Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Firewall Security Requirements Guide

V1R5 · · · Released 24 Jul 2020 · 33 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Digest of Updates vs. V1R4 · 26 Jul 2019 +3 −11 ✎ 2

Comparison against the immediately-prior release (V1R4). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Added rules 3

  • V-101103 Medium The firewall must be configured to inspect all inbound and outbound traffic at the application layer.
  • V-101105 Medium The firewall must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.
  • V-101107 Medium The firewall must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

Removed rules 11

  • V-79411 Medium The firewall must fail closed if the firewall filtering function is nonfunctional.
  • V-79417 Medium The firewall must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services on the network segment in accordance as defined in the Ports, Protocols, and Services Management (PPSM) CAL and vulnerability assessments.
  • V-79425 Medium The firewall that filters traffic from the wireless access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.
  • V-79449 Medium The firewall must be configured to send a real-time alert to the ISSO and SA (at a minimum) in the event of an audit processing failure on the firewall itself.
  • V-79455 Medium The firewall must protect traffic log records from unauthorized read access while stored locally.
  • V-79467 Medium The perimeter firewall must be configured for service redundancy, load balancing, or other organization-defined safeguards to limit the effects of types of denial-of-service (DoS) attacks on the network.
  • V-79473 Medium The firewall must establish ingress filters that block inbound packets where the destination is an IP address assigned to the management or loopback addresses of the enclave protection devices unless the packet has a source address assigned to the management network or network infrastructure.
  • V-79475 Medium The firewall must block or restrict inbound IP packets destined to the control plane of the firewall itself.
  • V-79481 Medium The firewall must block outbound IP packets that contain illegitimate packet attributes including, at a minimum, invalid source address or packets that fail minimum length tests (TCP length, UDP length, IP data length) that have undefined protocol numbers, improper use of hop-by-hop header, or IPv6 RH0 header.
  • V-79483 Medium The firewall must be configured to fail securely in the event of an operational failure of the firewall filtering or boundary protection function.
  • V-79487 Low The firewall must be configured to allow the system administrator to select a subset of DoD-required auditable events.

Content changes 2

  • V-79453 Medium descriptioncheckfix The firewall must be configured to use TCP when sending log records to the central audit server.
  • V-79463 Medium descriptioncheckfix The firewall must fail to a secure state upon the failure of the following: system initialization, shutdown, or system abort.
Sort by
c
The firewall must be configured to use filters that use packet headers and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies (including perimeter firewalls and server VLANs).
AC-4 - High - CCI-001414 - V-79409 - SV-94115r1_rule
RMF Control
AC-4
Severity
H
CCI
CCI-001414
Version
SRG-NET-000019-FW-000003
Vuln IDs
  • V-79409
Rule IDs
  • SV-94115r1_rule
Information flow control regulates where information is allowed to travel within a network and between interconnected networks. Blocking or restricting detected harmful or suspicious communications between interconnected networks enforces approved authorizations for controlling the flow of traffic. The firewall that filters traffic outbound to interconnected networks with different security policies must be configured with filters (i.e., rules, access control lists [ACLs], screens, and policies) that permit, restrict, or block traffic based on organization-defined traffic authorizations. Filtering must include packet header and packet attribute information, such as IP addresses and port numbers. Configure filters to perform certain actions when packets match specified attributes, including the following actions: - Apply a policy - Accept, reject, or discard the packets - Classify the packets based on their source address - Evaluate the next term in the filter - Increment a packet counter - Set the packets’ loss priority - Specify an IPsec SA (if IPsec is used in the implementation) - Specify the forwarding path - Write an alert or message to the system log
Checks: C-79023r1_chk

Verify the firewall is configured to use filters to restrict or block information system services based on best practices, known threats, and guidance in the Ports, Protocols, Services Management (PPSM) database regarding restrictions for boundary crossing for ports, protocols, and services. If the firewall cannot be configured with filters that employ packet header and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies, this is a finding.

Fix: F-86181r1_fix

Configure filters in the firewall to examine characteristics of incoming and outgoing packets, including but not limited to the following: - Bit fields in the packet header, including IP fragmentation flags, IP options, and TCP flags - IP version 4 (IPv4) numeric range, including destination port, DiffServ code point (DSCP) value, fragment offset, Internet Control Message Protocol (ICMP) code, ICMP packet type, interface group, IP precedence, packet length, protocol, and TCP and UDP source and destination port - IP version 6 (IPv6) numeric range, including class of service (CoS) priority, destination address, destination port, ICMP code, ICMP packet type, interface group, IP address, next header, packet length, source address, source port, and TCP and UDP source and destination port - Source and destination address and prefix list

