STIGQter: STIG Summary: F5 BIG-IP TMOS ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The F5 BIG-IP appliance must be configured to set the "Max In Progress Sessions per Client IP" value to 10 or an organizational-defined number.

DISA Rule

SV-266175r1024855_rule

Vulnerability Number

V-266175

Group Title

SRG-NET-000053-ALG-000001

Rule Version

F5BI-AP-300164

Severity

CAT III

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the access profile name.
5. In the "Settings" section, set "Max In Progress Sessions per Client IP" to 10 or an organization-defined number.
Note: If the setting is grayed out, check the box to the right of the setting and then update it. If the setting is not set to 10, verify the operational reason is documented and approved by the AO.
6. Click "Update".
7. Click "Apply Access Policy".

Check Contents

Note: Setting must be tested to determine if a number greater than 10 is operationally necessary. Ten is the minimum but may have operational impacts. Set to the minimum that is possible without adverse impacts, document the setting and the operational testing.

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the access profile name.
5. In the "Settings" section, verify "Max In Progress Sessions per Client IP" is set to 10 or an organization-defined number.

If the F5 BIG-IP APM access policy is not configured to set a "Max In Progress Sessions per Client IP" value to 10 or an organization-defined number, this is a finding.

Vulnerability Number

V-266175

Documentable

False

Rule Version

F5BI-AP-300164

Severity Override Guidance

Note: Setting must be tested to determine if a number greater than 10 is operationally necessary. Ten is the minimum but may have operational impacts. Set to the minimum that is possible without adverse impacts, document the setting and the operational testing.

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the access profile name.
5. In the "Settings" section, verify "Max In Progress Sessions per Client IP" is set to 10 or an organization-defined number.

If the F5 BIG-IP APM access policy is not configured to set a "Max In Progress Sessions per Client IP" value to 10 or an organization-defined number, this is a finding.

Check Content Reference

M

Target Key

5640