Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Firewall Security Requirements Guide

V2R1 · · · Released 22 Jan 2021 · 33 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Digest of Updates vs. V1R5 · 24 Jul 2020 +33 −33

Comparison against the immediately-prior release (V1R5). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Added rules 33

  • V-206674 High The firewall must be configured to use filters that use packet headers and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies (including perimeter firewalls and server VLANs).
  • V-206675 Medium The firewall must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.
  • V-206676 Medium The firewall that filters traffic from the VPN access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.
  • V-206678 Medium The firewall must generate traffic log entries containing information to establish what type of events occurred.
  • V-206679 Medium The firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.
  • V-206680 Medium The firewall must generate traffic log entries containing information to establish the location on the network where the events occurred.
  • V-206681 Low The firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.
  • V-206682 Medium The firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
  • V-206684 Medium In the event that communication with the central audit server is lost, the firewall must continue to queue traffic log records locally.
  • V-206685 Medium The firewall must be configured to use TCP when sending log records to the central audit server.
  • V-206687 Medium The firewall must protect the traffic log from unauthorized modification of local log records.
  • V-206688 Medium The firewall must protect the traffic log from unauthorized deletion of local log files and log records.
  • V-206690 Medium The firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
  • V-206692 Medium The firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.
  • V-206693 Medium The firewall implementation must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.
  • V-206694 High The firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
  • V-206695 Medium The perimeter firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave.
  • V-206696 Medium The firewall must fail to a secure state upon the failure of the following: system initialization, shutdown, or system abort.
  • V-206698 Medium In the event of a system failure of the firewall function, the firewall must be configured to save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.
  • V-206699 Medium The firewall must be configured to send traffic log entries to a central audit server for management and configuration of the traffic log entries.
  • V-206700 Medium If communication with the central audit server is lost, the firewall must generate a real-time alert to, at a minimum, the SCA and ISSO.
  • V-206701 High The firewall must employ filters that prevent or limit the effects of all types of commonly known denial-of-service (DoS) attacks, including flooding, packet sweeps, and unauthorized port scanning.
  • V-206703 Medium The firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
  • V-206704 Medium The firewall must apply egress filters to traffic that is outbound from the network through any internal interface.
  • V-206707 Medium The premise firewall (located behind the premise router) must block all outbound management traffic.
  • V-206708 Medium The firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.
  • V-206711 Low The firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.
  • V-206712 Medium The firewall must be configured to allow authorized users to record a packet capture based IP, traffic type (TCP, UDP, or ICMP), or protocol.
  • V-206713 Medium The firewall must generate traffic log records when traffic is denied, restricted, or discarded.
  • V-206714 Medium The firewall must generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.
  • V-223011 Medium The firewall must be configured to inspect all inbound and outbound traffic at the application layer.
  • V-223012 Medium The firewall must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.
  • V-223013 Medium The firewall must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

Removed rules 33

  • V-101103 Medium The firewall must be configured to inspect all inbound and outbound traffic at the application layer.
  • V-101105 Medium The firewall must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.
  • V-101107 Medium The firewall must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).
  • V-79409 High The firewall must be configured to use filters that use packet headers and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies (including perimeter firewalls and server VLANs).
  • V-79413 High The firewall must employ filters that prevent or limit the effects of all types of commonly known denial-of-service (DoS) attacks, including flooding, packet sweeps, and unauthorized port scanning.
  • V-79415 High The firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
  • V-79419 Medium The firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.
  • V-79421 Medium The firewall implementation must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.
  • V-79423 Medium The firewall that filters traffic from the VPN access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.
  • V-79427 Medium The firewall must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.
  • V-79429 Medium The firewall must generate traffic log records when traffic is denied, restricted, or discarded.
  • V-79431 Medium The firewall must generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.
  • V-79433 Medium The firewall must be configured to allow authorized users to record a packet capture based IP, traffic type (TCP, UDP, or ICMP), or protocol.
  • V-79435 Medium The firewall must generate traffic log entries containing information to establish what type of events occurred.
  • V-79437 Medium The firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.
  • V-79439 Medium The firewall must generate traffic log entries containing information to establish the location on the network where the events occurred.
  • V-79441 Low The firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.
  • V-79443 Medium The firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
  • V-79445 Medium The firewall must be configured to send traffic log entries to a central audit server for management and configuration of the traffic log entries.
  • V-79447 Medium If communication with the central audit server is lost, the firewall must generate a real-time alert to, at a minimum, the SCA and ISSO.
  • V-79451 Medium In the event that communication with the central audit server is lost, the firewall must continue to queue traffic log records locally.
  • V-79453 Medium The firewall must be configured to use TCP when sending log records to the central audit server.
  • V-79457 Medium The firewall must protect the traffic log from unauthorized modification of local log records.
  • V-79459 Medium The firewall must protect the traffic log from unauthorized deletion of local log files and log records.
  • V-79461 Medium The firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
  • V-79463 Medium The firewall must fail to a secure state upon the failure of the following: system initialization, shutdown, or system abort.
  • V-79465 Medium In the event of a system failure of the firewall function, the firewall must be configured to save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.
  • V-79469 Medium The firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
  • V-79471 Medium The firewall must apply egress filters to traffic that is outbound from the network through any internal interface.
  • V-79477 Medium The premise firewall (located behind the premise router) must block all outbound management traffic.
  • V-79479 Medium The firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.
  • V-79485 Medium The perimeter firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave.
  • V-79489 Low The firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.
Sort by
c
The firewall must be configured to use filters that use packet headers and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies (including perimeter firewalls and server VLANs).
AC-4 - High - CCI-001414 - V-206674 - SV-206674r604133_rule
RMF Control
AC-4
Severity
H
CCI
CCI-001414
Version
SRG-NET-000019-FW-000003
Vuln IDs
  • V-206674
  • V-79409
Rule IDs
  • SV-206674r604133_rule
  • SV-94115
Information flow control regulates where information is allowed to travel within a network and between interconnected networks. Blocking or restricting detected harmful or suspicious communications between interconnected networks enforces approved authorizations for controlling the flow of traffic. The firewall that filters traffic outbound to interconnected networks with different security policies must be configured with filters (i.e., rules, access control lists [ACLs], screens, and policies) that permit, restrict, or block traffic based on organization-defined traffic authorizations. Filtering must include packet header and packet attribute information, such as IP addresses and port numbers. Configure filters to perform certain actions when packets match specified attributes, including the following actions: - Apply a policy - Accept, reject, or discard the packets - Classify the packets based on their source address - Evaluate the next term in the filter - Increment a packet counter - Set the packets’ loss priority - Specify an IPsec SA (if IPsec is used in the implementation) - Specify the forwarding path - Write an alert or message to the system log
Checks: C-6931r297801_chk