c
The firewall must employ filters that prevent or limit the effects of all types of commonly known denial-of-service (DoS) attacks, including flooding, packet sweeps, and unauthorized port scanning.
SC-5 - High - CCI-002385 - V-79413 - SV-94119r1_rule
RMF Control
SC-5
Severity
H
CCI
CCI-002385
Version
SRG-NET-000362-FW-000028
Vuln IDs
  • V-79413
Rule IDs
  • SV-94119r1_rule
Not configuring a key boundary security protection device such as the firewall against commonly known attacks is an immediate threat to the protected enclave because they are easily implemented by those with little skill. Directions for the attack are obtainable on the Internet and in hacker groups. Without filtering enabled for these attacks, the firewall will allow these attacks beyond the protected boundary. Configure the perimeter and internal boundary firewall to guard against the three general methods of well-known DoS attacks: flooding attacks, protocol sweeping attacks, and unauthorized port scanning. Flood attacks occur when the host receives too much traffic to buffer and slows down or crashes. Popular flood attacks include ICMP flood and SYN flood. A TCP flood attack of SYN packets initiating connection requests can overwhelm the device until it can no longer process legitimate connection requests, resulting in denial of service. An ICMP flood can overload the device with so many echo requests (ping requests) that it expends all its resources responding and can no longer process valid network traffic, also resulting in denial of service. An attacker might use session table floods and SYN-ACK-ACK proxy floods to fill up the session table of a host. In an IP address sweep attack, an attacker sends ICMP echo requests (pings) to multiple destination addresses. If a target host replies, the reply reveals the target’s IP address to the attacker. In a TCP sweep attack, an attacker sends TCP SYN packets to the target device as part of the TCP handshake. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack. In a UDP sweep attack, an attacker sends UDP packets to the target device. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack. In a port scanning attack, an unauthorized application is used to scan the host devices for available services and open ports for subsequent use in an attack. This type of scanning can be used as a DoS attack when the probing packets are sent excessively.
Checks: C-79027r1_chk

View the security filters for each interface or security zone. Verify DoS filters are configured to detect and prevent known DoS attacks such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps. If filters are not configured or if the security zone is not configured with filters that guard against common DoS attacks, this is a finding.

Fix: F-86185r1_fix

Configure the firewall to detect and prevent DoS attacks. Implement filters with thresholds that are customized for the specific environment where applicable. DoS filters are based on NIST 800-53 requirements and vendor recommendations. The following sample commands show filters that implement this requirement (these are examples only): set filter1 icmp ip-sweep threshold 1000 set filter2 tcp port-scan threshold 1000 set filter3 tcp syn-flood alarm-threshold 1000 set filter3 tcp syn-flood attack-threshold 1100 set filter4 tcp syn-flood source-threshold 100 set filter5 tcp syn-flood destination-threshold 2048 set filter6 tcp syn-flood timeout 20 set filter7 tcp tcp-sweep threshold 1000 set filter8 udp flood threshold 5000 set filter9 udp udp-sweep threshold 1000

c
The firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
SC-7 - High - CCI-001109 - V-79415 - SV-94121r2_rule
RMF Control
SC-7
Severity
H
CCI
CCI-001109
Version
SRG-NET-000202-FW-000039
Vuln IDs
  • V-79415
Rule IDs
  • SV-94121r2_rule
To prevent malicious or accidental leakage of traffic, organizations must implement a deny-by-default security posture at the network perimeter. Such rulesets prevent many malicious exploits or accidental leakage by restricting the traffic to only known sources and only those ports, protocols, or services that are permitted and operationally necessary. As a managed boundary interface, the firewall must block all inbound and outbound network traffic unless a filter is installed to explicitly allow it. The allow filters must comply with the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessment (VA).
Checks: C-79029r2_chk

Determine the default security policies on the firewall for traffic from one zone to another zone (inter-zone). The default policy must be a "Deny" policy that blocks all inter-zone traffic by default. Ensure no policy that circumvents the default "Deny" inter-zone policy is allowed. Traffic through the firewall is filtered so that only the specific traffic that is approved and registered in the PPSM CAL and VAs for the enclave. Verify rules or access control statements containing "any" for either the host, destination, protocol, or port are not used. If the firewall does not deny all network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception), this is a finding.

Fix: F-86187r2_fix

Configure the firewall with a "Deny" inter-zone policy which, by default, blocks traffic between zones and allows network communications traffic by exception (i.e., deny all, permit by exception) in accordance with PPSM CAL and VAs for the enclave.

b
The firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.
SC-5 - Medium - CCI-001094 - V-79419 - SV-94125r1_rule
RMF Control
SC-5
Severity
M
CCI
CCI-001094
Version
SRG-NET-000192-FW-000029
Vuln IDs
  • V-79419
Rule IDs
  • SV-94125r1_rule
DoS attacks can take multiple forms but have the common objective of overloading or blocking a network or host to deny or seriously degrade performance. If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users. Installation of a firewall at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type. The firewall must include protection against DoS attacks that originate from inside the enclave that can affect either internal or external systems. These attacks may use legitimate or rogue endpoints from inside the enclave. These attacks can be simple "floods" of traffic to saturate circuits or devices, malware that consumes CPU and memory on a device or causes it to crash, or a configuration issue that disables or impairs the proper function of a device. For example, an accidental or deliberate misconfiguration of a routing table can misdirect traffic for multiple networks.
Checks: C-79033r1_chk

Obtain and review the list of outbound interfaces and zones from site personnel. Review each of the configured outbound interfaces and zones. Verify zones that communicate outbound have been configured with the DoS firewall filter (i.e., rules, access control lists [ACLs], screens, or policies) such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps. If all outbound interfaces are not configured to block DoS attacks, this is a finding.

