STIGQter: STIG Summary: VMware NSX-T Tier 1 Gateway Firewall Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 26 Jul 2023:

The NSX-T Tier-1 Gateway Firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.

DISA Rule

SV-251764r919240_rule

Vulnerability Number

V-251764

Group Title

SRG-NET-000192-FW-000029

Rule Version

T1FW-3X-000019

Severity

CAT II

CCI(s)

• CCI-001094 - Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems.
• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

To create a new Flood Protection profile, do the following:

From the NSX-T Manager web interface, go to Security >> General Settings >> Firewall >> Flood Protection >> Add Profile >> Add Firewall Profile.

Enter a name and specify appropriate values for the following: TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit.

Configure the "Applied To" field to contain Tier-1 Gateways and then click "Save".

Check Contents

From the NSX-T Manager web interface, go to Security >> General Settings >> Firewall >> Flood Protection to view Flood Protection profiles.

If there are no Flood Protection profiles of type "Gateway", this is a finding.

For each gateway flood protection profile, verify the TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit are set to "None".

If they are not, this is a finding.

For each gateway flood protection profile, examine the "Applied To" field to view the Tier-1 Gateways to which it is applied.

If a gateway flood protection profile is not applied to all Tier-1 Gateways through one or more policies, this is a finding.

Vulnerability Number

V-251764

Documentable

False

Rule Version

T1FW-3X-000019

Severity Override Guidance

From the NSX-T Manager web interface, go to Security >> General Settings >> Firewall >> Flood Protection to view Flood Protection profiles.

If there are no Flood Protection profiles of type "Gateway", this is a finding.

For each gateway flood protection profile, verify the TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit are set to "None".

If they are not, this is a finding.

For each gateway flood protection profile, examine the "Applied To" field to view the Tier-1 Gateways to which it is applied.

If a gateway flood protection profile is not applied to all Tier-1 Gateways through one or more policies, this is a finding.

Check Content Reference

M

Target Key

5453