TMA-FORTISWITCH-1.7.1.1.6

Apply Local-in Policies

中级别 1自动化fortiswitch

说明

Configure Local-in Policies to control inbound traffic that is destined to a FortiGate interface. PASS requires at least one local-in policy. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

检查方式

审计方法: 配置正则匹配

匹配模式: (?m)^config (?:firewall|system) local-in-policy6?\n[ \t]+edit

修复方式

修复方法: 操作指南或基础设施补丁

Local-in Policies can only be configured through the CLI: config firewall {local-in-policy | local-in-policy6} edit <policy_number> set intf <interface> set srcaddr <source_address> [source_address] ... set dstaddr <destination_address> [destination_address] ... set action {accept | deny} set service <service_name> [service_name] ... set schedule <schedule_name> set comments <string> next end For example, to prevent the source subnet 10.10.10.0/24 from pinging port1, but allow administrative access for PING on port1: config firewall address edit "10.10.10.0" set subnet 10.10.10.0 255.255.255.0 next end config firewall local-in-policy edit 1 set intf "port1" set srcaddr "10.10.10.0" set dstaddr "all" set service "PING" set schedule "always" next end

属性

操作系统: 任意
标签: fortiswitchfirewall-policy
参考: CIS FortiSwitch Benchmark v1.0.0 - 1.7.1.1.6 Apply Local-in Policies

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target fortiswitch