Fix: F-86191r1_fix

Associate a properly configured DoS firewall filter (e.g., rules, access control lists [ACLs], screens, or policies) to outbound interfaces and security zones. Apply a firewall filter to each outbound interface example: set security zones security-zone untrust interfaces <OUTBOUND-INTERFACE> set security zones security-zone trust screen untrust-screen

b
The firewall implementation must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.
SC-5 - Medium - CCI-001095 - V-79421 - SV-94127r1_rule
RMF Control
SC-5
Severity
M
CCI
CCI-001095
Version
SRG-NET-000193-FW-000030
Vuln IDs
  • V-79421
Rule IDs
  • SV-94127r1_rule
A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering resulting in route flapping and will eventually black hole production traffic. The device must be configured to contain and limit a DoS attack's effect on the device's resource utilization. The use of redundant components and load balancing are examples of mitigating "flood-type" DoS attacks through increased capacity.
Checks: C-79035r1_chk

Use the "show" command to verify that all inbound interfaces have a stateless firewall filter to set rate limits based on a destination. If the firewall does not have a stateless firewall filter that sets rate limits based on a destination, this is a finding.

Fix: F-86193r1_fix

Configure a stateless firewall filter to set rate limits based on a destination of the packets. Apply the stateless firewall filter to all inbound interfaces.

b
The firewall that filters traffic from the VPN access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.
AC-17 - Medium - CCI-000067 - V-79423 - SV-94129r1_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
SRG-NET-000061-FW-000001
Vuln IDs
  • V-79423
Rule IDs
  • SV-94129r1_rule
Remote access devices (such as those providing remote access to network devices and information systems) that lack automated capabilities increase risk and make remote user access management difficult at best. Remote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).
Checks: C-79037r1_chk

Review the firewall configuration statements used to create a group policy with filtering rules for remote clients accessing the network using a VPN. Verify both ingress and egress traffic on this interface is subject to the remote access policy and filtering rules required by the organization. If the firewall is used to filter traffic from the VPN access points but is not configured with filtering rules that apply to the monitoring of remote access traffic, this is a finding.

Fix: F-86195r1_fix

Configure a group policy for remote clients and apply to the interface that is connected to allow ingress and egress to the VPN access points.

b
The firewall must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.
AC-4 - Medium - CCI-001414 - V-79427 - SV-94133r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-FW-000004
Vuln IDs
  • V-79427
Rule IDs
  • SV-94133r1_rule
Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.
Checks: C-79041r1_chk

Verify the firewall immediately uses updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones. For example, there is no need to reinitialize or reboot or the action to commit the changes is prompted. If the firewall does not immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones, this is a finding.

Fix: F-86199r1_fix

Require system administrators to commit and test changes upon configuration of the firewall.

b
The firewall must generate traffic log records when traffic is denied, restricted, or discarded.
AU-12 - Medium - CCI-000172 - V-79429 - SV-94135r1_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
SRG-NET-000492-FW-000006
Vuln IDs
  • V-79429
Rule IDs
  • SV-94135r1_rule
Without generating log records that log usage of objects by subjects and other objects, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Security objects are data objects that are controlled by security policy and bound to security attributes. The firewall must not forward traffic unless it is explicitly permitted via security policy. Logging for firewall security-related sources such as screens and security policies must be configured separately. To ensure security objects such as firewall filters (i.e., rules, access control lists [ACLs], screens, and policies) send events to a syslog server and local logs, security logging must be configured one each firewall term.
Checks: C-79043r1_chk

View the configuration of the firewall or the central audit server log records. Verify the firewall generates traffic log records when traffic is denied, restricted, or discarded. If the firewall does not generate traffic log records for events when traffic is denied, restricted, or discarded, this is a finding.

Fix: F-86201r1_fix

Configure the firewall central audit server stanza to generate traffic log records for events when traffic is denied, restricted, or discarded.

b
The firewall must generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.
AU-12 - Medium - CCI-000172 - V-79431 - SV-94137r1_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
SRG-NET-000493-FW-000007
Vuln IDs
  • V-79431
Rule IDs
  • SV-94137r1_rule
Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Access for different security levels maintains separation between resources (particularly stored data) of different security domains. The firewall can be configured to use security zones that are configured with different security policies based on risk and trust levels. These zones can be leveraged to prevent traffic from one zone from sending packets to another zone. For example, information from certain IP sources will be rejected if the destination matches specified security zones that are not authorized.
Checks: C-79045r1_chk

View the configuration of the firewall or the central audit server log records. Verify the firewall generates traffic log records when attempts are made to send packets between security zones that are not authorized to communicate. If the firewall does not generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate, this is a finding.

