DoD Compliance · STIG

Firewall Security Requirements Guide

V1R4 · · 6.8 years ago · Released 26 Jul 2019 · 41 rules

Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Digest of Updates vs. V1R3 · 25 Jan 2019 ✎ 41

Comparison against the immediately-prior release (V1R3). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Content changes 41

V-79409 High checkfix The firewall must be configured to use filters that use packet headers and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies (including perimeter firewalls and server VLANs).
V-79411 Medium checkfix The firewall must fail closed if the firewall filtering function is nonfunctional.
V-79413 High checkfix The firewall must employ filters that prevent or limit the effects of all types of commonly known denial-of-service (DoS) attacks, including flooding, packet sweeps, and unauthorized port scanning.
V-79415 High checkfix The firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
V-79417 Medium checkfix The firewall must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services on the network segment in accordance as defined in the Ports, Protocols, and Services Management (PPSM) CAL and vulnerability assessments.
V-79419 Medium checkfix The firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.
V-79421 Medium checkfix The firewall implementation must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.
V-79423 Medium checkfix The firewall that filters traffic from the VPN access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.
V-79425 Medium checkfix The firewall that filters traffic from the wireless access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.
V-79427 Medium checkfix The firewall must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.
V-79429 Medium checkfix The firewall must generate traffic log records when traffic is denied, restricted, or discarded.
V-79431 Medium checkfix The firewall must generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.
V-79433 Medium checkfix The firewall must be configured to allow authorized users to record a packet capture based IP, traffic type (TCP, UDP, or ICMP), or protocol.
V-79435 Medium checkfix The firewall must generate traffic log entries containing information to establish what type of events occurred.
V-79437 Medium checkfix The firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.
V-79439 Medium checkfix The firewall must generate traffic log entries containing information to establish the location on the network where the events occurred.
V-79441 Low checkfix The firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.
V-79443 Medium checkfix The firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
V-79445 Medium checkfix The firewall must be configured to send traffic log entries to a central audit server for management and configuration of the traffic log entries.
V-79447 Medium checkfix If communication with the central audit server is lost, the firewall must generate a real-time alert to, at a minimum, the SCA and ISSO.
V-79449 Medium checkfix The firewall must be configured to send a real-time alert to the ISSO and SA (at a minimum) in the event of an audit processing failure on the firewall itself.
V-79451 Medium checkfix In the event that communication with the central audit server is lost, the firewall must continue to queue traffic log records locally.
V-79453 Medium checkfix The firewall must protect traffic log records from unauthorized access while in transit to the central audit server.
V-79455 Medium checkfix The firewall must protect traffic log records from unauthorized read access while stored locally.
V-79457 Medium checkfix The firewall must protect the traffic log from unauthorized modification of local log records.
V-79459 Medium checkfix The firewall must protect the traffic log from unauthorized deletion of local log files and log records.
V-79461 Medium checkfix The firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
V-79463 Medium checkfix The firewall must fail to a secure state if the firewall filtering functions fail unexpectedly.
V-79465 Medium checkfix In the event of a system failure of the firewall function, the firewall must be configured to save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.
V-79467 Medium checkfix The perimeter firewall must be configured for service redundancy, load balancing, or other organization-defined safeguards to limit the effects of types of denial-of-service (DoS) attacks on the network.
V-79469 Medium checkfix The firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
V-79471 Medium checkfix The firewall must apply egress filters to traffic that is outbound from the network through any internal interface.
V-79473 Medium checkfix The firewall must establish ingress filters that block inbound packets where the destination is an IP address assigned to the management or loopback addresses of the enclave protection devices unless the packet has a source address assigned to the management network or network infrastructure.
V-79475 Medium checkfix The firewall must block or restrict inbound IP packets destined to the control plane of the firewall itself.
V-79477 Medium checkfix The premise firewall (located behind the premise router) must block all outbound management traffic.
V-79479 Medium checkfix The firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.
V-79481 Medium checkfix The firewall must block outbound IP packets that contain illegitimate packet attributes including, at a minimum, invalid source address or packets that fail minimum length tests (TCP length, UDP length, IP data length) that have undefined protocol numbers, improper use of hop-by-hop header, or IPv6 RH0 header.
V-79483 Medium checkfix The firewall must be configured to fail securely in the event of an operational failure of the firewall filtering or boundary protection function.
V-79485 Medium checkfix The perimeter firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave.
V-79487 Low checkfix The firewall must be configured to allow the system administrator to select a subset of DoD-required auditable events.
V-79489 Low checkfix The firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.

Sort by

Expand all

The firewall must be configured to use filters that use packet headers and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies (including perimeter firewalls and server VLANs).

AC-4 - High - CCI-001414 - V-79409 - SV-94115r1_rule

RMF Control

AC-4

Severity

CCI

CCI-001414

Version

SRG-NET-000019-FW-000003

Vuln IDs

V-79409

Rule IDs

SV-94115r1_rule

Information flow control regulates where information is allowed to travel within a network and between interconnected networks. Blocking or restricting detected harmful or suspicious communications between interconnected networks enforces approved authorizations for controlling the flow of traffic. The firewall that filters traffic outbound to interconnected networks with different security policies must be configured with filters (i.e., rules, access control lists [ACLs], screens, and policies) that permit, restrict, or block traffic based on organization-defined traffic authorizations. Filtering must include packet header and packet attribute information, such as IP addresses and port numbers. Configure filters to perform certain actions when packets match specified attributes, including the following actions: - Apply a policy - Accept, reject, or discard the packets - Classify the packets based on their source address - Evaluate the next term in the filter - Increment a packet counter - Set the packets’ loss priority - Specify an IPsec SA (if IPsec is used in the implementation) - Specify the forwarding path - Write an alert or message to the system log

Checks: C-79023r1_chk

Verify the firewall is configured to use filters to restrict or block information system services based on best practices, known threats, and guidance in the Ports, Protocols, Services Management (PPSM) database regarding restrictions for boundary crossing for ports, protocols, and services. If the firewall cannot be configured with filters that employ packet header and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies, this is a finding.

Fix: F-86181r1_fix

Configure filters in the firewall to examine characteristics of incoming and outgoing packets, including but not limited to the following: - Bit fields in the packet header, including IP fragmentation flags, IP options, and TCP flags - IP version 4 (IPv4) numeric range, including destination port, DiffServ code point (DSCP) value, fragment offset, Internet Control Message Protocol (ICMP) code, ICMP packet type, interface group, IP precedence, packet length, protocol, and TCP and UDP source and destination port - IP version 6 (IPv6) numeric range, including class of service (CoS) priority, destination address, destination port, ICMP code, ICMP packet type, interface group, IP address, next header, packet length, source address, source port, and TCP and UDP source and destination port - Source and destination address and prefix list

The firewall must fail closed if the firewall filtering function is nonfunctional.