Verify the firewall is configured to use filters to restrict or block information system services based on best practices, known threats, and guidance in the Ports, Protocols, Services Management (PPSM) database regarding restrictions for boundary crossing for ports, protocols, and services. If the firewall cannot be configured with filters that employ packet header and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies, this is a finding.

Fix: F-6931r297802_fix

Configure filters in the firewall to examine characteristics of incoming and outgoing packets, including but not limited to the following: - Bit fields in the packet header, including IP fragmentation flags, IP options, and TCP flags - IP version 4 (IPv4) numeric range, including destination port, DiffServ code point (DSCP) value, fragment offset, Internet Control Message Protocol (ICMP) code, ICMP packet type, interface group, IP precedence, packet length, protocol, and TCP and UDP source and destination port - IP version 6 (IPv6) numeric range, including class of service (CoS) priority, destination address, destination port, ICMP code, ICMP packet type, interface group, IP address, next header, packet length, source address, source port, and TCP and UDP source and destination port - Source and destination address and prefix list

b
The firewall must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.
AC-4 - Medium - CCI-001414 - V-206675 - SV-206675r604133_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-FW-000004
Vuln IDs
  • V-206675
  • V-79427
Rule IDs
  • SV-206675r604133_rule
  • SV-94133
Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes to the Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list, vulnerability assessments, or mission conditions. Changing conditions include changes in the threat environment and detection of potentially harmful or adverse events.
Checks: C-6932r297804_chk

Verify the firewall immediately uses updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones. For example, there is no need to reinitialize or reboot or the action to commit the changes is prompted. If the firewall does not immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones, this is a finding.

Fix: F-6932r297805_fix

Require system administrators to commit and test changes upon configuration of the firewall.

b
The firewall that filters traffic from the VPN access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.
AC-17 - Medium - CCI-000067 - V-206676 - SV-206676r604133_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
SRG-NET-000061-FW-000001
Vuln IDs
  • V-206676
  • V-79423
Rule IDs
  • SV-206676r604133_rule
  • SV-94129
Remote access devices (such as those providing remote access to network devices and information systems) that lack automated capabilities increase risk and make remote user access management difficult at best. Remote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).
Checks: C-6933r297807_chk

Review the firewall configuration statements used to create a group policy with filtering rules for remote clients accessing the network using a VPN. Verify both ingress and egress traffic on this interface is subject to the remote access policy and filtering rules required by the organization. If the firewall is used to filter traffic from the VPN access points but is not configured with filtering rules that apply to the monitoring of remote access traffic, this is a finding.

Fix: F-6933r297808_fix

Configure a group policy for remote clients and apply to the interface that is connected to allow ingress and egress to the VPN access points.

b
The firewall must generate traffic log entries containing information to establish what type of events occurred.
AU-3 - Medium - CCI-000130 - V-206678 - SV-206678r604133_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
SRG-NET-000074-FW-000009
Vuln IDs
  • V-206678
  • V-79435
Rule IDs
  • SV-206678r604133_rule
  • SV-94141
Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit event content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the network element logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.
Checks: C-6935r297813_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log. If the traffic log entries do not include enough information to determine what type of event occurred, this is a finding.

Fix: F-6935r297814_fix

Configure the firewall to ensure entries sent to the traffic log include sufficient information to determine the type or category for each event in the traffic log.

b
The firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.
AU-3 - Medium - CCI-000131 - V-206679 - SV-206679r604133_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000131
Version
SRG-NET-000075-FW-000010
Vuln IDs
  • V-206679
  • V-79437
Rule IDs
  • SV-206679r604133_rule
  • SV-94143
Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment, and provide forensic analysis of network traffic patterns, it is essential for security personnel to know when flow control events occurred (date and time) within the infrastructure. Associating event types with detected events in the network traffic logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.
Checks: C-6936r297816_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include the date and time of each event. If the traffic log entries do not include the date and time the event occurred, this is a finding.

Fix: F-6936r297817_fix

Configure the firewall to ensure entries sent to the traffic log include the date and time of the event.

b
The firewall must generate traffic log entries containing information to establish the location on the network where the events occurred.
AU-3 - Medium - CCI-000132 - V-206680 - SV-206680r604133_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000132
Version
SRG-NET-000076-FW-000011
Vuln IDs
  • V-206680
  • V-79439
Rule IDs
  • SV-206680r604133_rule
  • SV-94145
Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as network element components, modules, device identifiers, node names, and functionality. Associating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured network element.
Checks: C-6937r297819_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include the location of each event (e.g., network name, network subnet, port, or network segment). If the traffic log entries do not include the event location, this is a finding.