Fix: F-86203r1_fix

Configure the firewall central audit server stanza to generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.

b
The firewall must be configured to allow authorized users to record a packet capture based IP, traffic type (TCP, UDP, or ICMP), or protocol.
AU-14 - Medium - CCI-001462 - V-79433 - SV-94139r1_rule
RMF Control
AU-14
Severity
M
CCI
CCI-001462
Version
SRG-NET-000399-FW-000008
Vuln IDs
  • V-79433
Rule IDs
  • SV-94139r1_rule
Without the ability to capture, record, and log content related to a user session, investigations into suspicious user activity would be hampered. This configuration ensures the ability to select specific sessions to capture in order to support general auditing/incident investigation or to validate suspected misuse.
Checks: C-79047r1_chk

View the documented process for packet capture. Verify the firewall allows authorized users to perform a packet capture based on IP, traffic type (TCP, UDP, or ICMP), or protocol. If the firewall is not configured to allow authorized users to capture, record, and log all content related to a user session, this is a finding.

Fix: F-86205r1_fix

Document a process for authorized users to capture, record, and log all content based on IP, traffic type (TCP, UDP, or ICMP), or protocol.

b
The firewall must generate traffic log entries containing information to establish what type of events occurred.
AU-3 - Medium - CCI-000130 - V-79435 - SV-94141r1_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
SRG-NET-000074-FW-000009
Vuln IDs
  • V-79435
Rule IDs
  • SV-94141r1_rule
Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit event content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the network element logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.
Checks: C-79049r1_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log. If the traffic log entries do not include enough information to determine what type of event occurred, this is a finding.

Fix: F-86207r1_fix

Configure the firewall to ensure entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log.

b
The firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.
AU-3 - Medium - CCI-000131 - V-79437 - SV-94143r1_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000131
Version
SRG-NET-000075-FW-000010
Vuln IDs
  • V-79437
Rule IDs
  • SV-94143r1_rule
Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment, and provide forensic analysis of network traffic patterns, it is essential for security personnel to know when flow control events occurred (date and time) within the infrastructure. Associating event types with detected events in the network traffic logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.
Checks: C-79051r1_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include the date and time of each event. If the traffic log entries do not include the date and time the event occurred, this is a finding.

Fix: F-86209r1_fix

Configure the firewall to ensure entries sent to the traffic log include the date and time of the event.

b
The firewall must generate traffic log entries containing information to establish the location on the network where the events occurred.
AU-3 - Medium - CCI-000132 - V-79439 - SV-94145r1_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000132
Version
SRG-NET-000076-FW-000011
Vuln IDs
  • V-79439
Rule IDs
  • SV-94145r1_rule
Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as network element components, modules, device identifiers, node names, and functionality. Associating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.
Checks: C-79053r1_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include the location of each event (e.g., network name, network subnet, port, or network segment). If the traffic log entries do not include the event location, this is a finding.

Fix: F-86211r1_fix

Configure the firewall to ensure entries sent to the traffic log include the location of each event (e.g., network name, network subnet, network segment, or port).

a
The firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.
AU-3 - Low - CCI-000133 - V-79441 - SV-94147r1_rule
RMF Control
AU-3
Severity
L
CCI
CCI-000133
Version
SRG-NET-000077-FW-000012
Vuln IDs
  • V-79441
Rule IDs
  • SV-94147r1_rule
Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event. In addition to logging where events occur within the network, the traffic log events must also identify sources of events, such as IP addresses, processes, and node or device names.
Checks: C-79055r1_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to ascertain the source of the events (e.g., IP address, session, or packet ID). If the traffic log entries do not include sufficient information to ascertain the source of the events, this is a finding.

Fix: F-86213r1_fix

Configure the firewall implementation to ensure entries sent to the traffic log include sufficient information to ascertain the source of each event (e.g., IP address, session, or packet ID).

b
The firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
AU-3 - Medium - CCI-000134 - V-79443 - SV-94149r1_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000134
Version
SRG-NET-000078-FW-000013
Vuln IDs
  • V-79443
Rule IDs
  • SV-94149r1_rule
Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network. Event outcomes can include indicators of event success or failure and event-specific results. They also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.
Checks: C-79057r1_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to ascertain the outcome of the firewall rules. Verify that, at a minimum, the success or failure of the event is evented. If the traffic log entries do not include sufficient information to ascertain the outcome of the application of the firewall rules, this is a finding. If the traffic log entries do not include the success or failure of the application of the firewall rules, this is a finding.