SC-24 - Medium - CCI-001190 - V-79411 - SV-94117r1_rule

RMF Control

SC-24

Severity

CCI

CCI-001190

Version

SRG-NET-000235-FW-000160

Vuln IDs

V-79411

Rule IDs

SV-94117r1_rule

While failure to an open state may ensure users are not inconvenienced, it also circumvents a critical security network function that guards against direct and indirect network attacks. Allow traffic to flow without filtering or inspection puts the entire network and DoD critical assets at immediate risk. An example is a network element that blocks all traffic rather than allowing all traffic when a network element component fails (e.g., fail closed and do not forward traffic). This prevents an attacker from forcing a failure of the system in order to obtain access.

Checks: C-79025r1_chk

Review the firewall configuration to verify traffic flow defaults to closed when the firewall filtering function aborts or is nonfunctional. If the firewall is configured to allow traffic flow to attached interfaces when the firewall filtering function is non-functional, this is a finding.

Fix: F-86183r1_fix

Configure the firewall to fail closed. The firewall must block all traffic rather than allowing all traffic when a network element component fails (e.g., fail closed and do not forward traffic). The recommended architecture is to implement load balancing so that the failure of the firewall redirects traffic to another filtering device. Obtain a risk acceptance in order to fail open.

The firewall must employ filters that prevent or limit the effects of all types of commonly known denial-of-service (DoS) attacks, including flooding, packet sweeps, and unauthorized port scanning.

SC-5 - High - CCI-002385 - V-79413 - SV-94119r1_rule

RMF Control

SC-5

Severity

CCI

CCI-002385

Version

SRG-NET-000362-FW-000028

Vuln IDs

V-79413

Rule IDs

SV-94119r1_rule

Not configuring a key boundary security protection device such as the firewall against commonly known attacks is an immediate threat to the protected enclave because they are easily implemented by those with little skill. Directions for the attack are obtainable on the Internet and in hacker groups. Without filtering enabled for these attacks, the firewall will allow these attacks beyond the protected boundary. Configure the perimeter and internal boundary firewall to guard against the three general methods of well-known DoS attacks: flooding attacks, protocol sweeping attacks, and unauthorized port scanning. Flood attacks occur when the host receives too much traffic to buffer and slows down or crashes. Popular flood attacks include ICMP flood and SYN flood. A TCP flood attack of SYN packets initiating connection requests can overwhelm the device until it can no longer process legitimate connection requests, resulting in denial of service. An ICMP flood can overload the device with so many echo requests (ping requests) that it expends all its resources responding and can no longer process valid network traffic, also resulting in denial of service. An attacker might use session table floods and SYN-ACK-ACK proxy floods to fill up the session table of a host. In an IP address sweep attack, an attacker sends ICMP echo requests (pings) to multiple destination addresses. If a target host replies, the reply reveals the target’s IP address to the attacker. In a TCP sweep attack, an attacker sends TCP SYN packets to the target device as part of the TCP handshake. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack. In a UDP sweep attack, an attacker sends UDP packets to the target device. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack. In a port scanning attack, an unauthorized application is used to scan the host devices for available services and open ports for subsequent use in an attack. This type of scanning can be used as a DoS attack when the probing packets are sent excessively.

Checks: C-79027r1_chk

View the security filters for each interface or security zone. Verify DoS filters are configured to detect and prevent known DoS attacks such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps. If filters are not configured or if the security zone is not configured with filters that guard against common DoS attacks, this is a finding.

Fix: F-86185r1_fix

Configure the firewall to detect and prevent DoS attacks. Implement filters with thresholds that are customized for the specific environment where applicable. DoS filters are based on NIST 800-53 requirements and vendor recommendations. The following sample commands show filters that implement this requirement (these are examples only): set filter1 icmp ip-sweep threshold 1000 set filter2 tcp port-scan threshold 1000 set filter3 tcp syn-flood alarm-threshold 1000 set filter3 tcp syn-flood attack-threshold 1100 set filter4 tcp syn-flood source-threshold 100 set filter5 tcp syn-flood destination-threshold 2048 set filter6 tcp syn-flood timeout 20 set filter7 tcp tcp-sweep threshold 1000 set filter8 udp flood threshold 5000 set filter9 udp udp-sweep threshold 1000

The firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

SC-7 - High - CCI-001109 - V-79415 - SV-94121r2_rule

RMF Control

SC-7

Severity

CCI

CCI-001109

Version

SRG-NET-000202-FW-000039

Vuln IDs

V-79415

Rule IDs

SV-94121r2_rule

To prevent malicious or accidental leakage of traffic, organizations must implement a deny-by-default security posture at the network perimeter. Such rulesets prevent many malicious exploits or accidental leakage by restricting the traffic to only known sources and only those ports, protocols, or services that are permitted and operationally necessary. As a managed boundary interface, the firewall must block all inbound and outbound network traffic unless a filter is installed to explicitly allow it. The allow filters must comply with the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessment (VA).

Checks: C-79029r2_chk

Determine the default security policies on the firewall for traffic from one zone to another zone (inter-zone). The default policy must be a "Deny" policy that blocks all inter-zone traffic by default. Ensure no policy that circumvents the default "Deny" inter-zone policy is allowed. Traffic through the firewall is filtered so that only the specific traffic that is approved and registered in the PPSM CAL and VAs for the enclave. Verify rules or access control statements containing "any" for either the host, destination, protocol, or port are not used. If the firewall does not deny all network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception), this is a finding.

Fix: F-86187r2_fix

Configure the firewall with a "Deny" inter-zone policy which, by default, blocks traffic between zones and allows network communications traffic by exception (i.e., deny all, permit by exception) in accordance with PPSM CAL and VAs for the enclave.

The firewall must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services on the network segment in accordance as defined in the Ports, Protocols, and Services Management (PPSM) CAL and vulnerability assessments.

CM-7 - Medium - CCI-000382 - V-79417 - SV-94123r1_rule

RMF Control

CM-7

Severity

CCI

CCI-000382

Version

SRG-NET-000132-FW-000026

Vuln IDs

V-79417

Rule IDs

SV-94123r1_rule

Some ports, protocols, or services have well-known exploits or security weaknesses that can be leveraged in an attack against the enclave and put it at immediate risk. These ports, protocols, and services must be prohibited or restricted in the packet or stateful filtering firewall configuration in accordance with DoD policy. Policy filters restrict traffic destined to the enclave perimeter as defined in the PPSM CAL and vulnerability assessments.

Checks: C-79031r1_chk

Verify the firewall is configured to disable or restrict the use of functions, ports, protocols, and/or services on the network segment that are not allowed by the PPSM CAL and vulnerability assessments. Verify all applications used in the enclave are registered in the PPSM database. Review the vulnerability assessment for each port, protocol, and service allowed into the enclave and apply all appropriate mitigations defined in the Vulnerability Assessment report for that port, protocol, and service. Compare enabled functions, ports, and services with the PPSM requirements. If prohibited functions, ports, protocols, and services are enabled, this is a finding.