Fix: F-6937r297820_fix

Configure the firewall to ensure entries sent to the traffic log include the location of each event (e.g., network name, network subnet, network segment, or port).

a
The firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.
AU-3 - Low - CCI-000133 - V-206681 - SV-206681r604133_rule
RMF Control
AU-3
Severity
L
CCI
CCI-000133
Version
SRG-NET-000077-FW-000012
Vuln IDs
  • V-206681
  • V-79441
Rule IDs
  • SV-206681r604133_rule
  • SV-94147
Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event. In addition to logging where events occur within the network, the traffic log events must also identify sources of events, such as IP addresses, processes, and node or device names.
Checks: C-6938r297822_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to ascertain the source of the events (e.g., IP address, session, or packet ID). If the traffic log entries do not include sufficient information to ascertain the source of the events, this is a finding.

Fix: F-6938r297823_fix

Configure the firewall implementation to ensure entries sent to the traffic log include sufficient information to ascertain the source of each event (e.g., IP address, session, or packet ID).

b
The firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
AU-3 - Medium - CCI-000134 - V-206682 - SV-206682r604133_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000134
Version
SRG-NET-000078-FW-000013
Vuln IDs
  • V-206682
  • V-79443
Rule IDs
  • SV-206682r604133_rule
  • SV-94149
Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network. Event outcomes can include indicators of event success or failure and event-specific results. They also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.
Checks: C-6939r297825_chk

Examine the traffic log configuration on the firewall or view several alert events on the organization's central audit server. Verify the entries sent to the traffic log include sufficient information to ascertain the outcome of the firewall rules. Verify that, at a minimum, the success or failure of the event is evented. If the traffic log entries do not include sufficient information to ascertain the outcome of the application of the firewall rules, this is a finding. If the traffic log entries do not include the success or failure of the application of the firewall rules, this is a finding.

Fix: F-6939r297826_fix

Configure the firewall to generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.

b
In the event that communication with the central audit server is lost, the firewall must continue to queue traffic log records locally.
AU-5 - Medium - CCI-000140 - V-206684 - SV-206684r604133_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000140
Version
SRG-NET-000089-FW-000019
Vuln IDs
  • V-206684
  • V-79451
Rule IDs
  • SV-206684r604133_rule
  • SV-94157
It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode. In accordance with DoD policy, the traffic log must be sent to a central audit server. When logging functions are lost, system processing cannot be shut down because firewall availability is an overriding concern given the role of the firewall in the enterprise. The system should either be configured to log events to an alternative server or queue log records locally. Upon restoration of the connection to the central audit server, action should be taken to synchronize the local log data with the central audit server. If the central audit server uses User Datagram Protocol (UDP) communications instead of a connection oriented protocol such as TCP, a method for detecting a lost connection must be implemented.
Checks: C-6941r297831_chk

Verify logging has been enabled and configured for local queuing of the traffic log. If a local log file (or files) is not configured to capture events locally if communication with the central audit server is lost, this is a finding.

Fix: F-6941r297832_fix

Configure local backup events files to capture DoD-defined auditable events either consistently or, if possible, in the event communication with the central audit server is lost.

b
The firewall must be configured to use TCP when sending log records to the central audit server.
CM-6 - Medium - CCI-000366 - V-206685 - SV-206685r604133_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000098-FW-000021
Vuln IDs
  • V-206685
  • V-79453
Rule IDs
  • SV-206685r604133_rule
  • SV-94159
If the default UDP protocol is used for communication between the hosts and devices to the Central Log Server, then log records that do not reach the log server are not detected as a data loss. The use of TCP to transport log records to the log servers improves delivery reliability.
Checks: C-6942r457833_chk

Review the firewall configuration and verify that it is configure to use TCP. If the firewall is not configured to use TCP when sending log records to the central audit server, this is a finding.

Fix: F-6942r457834_fix

Configure the firewall to use TCP when sending log records to the central audit server.

b
The firewall must protect the traffic log from unauthorized modification of local log records.
AU-9 - Medium - CCI-000163 - V-206687 - SV-206687r604133_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000163
Version
SRG-NET-000099-FW-000161
Vuln IDs
  • V-206687
  • V-79457
Rule IDs
  • SV-206687r604133_rule
  • SV-94163
If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This does not apply to traffic logs generated on behalf of the device itself (management).
Checks: C-6944r297840_chk

Verify the firewall's fine-grained permissions are configured to prevent unauthorized modification of local log records. If the firewall does not protect traffic log records from unauthorized modification while stored locally, this is a finding.

Fix: F-6944r297841_fix

Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems. Configure role-based, fine-grained permissions management for controlling commands needed to modify log records.

b
The firewall must protect the traffic log from unauthorized deletion of local log files and log records.
AU-9 - Medium - CCI-000164 - V-206688 - SV-206688r604133_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000164
Version
SRG-NET-000100-FW-000023
Vuln IDs
  • V-206688
  • V-79459
Rule IDs
  • SV-206688r604133_rule
  • SV-94165
If audit data were to become compromised, forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. This can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This requirement does not apply to traffic logs generated on behalf of the device itself (device management).
Checks: C-6945r297843_chk

Verify the firewall's fine-grained permissions are configured to prevent unauthorized deletion of local log files or log records. If the firewall does not protect traffic log records and log files from unauthorized deletion while stored locally, this is a finding.