Fix: F-86215r1_fix

Configure the firewall to generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.

b
The firewall must be configured to send traffic log entries to a central audit server for management and configuration of the traffic log entries.
AU-3 - Medium - CCI-001844 - V-79445 - SV-94151r1_rule
RMF Control
AU-3
Severity
M
CCI
CCI-001844
Version
SRG-NET-000333-FW-000014
Vuln IDs
  • V-79445
Rule IDs
  • SV-94151r1_rule
Without the ability to centrally manage the content captured in the traffic log entries, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. The DoD requires centralized management of all network component audit record content. Network components requiring centralized traffic log management must have the ability to support centralized management. The content captured in traffic log entries must be managed from a central location (necessitating automation). Centralized management of traffic log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Ensure at least one syslog server is configured on the firewall. If the product inherently has the ability to store log records locally, the local log must also be secured. However, this requirement is not met since it calls for a use of a central audit server.
Checks: C-79059r1_chk

Examine the traffic log configuration on the firewall. Verify the firewall is configured to send traffic log entries to the organization's central audit server. If the firewall is not configured to send traffic log entries to the organization's central audit server, this is a finding.

Fix: F-86217r1_fix

Configure the firewall to ensure traffic log entries are transmitted to the organization's central audit server (e.g., syslog server).

b
If communication with the central audit server is lost, the firewall must generate a real-time alert to, at a minimum, the SCA and ISSO.
AU-5 - Medium - CCI-001858 - V-79447 - SV-94153r1_rule
RMF Control
AU-5
Severity
M
CCI
CCI-001858
Version
SRG-NET-000335-FW-000017
Vuln IDs
  • V-79447
Rule IDs
  • SV-94153r1_rule
Without a real-time alert (less than a second), security personnel may be unaware of an impending failure of the audit functions and system operation may be adversely impacted. Alerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including via a regularly monitored console, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. Most firewalls use UDP to send audit records to the server and cannot tell if the server has received the transmission, thus the site should either implement a connection-oriented communications solution (e.g., TCP) or implement a heartbeat with the central audit server and send an alert if it is unreachable.
Checks: C-79061r1_chk

If a network device such as the events, network management, or SNMP server is configured to send an alert when communication is lost with the central audit server, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the SCA, ISSO, and other identified personnel when communication is lost with the central audit server. If the firewall is not configured to send an immediate alert via an approved method when communication is lost with the central audit server, this is a finding.

Fix: F-86219r1_fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the SCA, ISSO, and other identified personnel for any log failure event where the filtering functions are unable to write events to the central audit server.

b
In the event that communication with the central audit server is lost, the firewall must continue to queue traffic log records locally.
AU-5 - Medium - CCI-000140 - V-79451 - SV-94157r1_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000140
Version
SRG-NET-000089-FW-000019
Vuln IDs
  • V-79451
Rule IDs
  • SV-94157r1_rule
It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode. In accordance with DoD policy, the traffic log must be sent to a central audit server. When logging functions are lost, system processing cannot be shut down because firewall availability is an overriding concern given the role of the firewall in the enterprise. The system should either be configured to log events to an alternative server or queue log records locally. Upon restoration of the connection to the central audit server, action should be taken to synchronize the local log data with the central audit server. If the central audit server uses User Datagram Protocol (UDP) communications instead of a connection oriented protocol such as TCP, a method for detecting a lost connection must be implemented.
Checks: C-79065r1_chk

Verify logging has been enabled and configured for local queuing of the traffic log. If a local log file (or files) is not configured to capture events locally if communication with the central audit server is lost, this is a finding.

Fix: F-86223r1_fix

Configure local backup events files to capture DoD-defined auditable events either consistently or, if possible, in the event communication with the central audit server is lost.

b
The firewall must be configured to use TCP when sending log records to the central audit server.
AU-9 - Medium - CCI-000162 - V-79453 - SV-94159r2_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
SRG-NET-000098-FW-000021
Vuln IDs
  • V-79453
Rule IDs
  • SV-94159r2_rule
If the default UDP protocol is used for communication between the hosts and devices to the Central Log Server, then log records that do not reach the log server are not detected as a data loss. The use of TCP to transport log records to the log servers improves delivery reliability.
Checks: C-79067r2_chk

Review the firewall configuration and verify that it is configure to use TCP. If the firewall is not configured to use TCP when sending log records to the central audit server, this is a finding.

Fix: F-86225r2_fix

Configure the firewall to use TCP when sending log records to the central audit server.

b
The firewall must protect the traffic log from unauthorized modification of local log records.
AU-9 - Medium - CCI-000163 - V-79457 - SV-94163r1_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000163
Version
SRG-NET-000099-FW-000161
Vuln IDs
  • V-79457
Rule IDs
  • SV-94163r1_rule
If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This does not apply to traffic logs generated on behalf of the device itself (management).
Checks: C-79073r1_chk

Verify the firewall's fine-grained permissions are configured to prevent unauthorized modification of local log records. If the firewall does not protect traffic log records from unauthorized modification while stored locally, this is a finding.