Fix: F-86189r1_fix

SCAs must review the vulnerability assessment for each port, protocol, and service allowed into the enclave and apply all appropriate mitigations defined in the Vulnerability Assessment report. Register only ports, protocols, and functions allowed into the enclave in the PPSM database. The enclave owner must register the applications used in the PPSM database. Consult the packet/stateful firewall knowledge base and configuration guides to determine the commands for disabling each port, protocol, service, or function that is not in compliance.

The firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.

SC-5 - Medium - CCI-001094 - V-79419 - SV-94125r1_rule

RMF Control

SC-5

Severity

CCI

CCI-001094

Version

SRG-NET-000192-FW-000029

Vuln IDs

V-79419

Rule IDs

SV-94125r1_rule

DoS attacks can take multiple forms but have the common objective of overloading or blocking a network or host to deny or seriously degrade performance. If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users. Installation of a firewall at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type. The firewall must include protection against DoS attacks that originate from inside the enclave that can affect either internal or external systems. These attacks may use legitimate or rogue endpoints from inside the enclave. These attacks can be simple "floods" of traffic to saturate circuits or devices, malware that consumes CPU and memory on a device or causes it to crash, or a configuration issue that disables or impairs the proper function of a device. For example, an accidental or deliberate misconfiguration of a routing table can misdirect traffic for multiple networks.

Checks: C-79033r1_chk

Obtain and review the list of outbound interfaces and zones from site personnel. Review each of the configured outbound interfaces and zones. Verify zones that communicate outbound have been configured with the DoS firewall filter (i.e., rules, access control lists [ACLs], screens, or policies) such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps. If all outbound interfaces are not configured to block DoS attacks, this is a finding.

Fix: F-86191r1_fix

Associate a properly configured DoS firewall filter (e.g., rules, access control lists [ACLs], screens, or policies) to outbound interfaces and security zones. Apply a firewall filter to each outbound interface example: set security zones security-zone untrust interfaces <OUTBOUND-INTERFACE> set security zones security-zone trust screen untrust-screen

The firewall implementation must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

SC-5 - Medium - CCI-001095 - V-79421 - SV-94127r1_rule

RMF Control

SC-5

Severity

CCI

CCI-001095

Version

SRG-NET-000193-FW-000030

Vuln IDs

V-79421

Rule IDs

SV-94127r1_rule

A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering resulting in route flapping and will eventually black hole production traffic. The device must be configured to contain and limit a DoS attack's effect on the device's resource utilization. The use of redundant components and load balancing are examples of mitigating "flood-type" DoS attacks through increased capacity.

Checks: C-79035r1_chk

Use the "show" command to verify that all inbound interfaces have a stateless firewall filter to set rate limits based on a destination. If the firewall does not have a stateless firewall filter that sets rate limits based on a destination, this is a finding.

Fix: F-86193r1_fix

Configure a stateless firewall filter to set rate limits based on a destination of the packets. Apply the stateless firewall filter to all inbound interfaces.

The firewall that filters traffic from the VPN access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.

AC-17 - Medium - CCI-000067 - V-79423 - SV-94129r1_rule

RMF Control

AC-17

Severity

CCI

CCI-000067

Version

SRG-NET-000061-FW-000001

Vuln IDs

V-79423

Rule IDs

SV-94129r1_rule

Remote access devices (such as those providing remote access to network devices and information systems) that lack automated capabilities increase risk and make remote user access management difficult at best. Remote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).

Checks: C-79037r1_chk

Review the firewall configuration statements used to create a group policy with filtering rules for remote clients accessing the network using a VPN. Verify both ingress and egress traffic on this interface is subject to the remote access policy and filtering rules required by the organization. If the firewall is used to filter traffic from the VPN access points but is not configured with filtering rules that apply to the monitoring of remote access traffic, this is a finding.

Fix: F-86195r1_fix

Configure a group policy for remote clients and apply to the interface that is connected to allow ingress and egress to the VPN access points.

The firewall that filters traffic from the wireless access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.

AC-17 - Medium - CCI-000067 - V-79425 - SV-94131r1_rule

RMF Control

AC-17

Severity

CCI

CCI-000067

Version

SRG-NET-000061-FW-000002

Vuln IDs

V-79425

Rule IDs

SV-94131r1_rule

Checks: C-79039r1_chk

Review the firewall configuration statements used to create a group policy with filtering rules for wireless clients accessing the network using a wireless access point. Verify both ingress and egress traffic on this interface is subject to the remote access policy and filtering rules required by the organization. If the firewall is used to filter traffic from the wireless access points but is not configured with filtering rules that apply to the monitoring of wireless access traffic, this is a finding.

Fix: F-86197r1_fix

Configure a group policy for wireless clients and apply to the interface that is connected to allow ingress and egress to the wireless access points.

The firewall must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.

AC-4 - Medium - CCI-001414 - V-79427 - SV-94133r1_rule

RMF Control

AC-4

Severity

CCI

CCI-001414

Version

SRG-NET-000019-FW-000004

Vuln IDs

V-79427

Rule IDs

SV-94133r1_rule

Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.

Checks: C-79041r1_chk

Verify the firewall immediately uses updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones. For example, there is no need to reinitialize or reboot or the action to commit the changes is prompted. If the firewall does not immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones, this is a finding.

Fix: F-86199r1_fix

Require system administrators to commit and test changes upon configuration of the firewall.

The firewall must generate traffic log records when traffic is denied, restricted, or discarded.

AU-12 - Medium - CCI-000172 - V-79429 - SV-94135r1_rule

RMF Control

AU-12

Severity

CCI

CCI-000172

Version

SRG-NET-000492-FW-000006

Vuln IDs

V-79429

Rule IDs

SV-94135r1_rule

Without generating log records that log usage of objects by subjects and other objects, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Security objects are data objects that are controlled by security policy and bound to security attributes. The firewall must not forward traffic unless it is explicitly permitted via security policy. Logging for firewall security-related sources such as screens and security policies must be configured separately. To ensure security objects such as firewall filters (i.e., rules, access control lists [ACLs], screens, and policies) send events to a syslog server and local logs, security logging must be configured one each firewall term.

Checks: C-79043r1_chk

View the configuration of the firewall or the central audit server log records. Verify the firewall generates traffic log records when traffic is denied, restricted, or discarded. If the firewall does not generate traffic log records for events when traffic is denied, restricted, or discarded, this is a finding.

Fix: F-86201r1_fix

Configure the firewall central audit server stanza to generate traffic log records for events when traffic is denied, restricted, or discarded.

The firewall must generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.

AU-12 - Medium - CCI-000172 - V-79431 - SV-94137r1_rule

RMF Control

AU-12

Severity

CCI

CCI-000172

Version

SRG-NET-000493-FW-000007

Vuln IDs

V-79431

Rule IDs

SV-94137r1_rule

Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Access for different security levels maintains separation between resources (particularly stored data) of different security domains. The firewall can be configured to use security zones that are configured with different security policies based on risk and trust levels. These zones can be leveraged to prevent traffic from one zone from sending packets to another zone. For example, information from certain IP sources will be rejected if the destination matches specified security zones that are not authorized.

