STIGQter: STIG Summary: F5 BIG-IP TMOS NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 02 Jul 2025:

The F5 BIG-IP appliance must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.

DISA Rule

SV-266086r1024925_rule

Vulnerability Number

V-266086

Group Title

SRG-APP-000395-NDM-000347

Rule Version

F5BI-DM-300048

Severity

CAT II

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

From the BIG-IP console, type the following commands:

echo "1 M <passphrase> #MD5 Key" > /etc/ntp/keys

Note: This command assumes that no other keys have been previously configured in the /etc/ntp/keys file. Running this command will overwrite the file.

#Make sure this key is installed on all the NTP servers and clients participating in the NTP time synchronization.

tmsh edit sys ntp all-properties

#Replace the "include" section with the following (add as many ntp server lines as necessary for the environment, but configure at least 2):

include "server <ntp server> key <trusted key number matched to /etc/ntp/keys> iburst trustedkey <trusted key number matched to /etc/ntp/keys>
server <ntp server> key <trusted key number matched to /etc/ntp/keys> iburst trustedkey <trusted key number matched to /etc/ntp/keys>"

tmsh save sys config

Check Contents

From the BIG-IP Console:
cat /etc/ntp/keys

#Verify this key is installed on all the NTP servers and clients participating in the NTP time synchronization.

tmsh list sys ntp include

#Verify there is a line similar to the following:
#server <ntp server> key <trusted key number matched to /etc/ntp/keys> iburst trustedkey <trusted key number matched to /etc/ntp/keys>

If the BIG-IP appliance is not configured to authenticate Network Time Protocol sources using authentication that is cryptographically based, this is a finding.

Vulnerability Number

V-266086

Documentable

False

Rule Version

F5BI-DM-300048

Severity Override Guidance

From the BIG-IP Console:
cat /etc/ntp/keys

#Verify this key is installed on all the NTP servers and clients participating in the NTP time synchronization.

tmsh list sys ntp include

#Verify there is a line similar to the following:
#server <ntp server> key <trusted key number matched to /etc/ntp/keys> iburst trustedkey <trusted key number matched to /etc/ntp/keys>

If the BIG-IP appliance is not configured to authenticate Network Time Protocol sources using authentication that is cryptographically based, this is a finding.

Check Content Reference

M

Target Key

5639