Detections
Analytics
Ensure packet fragments are restricted for untrusted interfaces
Information
Sets the security appliance to drop fragmented packets received on the untrusted interface.Rationale:
Attackers use fragmentation to evade security systems such as firewalls or IPS because the checks are usually performed on the first fragment. They can then put malicious payload in the other fragments to perform DoS against internal systems. Disabling the fragmentation on the security appliance implies changing its default behavior from accepting up to 24 fragments in a packet to accepting only 1 fragment in a packet. In other words, it implies accepting only non fragmented packets.
Solution
Configure Fragment settings with Firepower Management Center:Step 1 - Select Devices > Device Management and click the edit icon () for your FTD device. The Interfaces tab is selected by default.
Step 2 - Click the edit icon () for the interface you want to edit.
Step 3 - Click the Advanced tab, and then click the Security Configuration tab.
Step 4 - To enable Unicast Reverse Path Forwarding, check the Anti-Spoofing check box.
Step 5 - To enable full fragment reassembly, check the Full Fragment Reassembly check box.
Step 6 - To change the number of fragments allowed per packet, check the Override Default Fragment Setting check box
See Also
Item Details
Audit Name: Tenable Cisco Firepower Best Practices Audit
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6
Plugin: Cisco
Control ID: 5f1ef8d25e0923ea825e326dfb27e291d852f3356f871ca7fdd7e584c75e4ff1