STIGQter: STIG Summary: F5 BIG-IP TMOS NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 02 Jul 2025:

The F5 BIG-IP appliance must be configured to limit the number of concurrent sessions to the Configuration Utility to 10 or an organization-defined number.

DISA Rule

SV-266064r1024595_rule

Vulnerability Number

V-266064

Group Title

SRG-APP-000001-NDM-000200

Rule Version

F5BI-DM-300001

Severity

CAT II

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.
• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

From the BIG-IP GUI:
1. System.
2. Preferences.
3. Set System Settings view to Advanced.
4. Maximum HTTP connections to Configuration Utility: enter 10 or an organization-defined number.
5. Update.

From the BIG-IP console, type the following commands:

tmsh modify sys httpd max-clients <10 or an organization-defined number>
tmsh save sys config

Check Contents

From the BIG-IP GUI:
1. System.
2. Preferences.
3. Verify that System Settings view is set to Advanced.
4. Verify Maximum HTTP connections to Configuration Utility is set to 10 or an organization-defined number.

From the BIG-IP console, type the following command:

tmsh list sys httpd max-clients

If the device is not configured to limit the number of concurrent sessions to the Configuration Utility to 10 or an organization-defined number, this is a finding.

Vulnerability Number

V-266064

Documentable

False

Rule Version

F5BI-DM-300001

Severity Override Guidance

From the BIG-IP GUI:
1. System.
2. Preferences.
3. Verify that System Settings view is set to Advanced.
4. Verify Maximum HTTP connections to Configuration Utility is set to 10 or an organization-defined number.

From the BIG-IP console, type the following command:

tmsh list sys httpd max-clients

If the device is not configured to limit the number of concurrent sessions to the Configuration Utility to 10 or an organization-defined number, this is a finding.

Check Content Reference

M

Target Key

5639