Details

Disables the DHCP service

Rationale:

The Firepower can act as a DHCP or DHCP Relay server. However, on untrusted interface, attacker can get the opportunity of the availability of the service to perform DoS attacks such as DHCP starvation that will exhaust not only the IP addresses’ space but also the memory and CPU resources of the security appliance and bring it down.

Solution

DHCP Server can be configured through the Firepower Management Center:

Step 1 – Choose Devices > Device Management, and edit the FTD device.
Step 2 – Select DHCP > DHCP Server.

Supportive Information

The following resource is also helpful.

• https://www.cisco.com/c/en/us/td/docs/security/firepower/640/hardening/ftd/FTD_Hardening_Guide_v64.html

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Cisco_Firepower.

References

• 800-53|CM-7b.

Source

• Tenable.com/audits