Fix: F-6945r297844_fix

Validate the firewall includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems. Configure role-based, fine-grained permissions management for controlling commands needed to delete log files and records.

b
The firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
CM-7 - Medium - CCI-000381 - V-206690 - SV-206690r604133_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
SRG-NET-000131-FW-000025
Vuln IDs
  • V-206690
  • V-79461
Rule IDs
  • SV-206690r604133_rule
  • SV-94167
Network devices are capable of providing a wide variety of functions (capabilities or processes) and services. Some of these functions and services are installed and enabled by default. The organization must determine which functions and services are required to perform the content filtering and other necessary core functionality for each component of the firewall. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Some services may be security related but, based on the firewall’s role in the architecture, must not be installed on the same hardware. For example, the device may serve as a router, VPN, or other perimeter services. However, if these functions are not part of the documented role of the firewall in the enterprise or branch architecture, the software and licenses should not be installed on the device. This mitigates the risk of exploitation of unconfigured services or services that are not kept updated with security fixes. If left unsecured, these services may provide a threat vector. Some services are not authorized for combination with the firewall and individual policy must be in place to instruct the administrator to remove these services. Examples of these services are Network Time Protocol (NTP), domain name server (DNS), email server, FTP server, web server, and Dynamic Host Configuration Protocol (DHCP). Only remove unauthorized services. This control is not intended to restrict the use of firewalls with multiple authorized roles.
Checks: C-6947r297849_chk

Review the documentation and architecture for the device or check the system-installed licenses or services. Determine what services and functions are installed on the firewall. Compare installed services and functions to the documentation showing the approved services. If unneeded services and functions are installed on the device but are not part of the documented role of the device, this is a finding.

Fix: F-6947r297850_fix

Display and remove unnecessary licenses, services, and functions from the firewall. Examples include NTP, DNS, and DHCP. Note: Only remove unauthorized services. This control is not intended to restrict the use of network devices with multiple authorized roles.

b
The firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.
SC-5 - Medium - CCI-001094 - V-206692 - SV-206692r604133_rule
RMF Control
SC-5
Severity
M
CCI
CCI-001094
Version
SRG-NET-000192-FW-000029
Vuln IDs
  • V-206692
  • V-79419
Rule IDs
  • SV-206692r604133_rule
  • SV-94125
DoS attacks can take multiple forms but have the common objective of overloading or blocking a network or host to deny or seriously degrade performance. If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users. Installation of a firewall at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type. The firewall must include protection against DoS attacks that originate from inside the enclave that can affect either internal or external systems. These attacks may use legitimate or rogue endpoints from inside the enclave. These attacks can be simple "floods" of traffic to saturate circuits or devices, malware that consumes CPU and memory on a device or causes it to crash, or a configuration issue that disables or impairs the proper function of a device. For example, an accidental or deliberate misconfiguration of a routing table can misdirect traffic for multiple networks.
Checks: C-6949r297855_chk

Obtain and review the list of outbound interfaces and zones from site personnel. Review each of the configured outbound interfaces and zones. Verify zones that communicate outbound have been configured with the DoS firewall filter (i.e., rules, access control lists [ACLs], screens, or policies) such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps. If all outbound interfaces are not configured to block DoS attacks, this is a finding.

Fix: F-6949r297856_fix

Associate a properly configured DoS firewall filter (e.g., rules, access control lists [ACLs], screens, or policies) to outbound interfaces and security zones. Apply a firewall filter to each outbound interface example: set security zones security-zone untrust interfaces <OUTBOUND-INTERFACE> set security zones security-zone trust screen untrust-screen

b
The firewall implementation must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.
SC-5 - Medium - CCI-001095 - V-206693 - SV-206693r604133_rule
RMF Control
SC-5
Severity
M
CCI
CCI-001095
Version
SRG-NET-000193-FW-000030
Vuln IDs
  • V-206693
  • V-79421
Rule IDs
  • SV-206693r604133_rule
  • SV-94127
A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering resulting in route flapping and will eventually black hole production traffic. The device must be configured to contain and limit a DoS attack's effect on the device's resource utilization. The use of redundant components and load balancing are examples of mitigating "flood-type" DoS attacks through increased capacity.
Checks: C-6950r297858_chk

Use the "show" command to verify that all inbound interfaces have a stateless firewall filter to set rate limits based on a destination. If the firewall does not have a stateless firewall filter that sets rate limits based on a destination, this is a finding.

Fix: F-6950r297859_fix

Configure a stateless firewall filter to set rate limits based on a destination of the packets. Apply the stateless firewall filter to all inbound interfaces.

c
The firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
SC-7 - High - CCI-001109 - V-206694 - SV-206694r604133_rule
RMF Control
SC-7
Severity
H
CCI
CCI-001109
Version
SRG-NET-000202-FW-000039
Vuln IDs
  • V-206694
  • V-79415
Rule IDs
  • SV-206694r604133_rule
  • SV-94121
To prevent malicious or accidental leakage of traffic, organizations must implement a deny-by-default security posture at the network perimeter. Such rulesets prevent many malicious exploits or accidental leakage by restricting the traffic to only known sources and only those ports, protocols, or services that are permitted and operationally necessary. As a managed boundary interface, the firewall must block all inbound and outbound network traffic unless a filter is installed to explicitly allow it. The allow filters must comply with the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessment (VA).
Checks: C-6951r297861_chk

Determine the default security policies on the firewall for traffic from one zone to another zone (inter-zone). The default policy must be a "Deny" policy that blocks all inter-zone traffic by default. Ensure no policy that circumvents the default "Deny" inter-zone policy is allowed. Traffic through the firewall is filtered so that only the specific traffic that is approved and registered in the PPSM CAL and VAs for the enclave. Verify rules or access control statements containing "any" for either the host, destination, protocol, or port are not used. If the firewall does not deny all network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception), this is a finding.

