STIGQter: STIG Summary: F5 BIG-IP TMOS ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The F5 BIG-IP appliance must configure certification path validation to ensure revoked machine credentials are prohibited from establishing an allowed session.

DISA Rule

SV-266153r1024380_rule

Vulnerability Number

V-266153

Group Title

SRG-NET-000164-ALG-000100

Rule Version

F5BI-AP-300052

Severity

CAT I

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

If the Access Profile is configured to pull a machine cert using the "Machine Cert Auth" object in the policy, then perform the following actions. Note that pulling a Machine Cert requires the use of the APM Edge Client installed on the client.

To add OCSP machine certificate verification to an access policy:

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click "Edit" under "Per-Session Policy" for the Access Profile.
5. Click the "+" icon on the Successful branch of the Machine Cert Auth object.
6. Authentication tab.
7. Select "OCSP Auth".
8. Click "Add Item".
9. From the OCSP Responder list, select an OCSP responder.
Note: To create an OCSP Responder, go to Access >> Authentication >> OCSP Responder.
10. From the Certificate Type list, select "Machine".
11. Click "Save".
12. Click "Apply Access Policy".

To add CRLDP certificate verification to an access policy:

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click "Edit" under "Per-Session Policy" for the Access Profile.
5. Click the "+" icon on the Successful branch of the Machine Cert Auth object.
6. Authentication tab.
7. Select "CRLDP Auth".
8. Click "Add Item".
9. Select an item from the CRLDP Server list.
Note: To create a CRLDP Server, go to Access >> Authentication >> CRLDP.
10. Click "Save".
11. Click "Apply Access Policy".

Check Contents

If the BIG-IP appliance does not provide intermediary services for TLS, or application protocols that use TLS (e.g., DNSSEC or HTTPS), this is not applicable.

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click "Edit" under "Per-Session Policy" for the Access Profile.
5. Verify an "OCSP Auth" object is configured in the Access Profile for "Machine" type or a CRLDP object is configured.

If the BIG-IP appliance is not configured to use OCSP or CRLDP to ensure revoked machine credentials are prohibited from establishing an allowed session, this is a finding.

Vulnerability Number

V-266153

Documentable

False

Rule Version

F5BI-AP-300052

Severity Override Guidance

If the BIG-IP appliance does not provide intermediary services for TLS, or application protocols that use TLS (e.g., DNSSEC or HTTPS), this is not applicable.

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click "Edit" under "Per-Session Policy" for the Access Profile.
5. Verify an "OCSP Auth" object is configured in the Access Profile for "Machine" type or a CRLDP object is configured.

If the BIG-IP appliance is not configured to use OCSP or CRLDP to ensure revoked machine credentials are prohibited from establishing an allowed session, this is a finding.

Check Content Reference

M

Target Key

5640