Checks: C-79045r1_chk

View the configuration of the firewall or the central audit server log records. Verify the firewall generates traffic log records when attempts are made to send packets between security zones that are not authorized to communicate. If the firewall does not generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate, this is a finding.

Fix: F-86203r1_fix

Configure the firewall central audit server stanza to generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.

The firewall must be configured to allow authorized users to record a packet capture based IP, traffic type (TCP, UDP, or ICMP), or protocol.

AU-14 - Medium - CCI-001462 - V-79433 - SV-94139r1_rule

RMF Control

AU-14

Severity

CCI

CCI-001462

Version

SRG-NET-000399-FW-000008

Vuln IDs

V-79433

Rule IDs

SV-94139r1_rule

Without the ability to capture, record, and log content related to a user session, investigations into suspicious user activity would be hampered. This configuration ensures the ability to select specific sessions to capture in order to support general auditing/incident investigation or to validate suspected misuse.

Checks: C-79047r1_chk

View the documented process for packet capture. Verify the firewall allows authorized users to perform a packet capture based on IP, traffic type (TCP, UDP, or ICMP), or protocol. If the firewall is not configured to allow authorized users to capture, record, and log all content related to a user session, this is a finding.

Fix: F-86205r1_fix

Document a process for authorized users to capture, record, and log all content based on IP, traffic type (TCP, UDP, or ICMP), or protocol.

The firewall must generate traffic log entries containing information to establish what type of events occurred.

AU-3 - Medium - CCI-000130 - V-79435 - SV-94141r1_rule

RMF Control

AU-3

Severity

CCI

CCI-000130

Version

SRG-NET-000074-FW-000009

Vuln IDs

V-79435

Rule IDs

SV-94141r1_rule

Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit event content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the network element logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.

Checks: C-79049r1_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log. If the traffic log entries do not include enough information to determine what type of event occurred, this is a finding.

Fix: F-86207r1_fix

Configure the firewall to ensure entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log.

The firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.

AU-3 - Medium - CCI-000131 - V-79437 - SV-94143r1_rule

RMF Control

AU-3

Severity

CCI

CCI-000131

Version

SRG-NET-000075-FW-000010

Vuln IDs

V-79437

Rule IDs

SV-94143r1_rule

Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment, and provide forensic analysis of network traffic patterns, it is essential for security personnel to know when flow control events occurred (date and time) within the infrastructure. Associating event types with detected events in the network traffic logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.

Checks: C-79051r1_chk

Fix: F-86209r1_fix

Configure the firewall to ensure entries sent to the traffic log include the date and time of the event.

The firewall must generate traffic log entries containing information to establish the location on the network where the events occurred.

AU-3 - Medium - CCI-000132 - V-79439 - SV-94145r1_rule

RMF Control

AU-3

Severity

CCI

CCI-000132

Version

SRG-NET-000076-FW-000011

Vuln IDs

V-79439

Rule IDs

SV-94145r1_rule

Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as network element components, modules, device identifiers, node names, and functionality. Associating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.

Checks: C-79053r1_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include the location of each event (e.g., network name, network subnet, port, or network segment). If the traffic log entries do not include the event location, this is a finding.

Fix: F-86211r1_fix

Configure the firewall to ensure entries sent to the traffic log include the location of each event (e.g., network name, network subnet, network segment, or port).

The firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.

AU-3 - Low - CCI-000133 - V-79441 - SV-94147r1_rule

RMF Control

AU-3

Severity

CCI

CCI-000133

Version

SRG-NET-000077-FW-000012

Vuln IDs

V-79441

Rule IDs

SV-94147r1_rule

Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event. In addition to logging where events occur within the network, the traffic log events must also identify sources of events, such as IP addresses, processes, and node or device names.

Checks: C-79055r1_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to ascertain the source of the events (e.g., IP address, session, or packet ID). If the traffic log entries do not include sufficient information to ascertain the source of the events, this is a finding.

Fix: F-86213r1_fix

Configure the firewall implementation to ensure entries sent to the traffic log include sufficient information to ascertain the source of each event (e.g., IP address, session, or packet ID).

The firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.

AU-3 - Medium - CCI-000134 - V-79443 - SV-94149r1_rule

RMF Control

AU-3

Severity

CCI

CCI-000134

Version

SRG-NET-000078-FW-000013

Vuln IDs

V-79443

Rule IDs

SV-94149r1_rule

Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network. Event outcomes can include indicators of event success or failure and event-specific results. They also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.

Checks: C-79057r1_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to ascertain the outcome of the firewall rules. Verify that, at a minimum, the success or failure of the event is evented. If the traffic log entries do not include sufficient information to ascertain the outcome of the application of the firewall rules, this is a finding. If the traffic log entries do not include the success or failure of the application of the firewall rules, this is a finding.

Fix: F-86215r1_fix

Configure the firewall to generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.

The firewall must be configured to send traffic log entries to a central audit server for management and configuration of the traffic log entries.

AU-3 - Medium - CCI-001844 - V-79445 - SV-94151r1_rule

RMF Control

AU-3

Severity

CCI

CCI-001844

Version

SRG-NET-000333-FW-000014

Vuln IDs

V-79445

Rule IDs

SV-94151r1_rule

Without the ability to centrally manage the content captured in the traffic log entries, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. The DoD requires centralized management of all network component audit record content. Network components requiring centralized traffic log management must have the ability to support centralized management. The content captured in traffic log entries must be managed from a central location (necessitating automation). Centralized management of traffic log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Ensure at least one syslog server is configured on the firewall. If the product inherently has the ability to store log records locally, the local log must also be secured. However, this requirement is not met since it calls for a use of a central audit server.

Checks: C-79059r1_chk

Examine the traffic log configuration on the firewall. Verify the firewall is configured to send traffic log entries to the organization's central audit server. If the firewall is not configured to send traffic log entries to the organization's central audit server, this is a finding.

Fix: F-86217r1_fix

Configure the firewall to ensure traffic log entries are transmitted to the organization's central audit server (e.g., syslog server).

If communication with the central audit server is lost, the firewall must generate a real-time alert to, at a minimum, the SCA and ISSO.

AU-5 - Medium - CCI-001858 - V-79447 - SV-94153r1_rule

RMF Control

AU-5

Severity

CCI

CCI-001858

Version

SRG-NET-000335-FW-000017

Vuln IDs

V-79447

Rule IDs

SV-94153r1_rule

Without a real-time alert (less than a second), security personnel may be unaware of an impending failure of the audit functions and system operation may be adversely impacted. Alerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including via a regularly monitored console, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. Most firewalls use UDP to send audit records to the server and cannot tell if the server has received the transmission, thus the site should either implement a connection-oriented communications solution (e.g., TCP) or implement a heartbeat with the central audit server and send an alert if it is unreachable.

Checks: C-79061r1_chk

If a network device such as the events, network management, or SNMP server is configured to send an alert when communication is lost with the central audit server, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the SCA, ISSO, and other identified personnel when communication is lost with the central audit server. If the firewall is not configured to send an immediate alert via an approved method when communication is lost with the central audit server, this is a finding.