Fix: F-6951r297862_fix

Configure the firewall with a "Deny" inter-zone policy which, by default, blocks traffic between zones and allows network communications traffic by exception (i.e., deny all, permit by exception) in accordance with PPSM CAL and VAs for the enclave.

b
The perimeter firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave.
SC-7 - Medium - CCI-001097 - V-206695 - SV-206695r604133_rule
RMF Control
SC-7
Severity
M
CCI
CCI-001097
Version
SRG-NET-000205-FW-000040
Vuln IDs
  • V-206695
  • V-79485
Rule IDs
  • SV-206695r604133_rule
  • SV-94191
The enclave's internal network contains the servers where mission-critical data and applications reside. Malicious traffic can enter from an external boundary or originate from a compromised host internally. Vulnerability assessments must be reviewed by the SA and protocols must be approved by the IA staff before entering the enclave. Firewall filters (e.g., rules, access control lists [ACLs], screens, and policies) are the first line of defense in a layered security approach. They permit authorized packets and deny unauthorized packets based on port or service type. They enhance the posture of the network by not allowing packets to even reach a potential target within the security domain. The filters provided are highly susceptible ports and services that should be blocked or limited as much as possible without adversely affecting customer requirements. Auditing packets attempting to penetrate the network but stopped by the firewall filters will allow network administrators to broaden their protective ring and more tightly define the scope of operation. If the perimeter is in a Deny-by-Default posture and what is allowed through the filter is in accordance with the PPSM CAL and VAs for the enclave, and if the permit rule is explicitly defined with explicit ports and protocols allowed, then all requirements related to the database being blocked would be satisfied.
Checks: C-6952r297864_chk

Review the perimeter firewall to verify it filters traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave. If the perimeter firewall does not filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave, this is a finding.

Fix: F-6952r297865_fix

Configure the perimeter firewall to filter traffic destined to the internal enclave in accordance with the guidelines contained in the PPSM CAL and VAs for the enclave.

b
The firewall must fail to a secure state upon the failure of the following: system initialization, shutdown, or system abort.
SC-24 - Medium - CCI-001190 - V-206696 - SV-206696r604133_rule
RMF Control
SC-24
Severity
M
CCI
CCI-001190
Version
SRG-NET-000235-FW-000133
Vuln IDs
  • V-206696
  • V-79463
Rule IDs
  • SV-206696r604133_rule
  • SV-94169
Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. Network elements that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving the information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes.
Checks: C-6953r457836_chk

Verify the firewall stops forwarding traffic or maintains the configured security policies upon the failure of the following: system initialization, shutdown, or system abort. If the firewall does not stop forwarding traffic or maintain the configured security policies upon the failure of system initialization, shutdown, or system abort, this is a finding.

Fix: F-6953r457837_fix

Configure the firewall to stop forwarding traffic or maintain the configured security policies upon the failure of the following actions: system initialization, shutdown, or system abort.

b
In the event of a system failure of the firewall function, the firewall must be configured to save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted.
SC-24 - Medium - CCI-001665 - V-206698 - SV-206698r604133_rule
RMF Control
SC-24
Severity
M
CCI
CCI-001665
Version
SRG-NET-000236-FW-000027
Vuln IDs
  • V-206698
  • V-79465
Rule IDs
  • SV-206698r604133_rule
  • SV-94171
Failure to a secure state can address safety or security in accordance with the mission needs of the organization. Failure to a secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving state information helps to facilitate the restart of the firewall application and a return to the operational mode with less disruption. This requirement applies to a failure of the firewall function rather than the device or operating system as a whole, which is addressed in the Network Device Management SRG. Since it is usually not possible to test this functionality in a production environment, systems should be validated either in a testing environment or prior to installation. This requirement is usually a function of the design of the firewall. Compliance can be verified by acceptance/validation processes or vendor attestation.
Checks: C-6955r297873_chk

View the firewall failover configuration or system documentation. Verify that in the event of a system failure of the firewall function, the firewall saves diagnostic information, logs system messages, and loads the most current security policies, rules, and signatures. Testing of this functionality in a production environment is not recommended. If in the event of a system failure of the firewall function the firewall does not save diagnostic information, log system messages, and load the most current security policies, rules, and signatures when restarted, this is a finding.

Fix: F-6955r297874_fix

Configure the firewall to fail securely in the event of a transiently corrupt state or failure condition. When the system restarts, the system boot process must not succeed without passing all self-tests for cryptographic algorithms, RNG tests, and software integrity tests.

b
The firewall must be configured to send traffic log entries to a central audit server for management and configuration of the traffic log entries.
AU-3 - Medium - CCI-001844 - V-206699 - SV-206699r604133_rule
RMF Control
AU-3
Severity
M
CCI
CCI-001844
Version
SRG-NET-000333-FW-000014
Vuln IDs
  • V-206699
  • V-79445
Rule IDs
  • SV-206699r604133_rule
  • SV-94151
Without the ability to centrally manage the content captured in the traffic log entries, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. The DoD requires centralized management of all network component audit record content. Network components requiring centralized traffic log management must have the ability to support centralized management. The content captured in traffic log entries must be managed from a central location (necessitating automation). Centralized management of traffic log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Ensure at least one syslog server is configured on the firewall. If the product inherently has the ability to store log records locally, the local log must also be secured. However, this requirement is not met since it calls for a use of a central audit server.
Checks: C-6956r297876_chk

Examine the traffic log configuration on the firewall. Verify the firewall is configured to send traffic log entries to the organization's central audit server. If the firewall is not configured to send traffic log entries to the organization's central audit server, this is a finding.

