Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-234146 | FNFG-FW-000075 | SV-234146r628776_rule | Medium |
Description |
---|
A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering resulting in route flapping and will eventually black hole production traffic. The device must be configured to contain and limit a DoS attack's effect on the device's resource utilization. The use of redundant components and load balancing are examples of mitigating "flood-type" DoS attacks through increased capacity. |
STIG | Date |
---|---|
Fortinet FortiGate Firewall Security Technical Implementation Guide | 2021-01-29 |
Check Text ( C-37331r611436_chk ) |
---|
Log in to the FortiGate GUI with Super-Admin privilege. 1. Click Policy and Objects. 2. Go to IPv4 DoS Policy. 3. Verify different DoS policies that include Incoming Interface, Source Address, Destination Address, and Services have been created. 4. Verify the DoS policies are configured to block L3 and L4 anomalies. If the DoS policies are not configured to block excess traffic, this is a finding. |
Fix Text (F-37296r611437_fix) |
---|
Log in to the FortiGate GUI with Super-Admin privilege. 1. Click Policy and Objects. 2. Click IPv4 DoS Policy or IPv6 DoS Policy. 3. Click +Create New. 4. Select the Incoming Interface. 5. Select Source and Destination addresses. 6. Select the Service. 7. Enable desired L3 and L4 anomalies and thresholds. 8. Ensure the Enable this policy is toggle to right. 9. Click OK. 10. Ensure a policy is created for each interface where there is potential risk of DoS. |