my_remote_sites is applied to the interface outside: the IPSEC tunnel terminates on the interface outside. Step 2 sh run access-group | grep interface.outside access-group outside_acl in interface outside The ACL outside_acl is applied to the interface outside. Step 3 Note: this considers that the remote site networks are defined in an object called obj-remote-site and the local site networks in an object called obj-local-site. The ACE is added as the first entry in this case but could be after an initial series of denies to known "bad" destinations. access-list outside_acl line 1 permit ip object obj-remote-site object obj-local-site log notifications access-list outside_acl line 2 remark Temporary permit from remote site. Restrict as soon as possible. Step 4 no sysopt connection permit-vpn

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: cisco-asanetworkhardening
Tham chiếu: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 3.13 Ensure VPN traffic goes through the relevant ACL

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target cisco-asa --level 2