Fix: F-6956r297877_fix

Configure the firewall to ensure traffic log entries are transmitted to the organization's central audit server (e.g., syslog server).

b
If communication with the central audit server is lost, the firewall must generate a real-time alert to, at a minimum, the SCA and ISSO.
AU-5 - Medium - CCI-001858 - V-206700 - SV-206700r604133_rule
RMF Control
AU-5
Severity
M
CCI
CCI-001858
Version
SRG-NET-000335-FW-000017
Vuln IDs
  • V-206700
  • V-79447
Rule IDs
  • SV-206700r604133_rule
  • SV-94153
Without a real-time alert (less than a second), security personnel may be unaware of an impending failure of the audit functions and system operation may be adversely impacted. Alerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including via a regularly monitored console, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. Most firewalls use UDP to send audit records to the server and cannot tell if the server has received the transmission, thus the site should either implement a connection-oriented communications solution (e.g., TCP) or implement a heartbeat with the central audit server and send an alert if it is unreachable.
Checks: C-6957r297879_chk

If a network device such as the events, network management, or SNMP server is configured to send an alert when communication is lost with the central audit server, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the SCA, ISSO, and other identified personnel when communication is lost with the central audit server. If the firewall is not configured to send an immediate alert via an approved method when communication is lost with the central audit server, this is a finding.

Fix: F-6957r297880_fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the SCA, ISSO, and other identified personnel for any log failure event where the filtering functions are unable to write events to the central audit server.

c
The firewall must employ filters that prevent or limit the effects of all types of commonly known denial-of-service (DoS) attacks, including flooding, packet sweeps, and unauthorized port scanning.
SC-5 - High - CCI-002385 - V-206701 - SV-206701r604133_rule
RMF Control
SC-5
Severity
H
CCI
CCI-002385
Version
SRG-NET-000362-FW-000028
Vuln IDs
  • V-206701
  • V-79413
Rule IDs
  • SV-206701r604133_rule
  • SV-94119
Not configuring a key boundary security protection device such as the firewall against commonly known attacks is an immediate threat to the protected enclave because they are easily implemented by those with little skill. Directions for the attack are obtainable on the Internet and in hacker groups. Without filtering enabled for these attacks, the firewall will allow these attacks beyond the protected boundary. Configure the perimeter and internal boundary firewall to guard against the three general methods of well-known DoS attacks: flooding attacks, protocol sweeping attacks, and unauthorized port scanning. Flood attacks occur when the host receives too much traffic to buffer and slows down or crashes. Popular flood attacks include ICMP flood and SYN flood. A TCP flood attack of SYN packets initiating connection requests can overwhelm the device until it can no longer process legitimate connection requests, resulting in denial of service. An ICMP flood can overload the device with so many echo requests (ping requests) that it expends all its resources responding and can no longer process valid network traffic, also resulting in denial of service. An attacker might use session table floods and SYN-ACK-ACK proxy floods to fill up the session table of a host. In an IP address sweep attack, an attacker sends ICMP echo requests (pings) to multiple destination addresses. If a target host replies, the reply reveals the target’s IP address to the attacker. In a TCP sweep attack, an attacker sends TCP SYN packets to the target device as part of the TCP handshake. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack. In a UDP sweep attack, an attacker sends UDP packets to the target device. If the device responds to those packets, the attacker gets an indication that a port in the target device is open, which makes the port vulnerable to attack. In a port scanning attack, an unauthorized application is used to scan the host devices for available services and open ports for subsequent use in an attack. This type of scanning can be used as a DoS attack when the probing packets are sent excessively.
Checks: C-6958r297882_chk

View the security filters for each interface or security zone. Verify DoS filters are configured to detect and prevent known DoS attacks such as IP sweeps, TCP sweeps, buffer overflows, unauthorized port scanning, SYN floods, UDP floods, and UDP sweeps. If filters are not configured or if the security zone is not configured with filters that guard against common DoS attacks, this is a finding.

Fix: F-6958r297883_fix

Configure the firewall to detect and prevent DoS attacks. Implement filters with thresholds that are customized for the specific environment where applicable. DoS filters are based on NIST 800-53 requirements and vendor recommendations. The following sample commands show filters that implement this requirement (these are examples only): set filter1 icmp ip-sweep threshold 1000 set filter2 tcp port-scan threshold 1000 set filter3 tcp syn-flood alarm-threshold 1000 set filter3 tcp syn-flood attack-threshold 1100 set filter4 tcp syn-flood source-threshold 100 set filter5 tcp syn-flood destination-threshold 2048 set filter6 tcp syn-flood timeout 20 set filter7 tcp tcp-sweep threshold 1000 set filter8 udp flood threshold 5000 set filter9 udp udp-sweep threshold 1000

b
The firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
SC-7 - Medium - CCI-002403 - V-206703 - SV-206703r604133_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000364-FW-000031
Vuln IDs
  • V-206703
  • V-79469
Rule IDs
  • SV-206703r604133_rule
  • SV-94175
Unrestricted traffic to the trusted networks may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Firewall filters control the flow of network traffic, ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated.
Checks: C-6960r297888_chk

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database. If the list of authorized sources and destinations is not available, this is a finding. Review the firewall configuration for each of the configured inbound zones and interfaces. Verify an ingress filter (e.g., Access Control List) is applied to each inbound zone/interface, including the management interface. Verify ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself). Verify that traffic accessing the firewall originates from the Network Operations Center (NOC). If an ingress filter is not configured for each active inbound zone or interface, this is a finding.

