STIGQter: STIG Summary: F5 BIG-IP TMOS Firewall Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Sep 2024:

In the event that communication with the central audit server is lost, the F5 BIG-IP appliance must continue to queue traffic log records locally.

DISA Rule

SV-266257r1024871_rule

Vulnerability Number

V-266257

Group Title

SRG-NET-000089-FW-000019

Rule Version

F5BI-FW-300012

Severity

CAT III

CCI(s)

CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

Fix Recommendation

If using Remote High Speed Logging (recommended):
From the BIG-IP GUI:
1. Local Traffic.
2. Pools.
3. Pool List.
4. <Logging Pool Name>
5. Verify that "Enable Request Queueing" is set to "Yes".
Note: Configuration must be set to "Advanced" to view this option.

From the BIG-IP Console, type the following commands:

tmsh modify ltm pool <Logging Pool Name> queue-on-connection-limit enabled
tmsh save sys config

Check Contents

If using Remote High Speed Logging (recommended):
From the BIG-IP GUI:
1. Local Traffic.
2. Pools.
3. Pool List.
4. <Logging Pool Name>
5. Verify that "Enable Request Queueing" is set to "Yes".

From the BIG-IP Console, type the following commands:

tmsh list ltm pool <Logging Pool Name> queue-on-connection-limit

Note: Verify this is enabled.

If the BIG-IP appliance is not configured to queue traffic log records locally in the event that communication with the central audit server is lost, this is a finding.

Vulnerability Number

V-266257

Documentable

False

Rule Version

F5BI-FW-300012

Severity Override Guidance

If using Remote High Speed Logging (recommended):
From the BIG-IP GUI:
1. Local Traffic.
2. Pools.
3. Pool List.
4. <Logging Pool Name>
5. Verify that "Enable Request Queueing" is set to "Yes".

From the BIG-IP Console, type the following commands:

tmsh list ltm pool <Logging Pool Name> queue-on-connection-limit

Note: Verify this is enabled.

If the BIG-IP appliance is not configured to queue traffic log records locally in the event that communication with the central audit server is lost, this is a finding.

Check Content Reference

Target Key

5641