Ensure DoS & Spoof Protection is enabled with the appropriate settings

Trung bìnhCấp 1Xem xét thủ côngsophos

Mô tả

Enable SYN/TCP/UDP Flood protection for source and destination networks with appropriate threshold for Flood protection which depend highly on the environment and device used. Default packet/minutes or packet/seconds value may not be appropriate for all the environment and understanding of traffic patterns on the specific environment may be required to set accurate threshold. Enable Spoof protection to drop the packet if the source IP address of a packet does not match any entry on the firewall's routing table or if the packet is not from a direct subnet. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Verify that 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Verify that 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Verify that 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. (Full steps: CIS 5.7.)

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Navigate to 'Protect > Intrusion Prevention > DoS & Spoof Protection' Set 'Enable spoof prevention' is checked on LAN and DMZ zones. Under DoS settings > Set 'Apply Flag' is checked on 'SYN flood', 'UDP flood', 'TCP flood', 'ICMP/ICMPv6' flood on both Source and Destination. Under DoS settings > Set 'Apply Flag' is checked on 'Dropped source routed packets', 'Disable ICMP/ICMPv6 redirect packet', 'ARP hardening' on Destination. Validate 'DoS bypass rule' is not added with wide range of source or destination networks that will reduce integrity of overall DoS protection.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: sophoshardening
Tham chiếu: CIS Sophos Firewall v22 Benchmark v1.0.0 - 5.7 Ensure DoS & Spoof Protection is enabled with the appropriate settings