STIGQter: STIG Summary: VMware NSX-T Tier 1 Gateway Firewall Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 26 Jul 2023:

The NSX-T Tier-1 Gateway Firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

DISA Rule

SV-251765r810190_rule

Vulnerability Number

V-251765

Group Title

SRG-NET-000202-FW-000039

Rule Version

T1FW-3X-000021

Severity

CAT II

CCI(s)

CCI-001109 - Deny network communications traffic by default and allow network communications traffic by exception at managed interfaces; and/or for organization-defined systems.
CCI-001190 - Fail to an organization-defined known-system state for the following failures on the indicated components while preserving organization-defined system state information in failure.
CCI-001665 - Preserve organization-defined system state information in the event of a system failure.

Weight

Fix Recommendation

From the NSX-T Manager web interface, go to Security >> Gateway Firewall >> Gateway Specific Rules >> Choose each Tier-1 Gateway in drop-down >> Policy_Default_Infra Section >> Action >> change the Action to Drop or Reject and click Publish.

Check Contents

From the NSX-T Manager web interface, go to Security >> Gateway Firewall >> Gateway Specific Rules >> Choose each Tier-1 Gateway in drop-down >> Policy_Default_Infra Section >> Action.

If the default_rule is set to Allow, this is a finding.

Vulnerability Number

V-251765

Documentable

False

Rule Version

T1FW-3X-000021

Severity Override Guidance

From the NSX-T Manager web interface, go to Security >> Gateway Firewall >> Gateway Specific Rules >> Choose each Tier-1 Gateway in drop-down >> Policy_Default_Infra Section >> Action.

If the default_rule is set to Allow, this is a finding.

Check Content Reference

Target Key

5453