STIGQter: STIG Summary: Symantec Edge SWG NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Apr 2026:

The Edge SWG must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

DISA Rule

SV-279251r1192886_rule

Vulnerability Number

V-279251

Group Title

SRG-APP-000080-NDM-000220

Rule Version

SYME-ND-000190

Severity

CAT I

CCI(s)

CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.
CCI-000163 - Protect audit information from unauthorized modification.
CCI-000164 - Protect audit information from unauthorized deletion.
CCI-001493 - Protect audit tools from unauthorized access.
CCI-001494 - Protect audit tools from unauthorized modification.
CCI-001495 - Protect audit tools from unauthorized deletion.
CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
CCI-001499 - Limit privileges to change software resident within software libraries.
CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
CCI-002169 - Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.
CCI-000366 - Implement the security configuration settings.
CCI-002883 - Restrict the use of maintenance tools to authorized personnel only.
CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
CCI-004046 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
CCI-004047 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.

Weight

Fix Recommendation

In the Edge SWG Web UI, navigate to the Configuration tab.

1. Under the "Authentication" section under "Configuration and Realms and Domains", click "Add Realm and LDAP".
2. Add a name.
3. Under "Primary Server", enter the fully qualified domain name (FDQN) of the LDAPS primary domain controller (e.g., dc1.dod.mil), then enter the port number, e.g., 636.
4. Click "Enable SSL".
5. Select the SSL device profile created in SYME-ND-000800.
6. Under "User attribute Type": userPrincipalName.
7. Click "Add DN".
8. Enter the path of the domain (e.g., dc=dod,dc=mil).
9. Click "Show" under "Advanced Settings".
10. Click "Use the same refresh time for all" and set the refresh time to 10 seconds.
11. Set the Inactivity Timeout to 600 seconds.
12. Select "Local" for Group Comparison.
13. Under Alternate Server, type the secondary LDAPS domain controller (e.g., dc2.dod.mil), then enter the port number, e.g., 636.
14. Under "Search", click "only Authorized" and add the search user and password (i.e., the LDAPS service account) in DN format (e.g., CN=broadcom_svc,OU=BROADCOM,DC=dod,DC=mil)
15. Under "Groups" select "user" for membership type and attribute as member of.
16. Under "Object Classes" ensure "container" is selected.
17. Click the "test Configuration" to ensure all configuration has been entered correctly.

In the Edge SWG Web UI, navigate to the Configuration tab.

1. Under the Authentication section under "Configuration and Realms and Domains", click "Add Realm and Certificate".
2. Make the name: "CAC"
3. Under username enter: $(SubjectAltName.OtherName)
4. Under full username enter: $(SubjectAltName.OtherName.1)
5. Ensure "Authorization Realm" is checked and the previous LDAPS realm is selected.
6. Under "Authorization Username", select "Determined by Search".
7. Ensure the LDAPS search realm is selected.
8. Enter the following in the search filter: (userPrincipalName=$(cs-username)) and ensure the user attribute "Use FQDN" is selected.
9. Click "Show" advanced settings.
10. Ensure "Use persistent cookies" and "Verify the IP address in the cookie" are not checked.

In the Edge SWG Web UI, navigate to the Configuration tab.

1. Under "Services", click "Proxy Services".
2. Click "Add Service".
3. Name the service "CAC-MC-Notify".
4. Under "Proxy type", select "HTTPS Reverse Proxy".
5. Under "Key Ring and CCL", use those created under SYME-ND-000800.
6. Ensure SSL version is TLS 1.2 or 1.3 only.
7. Under "Listeners", add the management IPv4 address intercepting on port 444.
8. Under "Listeners", add the management IPv6 address intercepting on port 444.

In the Edge SWG Web UI, navigate to the VPM.

1. Go to the Symantec web portal to download the CPL text file called "AdminLoginBanner.txt", which will be used at https://knowledge.broadcom.com/external/article/388134.
2. Click "Add Layer".
3. Select "CPL".
4. Download the exact CPL file hosted on the Symantec website.
5. Click "Apply Policy" and ensure it loaded correctly.

Go back to the main portion of the VPM.

1. Click "Add Layer".
2. Scroll down and select "Admin Access", then click "Add".
3. Locate the Admin Access Layer (1) that was added and click "Add rule".
4. Inside of the rule, under "Source", left-click and select "Set".
5. Click "Add new Object".
6. Select "Group".
7. Under "Group" type in the full LDAPS full Distinguished Name (DN) for the admin group. e.g., CN=broadcom.admins.gsg,OU=BROADCOM,OU=Vendors,DC=dod,DC=local
8. Under the "Authentication Realm", select the "CAC Certificate Realm".
9. Click "Apply", then click "Set".
10. In the same rule, left-click in the "Service" field and click "Set".
11. Select Service Name: HTTPS-console and click "Set".
12. In the same rule, left-click in the "Action" field and click "Set".
13. Select the action "Allow Read/Write Access" and click "Set".
14. Repeat these steps to add various read-only or read-write groups for the HTTPS-console.
15. For the SSH-Console click "Add rule".
16. Inside of the rule, under "Source", left-click and select "Set".
17. Click "Add new Object".
18. Select "Group".
19. Under the "Group" field type in the full LDAPS full Distinguished Name (DN) for the admin group. e.g., CN=broadcom.admins.gsg,OU=BROADCOM,OU=Vendors,DC=dod,DC=local
20. Under the "Authentication Realm", select the "LDAPS" realm; do not select the CAC certificate realm.
21. Click "Apply", then click "Set".
22. In the same rule, left-click in the "Service" field and click "Set".
23. Select "Service Name: SSH-console" and click "Set".
24. In the same rule, left-click in the "Action" field and click "Set".
25. Select the action "Allow Read/Write Access" and click "Set".
26. Repeat these steps to add various read-only or read-write groups for the SSH-console.
27. Click "Apply Policy" and ensure it loaded correctly.

In the Edge SWG Web UI, navigate to the Configuration tab.

1. Under "Services", click "Management Services".
2. Click to edit the HTTPS-Console.
3. Ensure the keyring and CCL are those created in SYME-ND-000800.
4. Check "Verify Client" and select "Apply then save".
5. Close, then re-open the browser, then go to the URL associated with the login banner, https://proxy.dod.mil:444.
6. Once the login banner is presented, click "Accept".
7. Select the CAC certificate. Provide the PIN. The user must be authenticated.

Note: If it is unsuccessful, it is possible the LDAPS credential is not valid, the group does not match, or there is an OCSP revocation issue.

Check Contents

1. In the Edge SWG Web UI, navigate to the Configuration tab.
2. Go to Services >> Management Services.
3. Click "Edit" next to HTTPS-console.

Under the "Service Settings", if "Verify Client" is not checked, this is a finding.

Under the "Authentication" section under "Configuration and Realms and Domains", if a Certificate Realm is not configured and set with a valid LDAP authorization realm this is a finding.

In the Edge SWG Web UI, navigate to the VPM.

If an Admin Access layer is configured for HTTPS-console, verify the group is derived from the CAC/LDAPS admin group; otherwise, this is a finding.

For the SSH-console, verify the group is derived from the LDAPS admin group; otherwise, this is a finding.

1. Log in to the Edge SWG SSH CLI.
2. Enter "enable" and "configure terminal".
3. Enter "ssh-console" and then "x509-auth".
4. Enter "view".

If "x509 certificate authentication" states "disabled", this is a finding.

The Edge SWG must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key