OpenControls Logo

STIG Viewer

STIGViewer Support

The FortiGate firewall implementation must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-234146FNFG-FW-000075SV-234146r611438_ruleCCI-001095medium
Description
A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering resulting in route flapping and will eventually black hole production traffic. The device must be configured to contain and limit a DoS attack's effect on the device's resource utilization. The use of redundant components and load balancing are examples of mitigating "flood-type" DoS attacks through increased capacity.
STIGDate
Fortinet FortiGate Firewall Security Technical Implementation Guide2022-09-12

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CAP-02Resource Priority
0.50
CAP-03Capacity Planning
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AU-3Content of Audit Records
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
CM-7(2)Prevent Program Execution
1.00
SC-47Alternate Communications Paths
1.00
SC-5Denial-of-service Protection
1.00

+3 more (top 10 by confidence shown)

CCI1 mapping
CCI-001095
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.IR-04
0.50

Details

Check Text (C-234146r611438_chk)

Log in to the FortiGate GUI with Super-Admin privilege. 1. Click Policy and Objects. 2. Go to IPv4 DoS Policy. 3. Verify different DoS policies that include Incoming Interface, Source Address, Destination Address, and Services have been created. 4. Verify the DoS policies are configured to block L3 and L4 anomalies. If the DoS policies are not configured to block excess traffic, this is a finding.

Fix Text (F-37296r611437_fix)

Log in to the FortiGate GUI with Super-Admin privilege. 1. Click Policy and Objects. 2. Click IPv4 DoS Policy or IPv6 DoS Policy. 3. Click +Create New. 4. Select the Incoming Interface. 5. Select Source and Destination addresses. 6. Select the Service. 7. Enable desired L3 and L4 anomalies and thresholds. 8. Ensure the Enable this policy is toggle to right. 9. Click OK. 10. Ensure a policy is created for each interface where there is potential risk of DoS.