STIGQter STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Jan 2021:

For zones split between the external and internal sides of a network, the resource records (RRs) for the external hosts must be separate from the RRs for the internal hosts.

DISA Rule

SV-233868r621666_rule

Vulnerability Number

V-233868

Group Title

SRG-APP-000516-DNS-000091

Rule Version

IDNS-8X-400010

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

1. Navigate to Data Management >> DNS >> Zones and review each zone.
2. Remove any RRs listed in the internal name server configuration (DNS view) that resolve for external hosts.
3. Remove any RRs listed in the external name server configuration (DNS view) that resolve to internal hosts.
4. For hosts intended to be accessed by both internal and external clients, configure unique IP addresses in each of the internal and external name servers, respective to their location.
5. The perimeter firewall, or other routing device, must be configured to perform Network Address Translation to the true IP address of the destination.

Check Contents

DNS Views allow a single zone to have two different data sets, with the response based on a client match list.

1. When DNS Views are used, the top-level configuration of DNS >> Data Management >> Zones tab will display available views.
2. Select the desired view using the check box and click "Edit".
3. Review the "Match Clients" configuration.
4. Verify the "Match Clients" configuration properly separates the internal and external DNS views.

If DNS Views are used and the client match list is validated, this is not a finding.

Vulnerability Number

V-233868

Documentable

False

Rule Version

IDNS-8X-400010

Severity Override Guidance

DNS Views allow a single zone to have two different data sets, with the response based on a client match list.

1. When DNS Views are used, the top-level configuration of DNS >> Data Management >> Zones tab will display available views.
2. Select the desired view using the check box and click "Edit".
3. Review the "Match Clients" configuration.
4. Verify the "Match Clients" configuration properly separates the internal and external DNS views.

If DNS Views are used and the client match list is validated, this is not a finding.

Check Content Reference

M

Target Key

5251

Comments