STIGQter: STIG Summary: F5 BIG-IP TMOS ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The F5 BIG-IP appliance providing content filtering must protect against or limit the effects of known and unknown types of denial-of-service (DoS) attacks by employing pattern recognition pre-processors.

DISA Rule

SV-266157r1024386_rule

Vulnerability Number

V-266157

Group Title

SRG-NET-000362-ALG-000155

Rule Version

F5BI-AP-300061

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

From the BIG-IP GUI:
1. Security.
2. DoS Protection.
3. Device Protection.
4. Expand "Network".
5. Click "Configure settings".
6. Set "Dynamic Signature Detection" to "Enabled".
7. If applicable, expand "DNS".
8. Click "Configure settings".
9. Set "Dynamic Signature Detection" to "Enabled".
10. Click "Commit Changes to System".

Check Contents

If the BIG-IP appliance does not perform content filtering as part of the traffic management functions, this is not applicable.

From the BIG-IP GUI:
1. Security.
2. DoS Protection.
3. Device Protection.
4. Expand "Network" and verify "Dynamic Signatures" are enabled.
5. If applicable, expand "DNS" and verify "Dynamic Signatures" are enabled.

If the BIG-IP appliance is not configured to protect against or limit the effects of known and unknown types of DoS attacks by employing pattern recognition pre-processors, this is a finding.

Vulnerability Number

V-266157

Documentable

False

Rule Version

F5BI-AP-300061

Severity Override Guidance

If the BIG-IP appliance does not perform content filtering as part of the traffic management functions, this is not applicable.

From the BIG-IP GUI:
1. Security.
2. DoS Protection.
3. Device Protection.
4. Expand "Network" and verify "Dynamic Signatures" are enabled.
5. If applicable, expand "DNS" and verify "Dynamic Signatures" are enabled.

If the BIG-IP appliance is not configured to protect against or limit the effects of known and unknown types of DoS attacks by employing pattern recognition pre-processors, this is a finding.

Check Content Reference

M

Target Key

5640