STIGQter: STIG Summary: F5 BIG-IP TMOS ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The F5 BIG-IP appliance providing user access control intermediary services must implement attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.

DISA Rule

SV-266144r1137545_rule

Vulnerability Number

V-266144

Group Title

SRG-NET-000018-ALG-000017

Rule Version

F5BI-AP-300013

Severity

CAT I

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

From the BIG-IP GUI:
1. Security.
2. Network Firewall.
3. Policies.
4. Create and/or edit firewall policies that are applied to the Context needed to enforce approved authorizations for controlling the flow of information within the network.

Check Contents

From the BIG-IP GUI:
1. Security.
2. Network Firewall.
3. Active Rules.
4. Verify "Policy Type" is set to "Enforced".
5. Inspect the different "Context" choices and verify rules are configured to enforce approved authorizations for controlling the flow of information within the network.

If the BIG-IP appliance is not configured to enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic, this is a finding.

Vulnerability Number

V-266144

Documentable

False

Rule Version

F5BI-AP-300013

Severity Override Guidance

From the BIG-IP GUI:
1. Security.
2. Network Firewall.
3. Active Rules.
4. Verify "Policy Type" is set to "Enforced".
5. Inspect the different "Context" choices and verify rules are configured to enforce approved authorizations for controlling the flow of information within the network.

If the BIG-IP appliance is not configured to enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic, this is a finding.

Check Content Reference

M

Target Key

5640