Fix: F-86229r1_fix

Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems. Configure role-based, fine-grained permissions management for controlling commands needed to modify log records.

b
The firewall must protect the traffic log from unauthorized deletion of local log files and log records.
AU-9 - Medium - CCI-000164 - V-79459 - SV-94165r1_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000164
Version
SRG-NET-000100-FW-000023
Vuln IDs
  • V-79459
Rule IDs
  • SV-94165r1_rule
If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This requirement does not apply to traffic logs generated on behalf of the device itself (device management).
Checks: C-79075r1_chk

Verify the firewall's fine-grained permissions are configured to prevent unauthorized deletion of local log files or log records. If the firewall does not protect traffic log records and log files from unauthorized deletion while stored locally, this is a finding.

Fix: F-86231r1_fix

Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems. Configure role-based, fine-grained permissions management for controlling commands needed to delete log files and records.

b
The firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
CM-7 - Medium - CCI-000381 - V-79461 - SV-94167r1_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
SRG-NET-000131-FW-000025
Vuln IDs
  • V-79461
Rule IDs
  • SV-94167r1_rule
Network devices are capable of providing a wide variety of functions (capabilities or processes) and services. Some of these functions and services are installed and enabled by default. The organization must determine which functions and services are required to perform the content filtering and other necessary core functionality for each component of the firewall. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Some services may be security related but, based on the firewall’s role in the architecture, must not be installed on the same hardware. For example, the device may serve as a router, VPN, or other perimeter services. However, if these functions are not part of the documented role of the firewall in the enterprise or branch architecture, the software and licenses should not be installed on the device. This mitigates the risk of exploitation of unconfigured services or services that are not kept updated with security fixes. If left unsecured, these services may provide a threat vector. Some services are not authorized for combination with the firewall and individual policy must be in place to instruct the administrator to remove these services. Examples of these services are Network Time Protocol (NTP), domain name server (DNS), email server, FTP server, web server, and Dynamic Host Configuration Protocol (DHCP). Only remove unauthorized services. This control is not intended to restrict the use of firewalls with multiple authorized roles.
Checks: C-79077r1_chk

Review the documentation and architecture for the device or check the system-installed licenses or services. Determine what services and functions are installed on the firewall. Compare installed services and functions to the documentation showing the approved services. If unneeded services and functions are installed on the device but are not part of the documented role of the device, this is a finding.

Fix: F-86233r1_fix

Display and remove unnecessary licenses, services, and functions from the firewall. Examples include NTP, DNS, and DHCP. Note: Only remove unauthorized services. This control is not intended to restrict the use of network devices with multiple authorized roles.

b
The firewall must fail to a secure state upon the failure of the following: system initialization, shutdown, or system abort.
SC-24 - Medium - CCI-001190 - V-79463 - SV-94169r2_rule
RMF Control
SC-24
Severity
M
CCI
CCI-001190
Version
SRG-NET-000235-FW-000133
Vuln IDs
  • V-79463
Rule IDs
  • SV-94169r2_rule
Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. Network elements that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving the information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes.
Checks: C-79079r2_chk

Verify the firewall stops forwarding traffic or maintains the configured security policies upon the failure of the following: system initialization, shutdown, or system abort. If the firewall does not stop forwarding traffic or maintain the configured security policies upon the failure of system initialization, shutdown, or system abort, this is a finding.

Fix: F-86235r2_fix

Configure the firewall to stop forwarding traffic or maintain the configured security policies upon the failure of the following actions: system initialization, shutdown, or system abort.

b
In the event of a system failure of the firewall function, the firewall must be configured to save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.
SC-24 - Medium - CCI-001665 - V-79465 - SV-94171r1_rule
RMF Control
SC-24
Severity
M
CCI
CCI-001665
Version
SRG-NET-000236-FW-000027
Vuln IDs
  • V-79465
Rule IDs
  • SV-94171r1_rule
Failure to a secure state can address safety or security in accordance with the mission needs of the organization. Failure to a secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving state information helps to facilitate the restart of the firewall application and a return to the operational mode with less disruption. This requirement applies to a failure of the firewall function rather than the device or operating system as a whole, which is addressed in the Network Device Management SRG. Since it is usually not possible to test this functionality in a production environment, systems should be validated either in a testing environment or prior to installation. This requirement is usually a function of the design of the firewall. Compliance can be verified by acceptance/validation processes or vendor attestation.
Checks: C-79081r1_chk

View the firewall failover configuration or system documentation. Verify that in the event of a system failure of the firewall function, the firewall saves diagnostic information, logs system messages, and loads the most current security policies, rules, and signatures. Testing of this functionality in a production environment is not recommended. If in the event of a system failure of the firewall function the firewall does not save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted, this is a finding.

