STIGQter: STIG Summary: F5 BIG-IP TMOS ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The F5 BIG-IP appliance providing remote access intermediary services must disable split-tunneling for remote clients' VPNs.

DISA Rule

SV-266172r1024404_rule

Vulnerability Number

V-266172

Group Title

SRG-NET-000512-ALG-000062

Rule Version

F5BI-AP-300161

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-002397 - Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using organization-defined safeguards.

Weight

10

Fix Recommendation

Obtain the Network Access name in the Access Profile:
From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the name of the Access Profile.
5. Click the Access Policy tab and note the name(s) of the Network Access listed.

Configure the Network Access List:
From the BIG-IP GUI:
1. Access.
2. Connectivity/VPN.
3. Network Access (VPN).
4. Network Access Lists.
5. Click on the Name of the Network Access List.
6. Network Settings tab.
7. Select "Force all traffic through tunnel" under Client Settings >> Traffic Options.
8. Click "Update".

Check Contents

If the BIG-IP appliance does not provide remote access intermediary services, this is not applicable.

Access Profile:
From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the name of the Access Profile.
5. Click the Access Policy tab and note the name(s) of the Network Access listed.

Network Access List:
From the BIG-IP GUI:
1. Access.
2. Connectivity/VPN.
3. Network Access (VPN).
4. Network Access Lists.
5. Click on the Name of the Network Access List.
6. Network Settings tab.
7. Verify "Force all traffic through tunnel" is selected under Client Settings >> Traffic Options.

If the BIG-IP appliance is not configured to disable split-tunneling for remote client VPNs, this is a finding.

Vulnerability Number

V-266172

Documentable

False

Rule Version

F5BI-AP-300161

Severity Override Guidance

If the BIG-IP appliance does not provide remote access intermediary services, this is not applicable.

Access Profile:
From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the name of the Access Profile.
5. Click the Access Policy tab and note the name(s) of the Network Access listed.

Network Access List:
From the BIG-IP GUI:
1. Access.
2. Connectivity/VPN.
3. Network Access (VPN).
4. Network Access Lists.
5. Click on the Name of the Network Access List.
6. Network Settings tab.
7. Verify "Force all traffic through tunnel" is selected under Client Settings >> Traffic Options.

If the BIG-IP appliance is not configured to disable split-tunneling for remote client VPNs, this is a finding.

Check Content Reference

M

Target Key

5640