Fix: F-86219r1_fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the SCA, ISSO, and other identified personnel for any log failure event where the filtering functions are unable to write events to the central audit server.

The firewall must be configured to send a real-time alert to the ISSO and SA (at a minimum) in the event of an audit processing failure on the firewall itself.

AU-5 - Medium - CCI-000139 - V-79449 - SV-94155r1_rule

RMF Control

AU-5

Severity

CCI

CCI-000139

Version

SRG-NET-000088-FW-000018

Vuln IDs

V-79449

Rule IDs

SV-94155r1_rule

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process traffic logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Most firewalls use User Datagram Protocol (UDP) to send audit records to the server and cannot tell if the server has received the transmission. Thus, when the event daemon stops working, messages and notifications cannot be sent to the event monitor (e.g., Network Management System [NMS], Security Information and Event Management [SIEM], Syslog) or to the Simple Network Management Protocol (SNMP) server. Another method such as a keep-alive with the central audit server may be required. This requirement applies to each audit data storage repository (i.e., distinct information system component where traffic log records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both. Note that CCI-001858 requires that audit failure alerts be in real time; thus, simply sending a log event to the central audit server is not sufficient.

Checks: C-79063r1_chk

If a network device such as the events, network management, or SNMP server are configured to send an alert when an audit processing failure occurs, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP or another authorized method to the ISSO, SA, and other identified personnel when an audit processing failure occurs. If the firewall is not configured to send an alert via an approved and immediate method when an audit processing failure occurs, this is a finding.

Fix: F-86221r1_fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the ISSO, SA, and other identified personnel when an audit processing failure that prevents the device from generating, storing or sending events occurs on the device itself (e.g., a failure of the event daemon).

In the event that communication with the central audit server is lost, the firewall must continue to queue traffic log records locally.

AU-5 - Medium - CCI-000140 - V-79451 - SV-94157r1_rule

RMF Control

AU-5

Severity

CCI

CCI-000140

Version

SRG-NET-000089-FW-000019

Vuln IDs

V-79451

Rule IDs

SV-94157r1_rule

It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode. In accordance with DoD policy, the traffic log must be sent to a central audit server. When logging functions are lost, system processing cannot be shut down because firewall availability is an overriding concern given the role of the firewall in the enterprise. The system should either be configured to log events to an alternative server or queue log records locally. Upon restoration of the connection to the central audit server, action should be taken to synchronize the local log data with the central audit server. If the central audit server uses User Datagram Protocol (UDP) communications instead of a connection oriented protocol such as TCP, a method for detecting a lost connection must be implemented.

Checks: C-79065r1_chk

Verify logging has been enabled and configured for local queuing of the traffic log. If a local log file (or files) is not configured to capture events locally if communication with the central audit server is lost, this is a finding.

Fix: F-86223r1_fix

Configure local backup events files to capture DoD-defined auditable events either consistently or, if possible, in the event communication with the central audit server is lost.

The firewall must protect traffic log records from unauthorized access while in transit to the central audit server.

AU-9 - Medium - CCI-000162 - V-79453 - SV-94159r1_rule

RMF Control

AU-9

Severity

CCI

CCI-000162

Version

SRG-NET-000098-FW-000021

Vuln IDs

V-79453

Rule IDs

SV-94159r1_rule

Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or identify an improperly configured firewall. Thus, it is imperative that the collected log data be secured and access be restricted to authorized personnel. Methods of protection may include encryption or logical separation. This does not apply to traffic logs generated on behalf of the device itself (management). Some devices store traffic logs separately from the system logs.

Checks: C-79067r1_chk

Verify that all communication with the central audit server is going out the interface that is connected to the management network and is protected by an encryption solution such as the management network's VPN. If the firewall does not use either encryption or logical separation to protect transmitted traffic log records while in transit to the central audit server, this is a finding.

Fix: F-86225r1_fix

Configure the firewall to use either encryption or logical separation to protect transmitted traffic log records while in transit to the central audit server. The preferred solution is for all communication with the central audit server to egress via the management network interface and be protected by the management network's VPN.

The firewall must protect traffic log records from unauthorized read access while stored locally.

AU-9 - Medium - CCI-000162 - V-79455 - SV-94161r1_rule

RMF Control

AU-9

Severity

CCI

CCI-000162

Version

SRG-NET-000098-FW-000022

Vuln IDs

V-79455

Rule IDs

SV-94161r1_rule

Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or identify an improperly configured firewall. Thus, it is imperative that the collected log data be secured and can only be accessed by authorized personnel. This does not apply to traffic logs generated on behalf of the device itself (management). Some devices store traffic logs separately from the system logs.

Checks: C-79071r1_chk

Verify the firewall's fine-grained permissions are configured to control access to the log store where the traffic log is located. If the firewall does not protect traffic log records from unauthorized read access while stored locally, this is a finding.

Fix: F-86227r1_fix

Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems. Configure role-based, fine-grained permissions management for controlling access.

The firewall must protect the traffic log from unauthorized modification of local log records.

AU-9 - Medium - CCI-000163 - V-79457 - SV-94163r1_rule

RMF Control

AU-9

Severity

CCI

CCI-000163

Version

SRG-NET-000099-FW-000161

Vuln IDs

V-79457

Rule IDs

SV-94163r1_rule

If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This does not apply to traffic logs generated on behalf of the device itself (management).

Checks: C-79073r1_chk

Verify the firewall's fine-grained permissions are configured to prevent unauthorized modification of local log records. If the firewall does not protect traffic log records from unauthorized modification while stored locally, this is a finding.

Fix: F-86229r1_fix

The firewall must protect the traffic log from unauthorized deletion of local log files and log records.

AU-9 - Medium - CCI-000164 - V-79459 - SV-94165r1_rule

RMF Control

AU-9

Severity

CCI

CCI-000164

Version

SRG-NET-000100-FW-000023

Vuln IDs

V-79459

Rule IDs

SV-94165r1_rule

If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This requirement does not apply to traffic logs generated on behalf of the device itself (device management).

Checks: C-79075r1_chk

Verify the firewall's fine-grained permissions are configured to prevent unauthorized deletion of local log files or log records. If the firewall does not protect traffic log records and log files from unauthorized deletion while stored locally, this is a finding.

Fix: F-86231r1_fix

The firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.

CM-7 - Medium - CCI-000381 - V-79461 - SV-94167r1_rule

RMF Control

CM-7

Severity

CCI

CCI-000381

Version

SRG-NET-000131-FW-000025

Vuln IDs

V-79461

Rule IDs

SV-94167r1_rule

Network devices are capable of providing a wide variety of functions (capabilities or processes) and services. Some of these functions and services are installed and enabled by default. The organization must determine which functions and services are required to perform the content filtering and other necessary core functionality for each component of the firewall. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Some services may be security related but, based on the firewall’s role in the architecture, must not be installed on the same hardware. For example, the device may serve as a router, VPN, or other perimeter services. However, if these functions are not part of the documented role of the firewall in the enterprise or branch architecture, the software and licenses should not be installed on the device. This mitigates the risk of exploitation of unconfigured services or services that are not kept updated with security fixes. If left unsecured, these services may provide a threat vector. Some services are not authorized for combination with the firewall and individual policy must be in place to instruct the administrator to remove these services. Examples of these services are Network Time Protocol (NTP), domain name server (DNS), email server, FTP server, web server, and Dynamic Host Configuration Protocol (DHCP). Only remove unauthorized services. This control is not intended to restrict the use of firewalls with multiple authorized roles.