Fix: F-86237r1_fix

Configure the firewall to fail securely in the event of a transiently corrupt state or failure condition. When the system restarts, the system boot process must not succeed without passing all self-tests for cryptographic algorithms, RNG tests, and software integrity tests.

b
The firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
SC-7 - Medium - CCI-002403 - V-79469 - SV-94175r1_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000364-FW-000031
Vuln IDs
  • V-79469
Rule IDs
  • SV-94175r1_rule
Unrestricted traffic to the trusted networks may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Firewall filters control the flow of network traffic, ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated.
Checks: C-79085r1_chk

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database. If the list of authorized sources and destinations is not available, this is a finding. Review the firewall configuration for each of the configured inbound zones and interfaces. Verify an ingress filter (e.g., Access Control List) is applied to each inbound zone/interface, including the management interface. Verify ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself). Verify that traffic accessing the firewall originates from the Network Operations Center (NOC). If an ingress filter is not configured for each active inbound zone or interface, this is a finding.

Fix: F-86241r1_fix

Configure a security policy to each inbound zone and/or interface to implement continuous filtering of outbound traffic. Apply security policy zones/interfaces through which inbound traffic flows from untrusted external networks or subnetworks. Configure the ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself) and so that traffic accessing the firewall originates from the NOC.

b
The firewall must apply egress filters to traffic that is outbound from the network through any internal interface.
SC-7 - Medium - CCI-002403 - V-79471 - SV-94177r2_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000364-FW-000032
Vuln IDs
  • V-79471
Rule IDs
  • SV-94177r2_rule
If outbound communications traffic is not filtered, hostile activity intended to harm other networks or packets from networks destined to unauthorized networks may not be detected and prevented. Access control policies and access control lists implemented on devices, such as firewalls, that control the flow of network traffic ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated. This requirement addresses the binding of the egress filter to the interface/zone rather than the content of the egress filter.
Checks: C-79087r2_chk

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database. If the list of authorized sources and destinations is not available, this is a finding. Review the firewall configuration for each of the configured outbound zones and interfaces. Verify a security policy is applied to each outbound zone/interface, including the management interface. If an egress filter is not configured for each active outbound zone or interface, this is a finding.

Fix: F-86243r1_fix

Configure a security policy to each outbound zone and/or interface to implement continuous filtering of outbound traffic. Apply security policy zones/interfaces (including the management interface) through which outbound traffic flows to untrusted external networks or subnetworks.

b
The premise firewall (located behind the premise router) must block all outbound management traffic.
SC-7 - Medium - CCI-002403 - V-79477 - SV-94183r1_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000364-FW-000035
Vuln IDs
  • V-79477
Rule IDs
  • SV-94183r1_rule
The management network must still have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the managed network's premise equipment. If a firewall is located behind the premise router, all management traffic must be blocked at that point, with the exception of management traffic destined to premise equipment.
Checks: C-79093r1_chk

Review the firewall configuration to verify that it is blocking all outbound management traffic. If the firewall is not blocking management network from leaking to outside networks, this is a finding.

Fix: F-86249r1_fix

With the exception of management traffic destined to perimeter equipment, configure a firewall located behind the premise router to block all outbound management traffic.

b
The firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.
SC-7 - Medium - CCI-002403 - V-79479 - SV-94185r1_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000364-FW-000036
Vuln IDs
  • V-79479
Rule IDs
  • SV-94185r1_rule
Protect the management network with a filtering firewall configured to block unauthorized traffic. This requirement is similar to the out-of-band management (OOBM) model, when the production network is managed in-band. The management network could also be housed at a Network Operations Center (NOC) that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity, as well as connectivity between the NOC and the managed networks’ premise routers, would be enabled using either provisioned circuits or VPN technologies such as IPsec tunnels or MPLS VPN services.
Checks: C-79097r1_chk

Inspect the architecture diagrams. Inspect the NOC and the managed network. Note that the IPsec tunnel endpoints may be configured on the premise or gateway router, the VPN gateway firewall, or a VPN concentrator. Verify that all traffic between the managed network and management network and vice-versa is secured via IPsec encapsulation. If the firewall does not restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address, this is a finding.

Fix: F-86253r1_fix

Where IPsec technology is deployed to connect the managed network to the NOC, restrict the traffic entering the tunnels so that only the authorized management packets with authorized destination addresses are permitted.

b
The perimeter firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave.
SC-7 - Medium - CCI-001097 - V-79485 - SV-94191r1_rule
RMF Control
SC-7
Severity
M
CCI
CCI-001097
Version
SRG-NET-000205-FW-000040
Vuln IDs
  • V-79485
Rule IDs
  • SV-94191r1_rule
The enclave's internal network contains the servers where mission-critical data and applications reside. Malicious traffic can enter from an external boundary or originate from a compromised host internally. Vulnerability assessments must be reviewed by the SA and protocols must be approved by the IA staff before entering the enclave. Firewall filters (e.g., rules, access control lists [ACLs], screens, and policies) are the first line of defense in a layered security approach. They permit authorized packets and deny unauthorized packets based on port or service type. They enhance the posture of the network by not allowing packets to even reach a potential target within the security domain. The filters provided are highly susceptible ports and services that should be blocked or limited as much as possible without adversely affecting customer requirements. Auditing packets attempting to penetrate the network but stopped by the firewall filters will allow network administrators to broaden their protective ring and more tightly define the scope of operation. If the perimeter is in a Deny-by-Default posture and what is allowed through the filter is in accordance with the PPSM CAL and VAs for the enclave, and if the permit rule is explicitly defined with explicit ports and protocols allowed, then all requirements related to the database being blocked would be satisfied.
Checks: C-79109r1_chk

Review the perimeter firewall to verify it filters traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave. If the perimeter firewall does not filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave, this is a finding.

