STIGQter STIGQter: STIG Summary: Infoblox 7.x DNS Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port.

DISA Rule

SV-214217r612370_rule

Vulnerability Number

V-214217

Group Title

SRG-APP-000516-DNS-000110

Rule Version

IDNS-7X-000900

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Navigate to Data Management >> DNS >> Grid DNS Properties.

Toggle Advanced Mode and select General >> Advanced tab.

Disable "Set static source UDP port for queries (not recommended)" and "Set static source UDP port for notify messages".

Navigate to Data Management >> DNS >> Members/Servers tab.

Review each Infoblox member with the DNS service enabled.

Select each server, click "Edit", toggle Advanced Mode and select General >> Advanced tab.

Locate the section labeled "Source port settings" and click "Override" to utilize the Grid default values that disable static source ports.
When complete, click "Save & Close" to save the changes and exit the "Properties" screen.

Perform a service restart if necessary.

Check Contents

By default Infoblox systems utilize a random port for both DNS queries and notify messages.
Verify the default configuration is not overridden.

Navigate to Data Management >> DNS >> Members/Servers tab.

Review each server with the DNS service enabled.

Select each server, click "Edit", toggle Advanced Mode and select General >> Advanced tab.

Verify that the options under "Source Port Settings"; "Set static source UDP port for queries (not recommended)" and "Set static source UDP port for notify messages" use the default value of not enabled.

If configuration of either of these values exists, this is a finding.

When complete, click "Cancel" to exit the "Properties" screen.

Vulnerability Number

V-214217

Documentable

False

Rule Version

IDNS-7X-000900

Severity Override Guidance

By default Infoblox systems utilize a random port for both DNS queries and notify messages.
Verify the default configuration is not overridden.

Navigate to Data Management >> DNS >> Members/Servers tab.

Review each server with the DNS service enabled.

Select each server, click "Edit", toggle Advanced Mode and select General >> Advanced tab.

Verify that the options under "Source Port Settings"; "Set static source UDP port for queries (not recommended)" and "Set static source UDP port for notify messages" use the default value of not enabled.

If configuration of either of these values exists, this is a finding.

When complete, click "Cancel" to exit the "Properties" screen.

Check Content Reference

M

Target Key

3995

Comments