STIGQter: STIG Summary: F5 BIG-IP TMOS ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The VPN Gateway must use Always On VPN connections for remote computing.

DISA Rule

SV-266174r1024406_rule

Vulnerability Number

V-266174

Group Title

SRG-NET-000512-ALG-000062

Rule Version

F5BI-AP-300163

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-001184 - Protect the authenticity of communications sessions.

Weight

10

Fix Recommendation

Configure at least one of these methods.
Always Connected Mode:

From the BIG-IP GUI:
1. Access.
2. Connectivity/VPN.
3. Connectivity.
4. Profiles.
5. Click the name of the profile.
6. At the bottom, click Customize Package >> Windows.
7. Click "BIG-IP Edge Client" on the left.
8. Check the box next to "Enable Always connected mode".
Note: Always connected mode requires at least one host be listed in the Server list of the Connectivity Profile. Edit the Connectivity Profile to add an entry, if necessary.
9. Click "Download" to save the settings and download the installer.

Machine Tunnels:
From the BIG-IP GUI:
1. Access.
2. Connectivity/VPN.
3. Connectivity.
4. Profiles.
5. Click the name of the profile.
6. At the bottom, click Customize Package >> Windows.
7. Check "Machine Tunnel Service".
8. Optionally, click "Machine Tunnel Service" on the left and check "Enable NLA for Machine Tunnel".
Note: To configure DNS Suffixes for NLA, edit the Connectivity Profile >> Win/Mac Edge Client > Location DNS List.
9. Click "Download" to save the settings and download the installer.

Check Contents

Verify at least one of these methods is configured.

Always Connected Mode:
From the BIG-IP GUI:
1. Access.
2. Connectivity/VPN.
3. Connectivity.
4. Profiles.
5. Click the name of the profile.
6. At the bottom, click Customize Package >> Windows.
7. Click "BIG-IP Edge Client" on the left.
8. Verify "Enable Always connected mode" is enabled.

Machine Tunnels:
From the BIG-IP GUI:
1. Access.
2. Connectivity/VPN.
3. Connectivity.
4. Profiles.
5. Click the name of the profile.
6. At the bottom, click Customize Package >> Windows.
7. Verify "Machine Tunnel Service" is checked.

If the BIG-IP VPN Gateway is not configured to use an Always On VPN connection for remote computing, this is a finding.

Vulnerability Number

V-266174

Documentable

False

Rule Version

F5BI-AP-300163

Severity Override Guidance

Verify at least one of these methods is configured.

Always Connected Mode:
From the BIG-IP GUI:
1. Access.
2. Connectivity/VPN.
3. Connectivity.
4. Profiles.
5. Click the name of the profile.
6. At the bottom, click Customize Package >> Windows.
7. Click "BIG-IP Edge Client" on the left.
8. Verify "Enable Always connected mode" is enabled.

Machine Tunnels:
From the BIG-IP GUI:
1. Access.
2. Connectivity/VPN.
3. Connectivity.
4. Profiles.
5. Click the name of the profile.
6. At the bottom, click Customize Package >> Windows.
7. Verify "Machine Tunnel Service" is checked.

If the BIG-IP VPN Gateway is not configured to use an Always On VPN connection for remote computing, this is a finding.

Check Content Reference

M

Target Key

5640