Checks: C-79077r1_chk

Review the documentation and architecture for the device or check the system-installed licenses or services. Determine what services and functions are installed on the firewall. Compare installed services and functions to the documentation showing the approved services. If unneeded services and functions are installed on the device but are not part of the documented role of the device, this is a finding.

Fix: F-86233r1_fix

Display and remove unnecessary licenses, services, and functions from the firewall. Examples include NTP, DNS, and DHCP. Note: Only remove unauthorized services. This control is not intended to restrict the use of network devices with multiple authorized roles.

The firewall must fail to a secure state if the firewall filtering functions fail unexpectedly.

SC-24 - Medium - CCI-001190 - V-79463 - SV-94169r1_rule

RMF Control

SC-24

Severity

CCI

CCI-001190

Version

SRG-NET-000235-FW-000133

Vuln IDs

V-79463

Rule IDs

SV-94169r1_rule

Firewalls that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection. Failure to a known safe state helps prevent systems from failing to a state that may cause unauthorized access to make changes to the firewall filtering functions. This applies to the configuration of the gateway or network traffic security function of the device. Abort refers to stopping the firewall filtering function before it has finished naturally. The term abort refers to both requested and unexpected terminations.

Checks: C-79079r1_chk

Review the firewall configuration to verify it fails to a secure state if the firewall filtering functions fail unexpectedly. If the firewall does not fail to a secure state if the firewall filtering functions fail unexpectedly, this is a finding.

Fix: F-86235r1_fix

Configure the firewall to fail to a secure state if the firewall filtering functions fail unexpectedly.

In the event of a system failure of the firewall function, the firewall must be configured to save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.

SC-24 - Medium - CCI-001665 - V-79465 - SV-94171r1_rule

RMF Control

SC-24

Severity

CCI

CCI-001665

Version

SRG-NET-000236-FW-000027

Vuln IDs

V-79465

Rule IDs

SV-94171r1_rule

Failure to a secure state can address safety or security in accordance with the mission needs of the organization. Failure to a secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving state information helps to facilitate the restart of the firewall application and a return to the operational mode with less disruption. This requirement applies to a failure of the firewall function rather than the device or operating system as a whole, which is addressed in the Network Device Management SRG. Since it is usually not possible to test this functionality in a production environment, systems should be validated either in a testing environment or prior to installation. This requirement is usually a function of the design of the firewall. Compliance can be verified by acceptance/validation processes or vendor attestation.

Checks: C-79081r1_chk

View the firewall failover configuration or system documentation. Verify that in the event of a system failure of the firewall function, the firewall saves diagnostic information, logs system messages, and loads the most current security policies, rules, and signatures. Testing of this functionality in a production environment is not recommended. If in the event of a system failure of the firewall function the firewall does not save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted, this is a finding.

Fix: F-86237r1_fix

Configure the firewall to fail securely in the event of a transiently corrupt state or failure condition. When the system restarts, the system boot process must not succeed without passing all self-tests for cryptographic algorithms, RNG tests, and software integrity tests.

The perimeter firewall must be configured for service redundancy, load balancing, or other organization-defined safeguards to limit the effects of types of denial-of-service (DoS) attacks on the network.

SC-5 - Medium - CCI-002385 - V-79467 - SV-94173r1_rule

RMF Control

SC-5

Severity

CCI

CCI-002385

Version

SRG-NET-000362-FW-000159

Vuln IDs

V-79467

Rule IDs

SV-94173r1_rule

As a critical security system, perimeter firewalls must be safeguarded with redundancy measures. If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users. Service redundancy techniques reduce the susceptibility of the firewall to many DoS attacks. A firewall experiencing a DoS attack will not be able to handle the traffic load. The high CPU utilization caused by a DoS attack will also have impact control keep-alives and timers used for neighbor peering, resulting in route flapping and eventually black hole traffic. Though redundant hardware is the primary means of compliance, there are a number of ways to meet this requirement. The firewall can also be configured for filter-based forwarding, per-flow load balancing, and/or per-packet load balancing.

Checks: C-79083r1_chk

Since Service redundancy and load balancing can be a highly complex configuration that can be implemented using a wide variety of configurations, ask the site representative to demonstrate the method used and the configuration. If the perimeter firewall is not configured for service redundancy, load balancing, or other organization-defined safeguards to limit the effects of types of DoS attacks on the network, this is a finding.

Fix: F-86239r1_fix

Consult vendor configuration guides and knowledge base. Implement one or more methods of service redundancy and/or load balancing (e.g., filter-based forwarding, per-flow load balancing, per-packet load balancing, or hardware redundancy options). The implementation must be tested prior to placing into production.

The firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.

SC-7 - Medium - CCI-002403 - V-79469 - SV-94175r1_rule

RMF Control

SC-7

Severity

CCI

CCI-002403

Version

SRG-NET-000364-FW-000031

Vuln IDs

V-79469

Rule IDs

SV-94175r1_rule

Unrestricted traffic to the trusted networks may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Firewall filters control the flow of network traffic, ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated.

Checks: C-79085r1_chk

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database. If the list of authorized sources and destinations is not available, this is a finding. Review the firewall configuration for each of the configured inbound zones and interfaces. Verify an ingress filter (e.g., Access Control List) is applied to each inbound zone/interface, including the management interface. Verify ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself). Verify that traffic accessing the firewall originates from the Network Operations Center (NOC). If an ingress filter is not configured for each active inbound zone or interface, this is a finding.

Fix: F-86241r1_fix

Configure a security policy to each inbound zone and/or interface to implement continuous filtering of outbound traffic. Apply security policy zones/interfaces through which inbound traffic flows from untrusted external networks or subnetworks. Configure the ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself) and so that traffic accessing the firewall originates from the NOC.

The firewall must apply egress filters to traffic that is outbound from the network through any internal interface.

SC-7 - Medium - CCI-002403 - V-79471 - SV-94177r2_rule

RMF Control

SC-7

Severity

CCI

CCI-002403

Version

SRG-NET-000364-FW-000032

Vuln IDs

V-79471

Rule IDs

SV-94177r2_rule

If outbound communications traffic is not filtered, hostile activity intended to harm other networks or packets from networks destined to unauthorized networks may not be detected and prevented. Access control policies and access control lists implemented on devices, such as firewalls, that control the flow of network traffic ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated. This requirement addresses the binding of the egress filter to the interface/zone rather than the content of the egress filter.