Fix: F-86259r1_fix

Configure the perimeter firewall to filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave.

a
The firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.
SI-4 - Low - CCI-002664 - V-79489 - SV-94195r1_rule
RMF Control
SI-4
Severity
L
CCI
CCI-002664
Version
SRG-NET-000392-FW-000042
Vuln IDs
  • V-79489
Rule IDs
  • SV-94195r1_rule
Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The firewall generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs), which require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The firewall must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.
Checks: C-79117r1_chk

If a network device such as the events, network management, or SNMP server is configured to send an alert when DoS incidents are detected, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the ISSO, ISSM, and other identified personnel when DoS incidents are detected. If the firewall is not configured to send an alert via an approved and immediate method when DoS incidents are detected, this is a finding.

Fix: F-86263r1_fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the ISSO and ISSM and other identified personnel when DoS incidents are detected.

b
The firewall must be configured to inspect all inbound and outbound traffic at the application layer.
CM-6 - Medium - CCI-000366 - V-101103 - SV-110207r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000364-FW-000040
Vuln IDs
  • V-101103
Rule IDs
  • SV-110207r1_rule
Application inspection enables the firewall to control traffic based on different parameters that exist within the packets such as enforcing application-specific message and field length. Inspection provides improved protection against application-based attacks by restricting the types of commands allowed for the applications. Application inspection all enforces conformance against published RFCs. Some applications embed an IP address in the packet that needs to match the source address that is normally translated when it goes through the firewall. Enabling application inspection for a service that embeds IP addresses, the firewall translates embedded addresses and updates any checksum or other fields that are affected by the translation. Enabling application inspection for a service that uses dynamically assigned ports, the firewall monitors sessions to identify the dynamic port assignments, and permits data exchange on these ports for the duration of the specific session.
Checks: C-99981r1_chk

Review the firewall configuration to verify that inspection for applications deployed within the network is being performed on all interfaces. If the firewall is not configured to inspect all inbound and outbound traffic at the application layer, this is a finding.

Fix: F-106805r1_fix

Configure the firewall to inspect all inbound and outbound traffic at the application layer.

b
The firewall must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.
CM-6 - Medium - CCI-000366 - V-101105 - SV-110209r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000364-FW-000041
Vuln IDs
  • V-101105
Rule IDs
  • SV-110209r1_rule
IPv6 packets with unknown extension headers as well as out-of-order headers can create Denial-of-Service attacks for other networking components as well as host devices. IPv6 inspection can check conformance to RFC 2460 enforcing the order extension headers. While routers only need to examine the IPv6 destination address and the Hop-by-Hop Options header, firewalls must recognize and parse through all existing extension headers since the upper-layer protocol information resides in the last header. An attacker is able to chain many extension headers in order to pass firewall and intrusion detections. An attacker can cause a denial of service if an intermediary device or destination host is not capable of processing an extensive or out-of-order chain of extension headers. Hence, it is imperative the firewall is configured to drop packets with unknown or out-of-order headers.
Checks: C-99983r1_chk

Review the firewall configuration to verify that IPv6 inspection is being performed on all interfaces. If the firewall is not configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers, this is a finding.

Fix: F-106807r1_fix

Configure the firewall to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.

b
The firewall must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).
CM-6 - Medium - CCI-000366 - V-101107 - SV-110211r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000364-FW-000042
Vuln IDs
  • V-101107
Rule IDs
  • SV-110211r1_rule
A compromised host in an enclave can be used by a malicious platform to launch cyberattacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack other computers or networks. Denial-of-Service attacks frequently leverage IP source address spoofing to send packets to multiple hosts that, in turn, will then send return traffic to the hosts with the IP addresses that were forged. This can generate significant amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken. When uRPF is enabled in strict mode, the packet must be received on the interface that the device would use to forward the return packet, thereby mitigating IP source address spoofing.
Checks: C-99985r1_chk

Review the firewall configuration to verify uRPF or an egress filter has been configured on all internal interfaces to restrict the firewall from accepting outbound packets that contain an illegitimate address in the source address field. If uRPF or an egress ACL to restrict the firewall from accepting outbound IP packets that contain an illegitimate address in the source address field has not been configured on all internal interfaces, this is a finding.

Fix: F-106809r1_fix

Configure the firewall with an egress filter or uRPF on all internal interfaces to restrict the firewall from accepting any outbound packet that contains an illegitimate address in the source field.