Fix: F-6960r297889_fix

Configure a security policy to each inbound zone and/or interface to implement continuous filtering of outbound traffic. Apply security policy zones/interfaces through which inbound traffic flows from untrusted external networks or subnetworks. Configure the ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself) and so that traffic accessing the firewall originates from the NOC.

b
The firewall must apply egress filters to traffic that is outbound from the network through any internal interface.
SC-7 - Medium - CCI-002403 - V-206704 - SV-206704r604133_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000364-FW-000032
Vuln IDs
  • V-206704
  • V-79471
Rule IDs
  • SV-206704r604133_rule
  • SV-94177
If outbound communications traffic is not filtered, hostile activity intended to harm other networks or packets from networks destined to unauthorized networks may not be detected and prevented. Access control policies and access control lists implemented on devices, such as firewalls, that control the flow of network traffic ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet) must be kept separated. This requirement addresses the binding of the egress filter to the interface/zone rather than the content of the egress filter.
Checks: C-6961r297891_chk

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database. If the list of authorized sources and destinations is not available, this is a finding. Review the firewall configuration for each of the configured outbound zones and interfaces. Verify a security policy is applied to each outbound zone/interface, including the management interface. If an egress filter is not configured for each active outbound zone or interface, this is a finding.

Fix: F-6961r297892_fix

Configure a security policy to each outbound zone and/or interface to implement continuous filtering of outbound traffic. Apply security policy zones/interfaces (including the management interface) through which outbound traffic flows to untrusted external networks or subnetworks.

b
The premise firewall (located behind the premise router) must block all outbound management traffic.
SC-7 - Medium - CCI-002403 - V-206707 - SV-206707r604133_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000364-FW-000035
Vuln IDs
  • V-206707
  • V-79477
Rule IDs
  • SV-206707r604133_rule
  • SV-94183
The management network must still have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the managed network's premise equipment. If a firewall is located behind the premise router, all management traffic must be blocked at that point, with the exception of management traffic destined to premise equipment.
Checks: C-6964r297900_chk

Review the firewall configuration to verify that it is blocking all outbound management traffic. If the firewall is not blocking management network from leaking to outside networks, this is a finding.

Fix: F-6964r297901_fix

With the exception of management traffic destined to perimeter equipment, configure a firewall located behind the premise router to block all outbound management traffic.

b
The firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.
SC-7 - Medium - CCI-002403 - V-206708 - SV-206708r604133_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000364-FW-000036
Vuln IDs
  • V-206708
  • V-79479
Rule IDs
  • SV-206708r604133_rule
  • SV-94185
Protect the management network with a filtering firewall configured to block unauthorized traffic. This requirement is similar to the out-of-band management (OOBM) model, when the production network is managed in-band. The management network could also be housed at a Network Operations Center (NOC) that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity, as well as connectivity between the NOC and the managed networks’ premise routers, would be enabled using either provisioned circuits or VPN technologies such as IPsec tunnels or MPLS VPN services.
Checks: C-6965r297903_chk

Inspect the architecture diagrams. Inspect the NOC and the managed network. Note that the IPsec tunnel endpoints may be configured on the premise or gateway router, the VPN gateway firewall, or a VPN concentrator. Verify that all traffic between the managed network and management network and vice-versa is secured via IPsec encapsulation. If the firewall does not restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address, this is a finding.

Fix: F-6965r297904_fix

Where IPsec technology is deployed to connect the managed network to the NOC, restrict the traffic entering the tunnels so that only the authorized management packets with authorized destination addresses are permitted.

a
The firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when denial-of-service (DoS) incidents are detected.
SI-4 - Low - CCI-002664 - V-206711 - SV-206711r604133_rule
RMF Control
SI-4
Severity
L
CCI
CCI-002664
Version
SRG-NET-000392-FW-000042
Vuln IDs
  • V-206711
  • V-79489
Rule IDs
  • SV-206711r604133_rule
  • SV-94195
Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The firewall generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs), which require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The firewall must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.
Checks: C-6968r297912_chk

If a network device such as the events, network management, or SNMP server is configured to send an alert when DoS incidents are detected, this is not a finding. Verify the firewall is configured to send an alert via instant message, email, SNMP, or another authorized method to the ISSO, ISSM, and other identified personnel when DoS incidents are detected. If the firewall is not configured to send an alert via an approved and immediate method when DoS incidents are detected, this is a finding.

Fix: F-6968r297913_fix

Configure the firewall (or another network device) to send an alert via instant message, email, or another authorized method to the ISSO and ISSM and other identified personnel when DoS incidents are detected.

b
The firewall must be configured to allow authorized users to record a packet capture based IP, traffic type (TCP, UDP, or ICMP), or protocol.
AU-14 - Medium - CCI-001462 - V-206712 - SV-206712r604133_rule
RMF Control
AU-14
Severity
M
CCI
CCI-001462
Version
SRG-NET-000399-FW-000008
Vuln IDs
  • V-206712
  • V-79433
Rule IDs
  • SV-206712r604133_rule
  • SV-94139
Without the ability to capture, record, and log content related to a user session, investigations into suspicious user activity would be hampered. This configuration ensures the ability to select specific sessions to capture in order to support general auditing/incident investigation or to validate suspected misuse.
Checks: C-6969r297915_chk

View the documented process for packet capture. Verify the firewall allows authorized users to perform a packet capture based on IP, traffic type (TCP, UDP, or ICMP), or protocol. If the firewall is not configured to allow authorized users to capture, record, and log all content related to a user session, this is a finding.