Checks: C-79087r2_chk

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database. If the list of authorized sources and destinations is not available, this is a finding. Review the firewall configuration for each of the configured outbound zones and interfaces. Verify a security policy is applied to each outbound zone/interface, including the management interface. If an egress filter is not configured for each active outbound zone or interface, this is a finding.

Fix: F-86243r1_fix

Configure a security policy to each outbound zone and/or interface to implement continuous filtering of outbound traffic. Apply security policy zones/interfaces (including the management interface) through which outbound traffic flows to untrusted external networks or subnetworks.

The firewall must establish ingress filters that block inbound packets where the destination is an IP address assigned to the management or loopback addresses of the enclave protection devices unless the packet has a source address assigned to the management network or network infrastructure.

SC-7 - Medium - CCI-002403 - V-79473 - SV-94179r2_rule

RMF Control

SC-7

Severity

CCI

CCI-002403

Version

SRG-NET-000364-FW-000033

Vuln IDs

V-79473

Rule IDs

SV-94179r2_rule

The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address. The network loopback address or management IP addresses should never be used as the source IP address of an inbound or outbound transmission since it is most likely a spoofing attempt ll traffic with a destination of a management address or to a loopback address for a network protection device should be blocked unless the source is from an authorized management range. The rule or filter should be applied to traffic ingressing on the external interfaces and ingressing onto internal interfaces. It is a best practice for the management network to use the network loopback addresses.

Checks: C-79089r2_chk

Review the firewall ingress rules/filters for each inbound interface on the perimeter or internal firewall. Verify rules or filters are in place that: - Permits the authorized management network to access the management network or loopback interface addresses on enclave perimeter network devices - Denies any other network from accessing the management network or loopback interface addresses on enclave perimeter network devices If filters do not exist that deny inbound packets where the destination is an IP address assigned to the management or network loopback addresses of the enclave protection devices and permits the packet if it has a source address assigned to the management network or network infrastructure, this is a finding.

Fix: F-86245r2_fix

Establish ingress filters on both perimeter and internal firewalls to deny inbound packets where the destination is an IP address assigned to the management or network loopback addresses of the enclave protection devices and permits the packet if it has a source address assigned to the management network or network infrastructure. Apply this rule inbound on firewall interfaces.

The firewall must block or restrict inbound IP packets destined to the control plane of the firewall itself.

SC-7 - Medium - CCI-002403 - V-79475 - SV-94181r1_rule

RMF Control

SC-7

Severity

CCI

CCI-002403

Version

SRG-NET-000364-FW-000034

Vuln IDs

V-79475

Rule IDs

SV-94181r1_rule

As a critical security system, perimeter firewalls must be safeguarded against direct attacks to the device. The firewall must have a filter that rejects requests for access or services where the source address received by the firewall specifies an external address and the destination address specifies the control plane of the firewall.

Checks: C-79091r1_chk

Review the device configuration to determine if filters are in place to block loopback addresses. Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure). If inbound IP packets destined to the control plane of the firewall itself are not blocked or restricted by an ingress firewall filter, this is a finding.

Fix: F-86247r1_fix

Establish ingress filters to block or restrict inbound IP packets destined to the control plane of the firewall itself.

The premise firewall (located behind the premise router) must block all outbound management traffic.

SC-7 - Medium - CCI-002403 - V-79477 - SV-94183r1_rule

RMF Control

SC-7

Severity

CCI

CCI-002403

Version

SRG-NET-000364-FW-000035

Vuln IDs

V-79477

Rule IDs

SV-94183r1_rule

The management network must still have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the managed network's premise equipment. If a firewall is located behind the premise router, all management traffic must be blocked at that point, with the exception of management traffic destined to premise equipment.

Checks: C-79093r1_chk

Review the firewall configuration to verify that it is blocking all outbound management traffic. If the firewall is not blocking management network from leaking to outside networks, this is a finding.

Fix: F-86249r1_fix

With the exception of management traffic destined to perimeter equipment, configure a firewall located behind the premise router to block all outbound management traffic.

The firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.

SC-7 - Medium - CCI-002403 - V-79479 - SV-94185r1_rule

RMF Control

SC-7

Severity

CCI

CCI-002403

Version

SRG-NET-000364-FW-000036

Vuln IDs

V-79479

Rule IDs

SV-94185r1_rule

Protect the management network with a filtering firewall configured to block unauthorized traffic. This requirement is similar to the out-of-band management (OOBM) model, when the production network is managed in-band. The management network could also be housed at a Network Operations Center (NOC) that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity, as well as connectivity between the NOC and the managed networks’ premise routers, would be enabled using either provisioned circuits or VPN technologies such as IPsec tunnels or MPLS VPN services.

Checks: C-79097r1_chk

Inspect the architecture diagrams. Inspect the NOC and the managed network. Note that the IPsec tunnel endpoints may be configured on the premise or gateway router, the VPN gateway firewall, or a VPN concentrator. Verify that all traffic between the managed network and management network and vice-versa is secured via IPsec encapsulation. If the firewall does not restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address, this is a finding.

Fix: F-86253r1_fix

Where IPsec technology is deployed to connect the managed network to the NOC, restrict the traffic entering the tunnels so that only the authorized management packets with authorized destination addresses are permitted.

The firewall must block outbound IP packets that contain illegitimate packet attributes including, at a minimum, invalid source address or packets that fail minimum length tests (TCP length, UDP length, IP data length) that have undefined protocol numbers, improper use of hop-by-hop header, or IPv6 RH0 header.

SC-7 - Medium - CCI-002403 - V-79481 - SV-94187r1_rule

RMF Control

SC-7

Severity

CCI

CCI-002403

Version

SRG-NET-000364-FW-000037

Vuln IDs

V-79481

Rule IDs

SV-94187r1_rule

If outbound communications traffic is not filtered, hostile activity intended to harm other networks may not be detected and prevented.

Checks: C-79099r2_chk

Review the configuration and verify the firewall blocks outbound IP packets that contain an illegitimate attributes. At a minimum, rules must exist to filter based on invalid source address or packets that fail minimum length tests (TCP length, UDP length, IP data length) that have undefined protocol numbers, improper use of hop-by-hop header, or IPv6 RH0 header. If the firewall does not block outbound IP packets that that contain illegitimate packet attributes, this is a finding.

Fix: F-86255r1_fix

Configure the firewall to block outbound IP packets that that contain illegitimate packet attributes.

The firewall must be configured to fail securely in the event of an operational failure of the firewall filtering or boundary protection function.

SC-7 - Medium - CCI-001126 - V-79483 - SV-94189r1_rule

RMF Control

SC-7

Severity

CCI

CCI-001126

Version

SRG-NET-000365-FW-000038

Vuln IDs

V-79483

Rule IDs

SV-94189r1_rule

If a boundary protection device fails in an unsecure manner (open), information external to the boundary protection device may enter, or the device may permit unauthorized information release. Secure failure ensures that when a boundary control device fails, all traffic will be subsequently denied. Fail secure is a condition achieved by employing information system mechanisms to ensure that in the event of operational failures of boundary protection devices at managed interfaces (e.g., routers, firewalls, guards, and application gateways residing on protected subnetworks commonly referred to as demilitarized zones), information systems do not enter into unsecure states where intended security properties no longer hold.

