STIGQter: STIG Summary: Firewall Security Requirements Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

In the event that communication with the central audit server is lost, the firewall must continue to queue traffic log records locally.

DISA Rule

SV-206684r604133_rule

Vulnerability Number

V-206684

Group Title

SRG-NET-000089

Rule Version

SRG-NET-000089-FW-000019

Severity

CAT II

CCI(s)

• CCI-000140 - The information system takes organization-defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).

Weight

10

Fix Recommendation

Configure local backup events files to capture DoD-defined auditable events either consistently or, if possible, in the event communication with the central audit server is lost.

Check Contents

Verify logging has been enabled and configured for local queuing of the traffic log.

If a local log file (or files) is not configured to capture events locally if communication with the central audit server is lost, this is a finding.

Vulnerability Number

V-206684

Documentable

False

Rule Version

SRG-NET-000089-FW-000019

Severity Override Guidance

Verify logging has been enabled and configured for local queuing of the traffic log.

If a local log file (or files) is not configured to capture events locally if communication with the central audit server is lost, this is a finding.

Check Content Reference

M

Target Key

2912

Comments