V-283898

Discussion

Auditing and logging are key components of any security architecture. Security personnel must know what is being done or attempted to be done, and by whom, to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack or identify a configuration mistake on the device.

Check Content

Review the IP filter to verify all deny statements are logged.

Use the commands below to verify the filter is logged and applied on the interface. 

- show filter ip 60

Entry               : 10
Description         : (Not Specified)
Log Id              : 101
Src. IP             : 0.0.0.0/0
Src. Port           : n/a
Dest. IP            : 0.0.0.0/0
Dest. Port          : n/a
Protocol            : Undefined
Dscp                : Undefined
ICMP Type           : Undefined                    ICMP Code      : Undefined
Fragment            : Off                          Src Route Opt  : Off
Sampling            : Off                          Int. Sampling  : On
IP-Option           : 0/0                          Multiple Option: Off
Tcp-flag            : (Not Specified)
Option-pres         : Off
Egress PBR          : Disabled
Primary Action      : Drop
Ing. Matches        : 0 pkts
Egr. Matches        : 0 pkts

- show router interface "TO-PE2" detail | match "Ingress Filter"

Egress Filter    : 10                   Ingress Filter    : 10

If packets being dropped are not logged and a filter is not applied, this is a finding.