Checks: C-79103r1_chk

Review the configuration and verify the firewall fails securely in the event of an operational failure. This involves such items as ensuring the Access Control Lists (filters) and security policy are not corrupted and cannot be accessed. Most importantly, it should not be possible to fail to a state where firewall filtering functions no longer hold. If the firewall does not fail securely in the event of an operational failure, this is a finding.

Fix: F-86257r1_fix

Configure the firewall to fail securely in the event of an operational failure of the firewall filtering or boundary protection function. This is not the same as a hardware failure, which is covered by the NDM STIG. This involves such items as ensuring the filters and security policy are not corrupted and cannot be accessed. Most importantly, it should not be possible to fail to a state where firewall filtering functions no longer hold.

The perimeter firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave.

SC-7 - Medium - CCI-001097 - V-79485 - SV-94191r1_rule

RMF Control

SC-7

Severity

CCI

CCI-001097

Version

SRG-NET-000205-FW-000040

Vuln IDs

V-79485

Rule IDs

SV-94191r1_rule

The enclave's internal network contains the servers where mission-critical data and applications reside. Malicious traffic can enter from an external boundary or originate from a compromised host internally. Vulnerability assessments must be reviewed by the SA and protocols must be approved by the IA staff before entering the enclave. Firewall filters (e.g., rules, access control lists [ACLs], screens, and policies) are the first line of defense in a layered security approach. They permit authorized packets and deny unauthorized packets based on port or service type. They enhance the posture of the network by not allowing packets to even reach a potential target within the security domain. The filters provided are highly susceptible ports and services that should be blocked or limited as much as possible without adversely affecting customer requirements. Auditing packets attempting to penetrate the network but stopped by the firewall filters will allow network administrators to broaden their protective ring and more tightly define the scope of operation. If the perimeter is in a Deny-by-Default posture and what is allowed through the filter is in accordance with the PPSM CAL and VAs for the enclave, and if the permit rule is explicitly defined with explicit ports and protocols allowed, then all requirements related to the database being blocked would be satisfied.

Checks: C-79109r1_chk

Review the perimeter firewall to verify it filters traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave. If the perimeter firewall does not filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave, this is a finding.

Fix: F-86259r1_fix

Configure the perimeter firewall to filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave.

The firewall must be configured to allow the system administrator to select a subset of DoD-required auditable events.

AU-12 - Low - CCI-000169 - V-79487 - SV-94193r1_rule

RMF Control

AU-12

Severity

CCI

CCI-000169

Version

SRG-NET-000113-FW-000005

Vuln IDs

V-79487

Rule IDs

SV-94193r1_rule

The generation of logs with a subset of criteria aide the system administrator, maintainers, and auditors when troubleshooting issues or reviewing the log for trends or security breaches. Traffic log records can be generated from various components within the information system (e.g., network interface, access control list, or filter). The DoD list of auditable events include the logging and audit requirements required by this document and any additional local requirements.

Checks: C-79111r1_chk

Obtain a list of required auditable events from the site representative or the System Security Plan (SSP). View the firewall configuration. Verify the firewall allows the system administrator to select a subset of DoD-required auditable events. If the firewall is not configured to allow the system administrator to select a subset of DoD-required events, this is a finding.

Fix: F-86261r1_fix

Configure the firewall audit management functions to allow the authorized system administrator to select from a list of auditable events, to include the firewall's network interfaces, rules, and policies.

The firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.

SI-4 - Low - CCI-002664 - V-79489 - SV-94195r1_rule

RMF Control

SI-4

Severity

CCI

CCI-002664

Version

SRG-NET-000392-FW-000042

Vuln IDs

V-79489

Rule IDs

SV-94195r1_rule

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The firewall generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs), which require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The firewall must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Checks: C-79117r1_chk

If a network device such as the events, network management, or SNMP server is configured to send an alert when DoS incidents are detected, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the ISSO, ISSM, and other identified personnel when DoS incidents are detected. If the firewall is not configured to send an alert via an approved and immediate method when DoS incidents are detected, this is a finding.

Fix: F-86263r1_fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the ISSO and ISSM and other identified personnel when DoS incidents are detected.

Content changes 41

Checks: C-79023r1_chk

Fix: F-86181r1_fix

Generate Mitigation Statement:

Checks: C-79025r1_chk

Fix: F-86183r1_fix

Generate Mitigation Statement:

Checks: C-79027r1_chk

Fix: F-86185r1_fix

Generate Mitigation Statement:

Checks: C-79029r2_chk

Fix: F-86187r2_fix

Generate Mitigation Statement:

Checks: C-79031r1_chk

Fix: F-86189r1_fix

Generate Mitigation Statement:

Checks: C-79033r1_chk

Fix: F-86191r1_fix

Generate Mitigation Statement:

Checks: C-79035r1_chk

Fix: F-86193r1_fix

Generate Mitigation Statement:

Checks: C-79037r1_chk

Fix: F-86195r1_fix

Generate Mitigation Statement:

Checks: C-79039r1_chk

Fix: F-86197r1_fix

Generate Mitigation Statement:

Checks: C-79041r1_chk

Fix: F-86199r1_fix

Generate Mitigation Statement:

Checks: C-79043r1_chk

Fix: F-86201r1_fix

Generate Mitigation Statement:

Checks: C-79045r1_chk

Fix: F-86203r1_fix

Generate Mitigation Statement:

Checks: C-79047r1_chk

Fix: F-86205r1_fix

Generate Mitigation Statement:

Checks: C-79049r1_chk

Fix: F-86207r1_fix

Generate Mitigation Statement:

Checks: C-79051r1_chk

Fix: F-86209r1_fix

Generate Mitigation Statement:

Checks: C-79053r1_chk

Fix: F-86211r1_fix

Generate Mitigation Statement:

Checks: C-79055r1_chk

Fix: F-86213r1_fix

Generate Mitigation Statement:

Checks: C-79057r1_chk

Fix: F-86215r1_fix

Generate Mitigation Statement:

Checks: C-79059r1_chk

Fix: F-86217r1_fix

Generate Mitigation Statement:

Checks: C-79061r1_chk

Fix: F-86219r1_fix

Generate Mitigation Statement:

Checks: C-79063r1_chk

Fix: F-86221r1_fix

Generate Mitigation Statement:

Checks: C-79065r1_chk

Fix: F-86223r1_fix

Generate Mitigation Statement:

Checks: C-79067r1_chk

Fix: F-86225r1_fix

Generate Mitigation Statement:

Checks: C-79071r1_chk

Fix: F-86227r1_fix

Generate Mitigation Statement:

Checks: C-79073r1_chk

Fix: F-86229r1_fix

Generate Mitigation Statement:

Checks: C-79075r1_chk

Fix: F-86231r1_fix

Generate Mitigation Statement:

Checks: C-79077r1_chk