STIGQter: STIG Summary: F5 BIG-IP TMOS Firewall Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Sep 2024:

The F5 BIG-IP appliance must generate traffic log entries containing information to establish the details of the event, including success or failure of the application of the firewall rule.

DISA Rule

SV-266256r1024869_rule

Vulnerability Number

V-266256

Group Title

F5BI-FW-300005

Rule Version

F5BI-FW-300005

Severity

CAT II

CCI(s)

CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

Fix Recommendation

From the BIG-IP GUI:
1. Security.
2. Event Logs.
3. Logging Profiles.
4. Edit the global-network profile.
5. Network Firewall tab.
6. Select a Log Publisher to use (for production environments, use Remote High Speed Logging).
7. Check the "Accept", "Drop", and "Reject" Log Rule Matches boxes are checked, along with any other settings to be enabled.
8. Click "Update".

From the BIG-IP Console, type the following commands:

tmsh modify security log profile global-network network modify { all { filter { log-acl-match-accept enabled log-acl-match-drop enabled log-acl-match-reject enabled } publisher <publisher name> } }
tmsh save sys config

Refer to vendor documentation for more information.

Check Contents

From the BIG-IP GUI:
1. Security.
2. Event Logs.
3. Logging Profiles.
4. Edit the global-network profile.
5. Network Firewall tab.
6. Select a Log Publisher to use (for production environments, use Remote High Speed Logging).
7. Verify at least the "Accept", "Drop", and "Reject" Log Rule Matches boxes are checked, along with any other settings to be enabled.

From the BIG-IP Console, type the following commands:

tmsh list security log profile global-network

Note: Verify the log-acl-match-accept, log-acl-match-drop, and log-acl-match-reject settings are enabled.

If the BIG-IP is not configured to generate traffic log entries containing information to establish the details of the event, including success or failure of the application of the firewall rule, this is a finding.

Vulnerability Number

V-266256

Documentable

False

Rule Version

F5BI-FW-300005

Severity Override Guidance

From the BIG-IP GUI:
1. Security.
2. Event Logs.
3. Logging Profiles.
4. Edit the global-network profile.
5. Network Firewall tab.
6. Select a Log Publisher to use (for production environments, use Remote High Speed Logging).
7. Verify at least the "Accept", "Drop", and "Reject" Log Rule Matches boxes are checked, along with any other settings to be enabled.

From the BIG-IP Console, type the following commands:

tmsh list security log profile global-network

Note: Verify the log-acl-match-accept, log-acl-match-drop, and log-acl-match-reject settings are enabled.

If the BIG-IP is not configured to generate traffic log entries containing information to establish the details of the event, including success or failure of the application of the firewall rule, this is a finding.

Check Content Reference

Target Key

5641