Fix: F-6969r297916_fix

Document a process for authorized users to capture, record, and log all content based on IP, traffic type (TCP, UDP, or ICMP), or protocol.

b
The firewall must generate traffic log records when traffic is denied, restricted, or discarded.
AU-12 - Medium - CCI-000172 - V-206713 - SV-206713r604133_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
SRG-NET-000492-FW-000006
Vuln IDs
  • V-206713
  • V-79429
Rule IDs
  • SV-206713r604133_rule
  • SV-94135
Without generating log records that log usage of objects by subjects and other objects, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Security objects are data objects that are controlled by security policy and bound to security attributes. The firewall must not forward traffic unless it is explicitly permitted via security policy. Logging for firewall security-related sources such as screens and security policies must be configured separately. To ensure security objects such as firewall filters (i.e., rules, access control lists [ACLs], screens, and policies) send events to a syslog server and local logs, security logging must be configured one each firewall term.
Checks: C-6970r297918_chk

View the configuration of the firewall or the central audit server log records. Verify the firewall generates traffic log records when traffic is denied, restricted, or discarded. If the firewall does not generate traffic log records for events when traffic is denied, restricted, or discarded, this is a finding.

Fix: F-6970r297919_fix

Configure the firewall central audit server stanza to generate traffic log records for events when traffic is denied, restricted, or discarded.

b
The firewall must generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.
AU-12 - Medium - CCI-000172 - V-206714 - SV-206714r604133_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
SRG-NET-000493-FW-000007
Vuln IDs
  • V-206714
  • V-79431
Rule IDs
  • SV-206714r604133_rule
  • SV-94137
Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Access for different security levels maintains separation between resources (particularly stored data) of different security domains. The firewall can be configured to use security zones that are configured with different security policies based on risk and trust levels. These zones can be leveraged to prevent traffic from one zone from sending packets to another zone. For example, information from certain IP sources will be rejected if the destination matches specified security zones that are not authorized.
Checks: C-6971r297921_chk

View the configuration of the firewall or the central audit server log records. Verify the firewall generates traffic log records when attempts are made to send packets between security zones that are not authorized to communicate. If the firewall does not generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate, this is a finding.

Fix: F-6971r297922_fix

Configure the firewall central audit server stanza to generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.

b
The firewall must be configured to inspect all inbound and outbound traffic at the application layer.
CM-6 - Medium - CCI-000366 - V-223011 - SV-223011r604133_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000364-FW-000040
Vuln IDs
  • V-223011
  • V-101103
Rule IDs
  • SV-223011r604133_rule
  • SV-110207
Application inspection enables the firewall to control traffic based on different parameters that exist within the packets such as enforcing application-specific message and field length. Inspection provides improved protection against application-based attacks by restricting the types of commands allowed for the applications. Application inspection all enforces conformance against published RFCs. Some applications embed an IP address in the packet that needs to match the source address that is normally translated when it goes through the firewall. Enabling application inspection for a service that embeds IP addresses, the firewall translates embedded addresses and updates any checksum or other fields that are affected by the translation. Enabling application inspection for a service that uses dynamically assigned ports, the firewall monitors sessions to identify the dynamic port assignments, and permits data exchange on these ports for the duration of the specific session.
Checks: C-24683r457848_chk

Review the firewall configuration to verify that inspection for applications deployed within the network is being performed on all interfaces. If the firewall is not configured to inspect all inbound and outbound traffic at the application layer, this is a finding.

Fix: F-24672r457849_fix

Configure the firewall to inspect all inbound and outbound traffic at the application layer.

b
The firewall must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.
CM-6 - Medium - CCI-000366 - V-223012 - SV-223012r604133_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000364-FW-000041
Vuln IDs
  • V-223012
  • V-101105
Rule IDs
  • SV-223012r604133_rule
  • SV-110209
IPv6 packets with unknown extension headers as well as out-of-order headers can create denial-of-service attacks for other networking components as well as host devices. IPv6 inspection can check conformance to RFC 2460 enforcing the order extension headers. While routers only need to examine the IPv6 destination address and the Hop-by-Hop Options header, firewalls should must recognize and parse through all existing extension headers since the upper-layer protocol information reside in the last header. An attacker is able to chain lots of extension headers in order to pass firewall- & intrusion detections. An attacker can cause a denial of service if an intermediary device or destination host is not capable of processing an extensive or out-of-order chaine of extension headers. Hence it is imperative, that the firewall is configured to drop packets with unknown or out-of-order headers.
Checks: C-24684r457851_chk

Review the firewall configuration to verify that IPv6 inspection is being performed on all interfaces. If the firewall is not configujred to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers, this is a finding.

Fix: F-24673r457853_fix

Configure the firewall to inspect all inbound and outbound traffic at the application layer.

b
The firewall must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).
CM-6 - Medium - CCI-000366 - V-223013 - SV-223013r604133_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000364-FW-000042
Vuln IDs
  • V-223013
  • V-101107
Rule IDs
  • SV-223013r604133_rule
  • SV-110211
A compromised host in an enclave can be used by a malicious platform to launch cyberattacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack other computers or networks. DDoS attacks frequently leverage IP source address spoofing to send packets to multiple hosts that in turn will then send return traffic to the hosts with the IP addresses that were forged. This can generate significant amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken. When uRPF is enabled in strict mode, the packet must be received on the interface that the device would use to forward the return packet; thereby mitigating IP source address spoofing.
Checks: C-24686r457855_chk

Review the firewall configuration to verify uRPF or an egress filter has been configured on all internal interfaces to restrict the firewall from accepting outbound packets that contain an illegitimate address in the source address field. If uRPF or an egress ACL to restrict the firewall from accepting outbound IP packets that contain an illegitimate address in the source address field has not been configured on all internal interfaces, this is a finding.

Fix: F-24674r457856_fix

Configure the firewall with an egress filter or uRPF on all internal interfaces to restrict the firewall from accepting any outbound packet that contains an illegitimate address in the source field.