Ensure Site-to-Site IPSec VPN is not configured with "Aggressive Mode"

高等級 2人工審核sophos

說明

IKEv1 Aggressive Mode does not provide Peer Identity Protection. They are vulnerable to offline dictionary or brute force attack. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Navigate to 'System > Profiles > IPsec profiles'. Verify that active 'IPsec Profile' in used is not configured with 'Key exchange' 'IKEv1' and 'Authentication mode' 'Aggressive mode'.

修補方式

修補方法: 操作指南或基礎設施修補檔

Navigate to 'System > Profiles > IPsec profiles'. Remove any active 'IPsec Profiles' configured with 'Key exchange' 'IKEv1' and 'Authentication mode' 'Aggressive mode' and replace with 'IKEv2' or 'Main mode'.

屬性

作業系統: 不限
標籤: sophoshardening
參考資料: CIS Sophos Firewall v22 Benchmark v1.0.0 - 3.6 Ensure Site-to-Site IPSec VPN is not configured with "Aggressive Mode"