STIGQter STIGQter: STIG Summary: F5 BIG-IP TMOS ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The F5 BIG-IP appliance must be configured to restrict a consistent inbound IP for the entire management session.

DISA Rule

SV-266167r1024399_rule

Vulnerability Number

V-266167

Group Title

SRG-NET-000230-ALG-000113

Rule Version

F5BI-AP-300156

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

From the BIG-IP GUI:
1. System.
2. Preferences.
3. Under Security Settings, check "Require A Consistent Inbound IP For The Entire Web Session".
4. Click "Update".

From the BIG-IP Console:

tmsh modify sys httpd auth-pam-validate-ip on
tmsh save sys config

Check Contents

From the BIG-IP GUI:
1. System.
2. Preferences.
3. Under Security Settings, verify "Require A Consistent Inbound IP For The Entire Web Session" box is checked.

From the BIG-IP Console:

tmsh list sys httpd auth-pam-validate-ip

Note: This returns a value of "on".

If the BIG-IP appliance is not configured to require a consistent inbound IP for the entire session for management sessions, this is a finding.

Vulnerability Number

V-266167

Documentable

False

Rule Version

F5BI-AP-300156

Severity Override Guidance

From the BIG-IP GUI:
1. System.
2. Preferences.
3. Under Security Settings, verify "Require A Consistent Inbound IP For The Entire Web Session" box is checked.

From the BIG-IP Console:

tmsh list sys httpd auth-pam-validate-ip

Note: This returns a value of "on".

If the BIG-IP appliance is not configured to require a consistent inbound IP for the entire session for management sessions, this is a finding.

Check Content Reference

M

Target Key

5640