STIGQter: STIG Summary: F5 BIG-IP Advanced Firewall Manager 11.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 29 May 2015:

The BIG-IP AFM module must be configured to only allow incoming communications from authorized sources routed to authorized destinations.

DISA Rule

SV-74355r1_rule

Vulnerability Number

V-59925

Group Title

SRG-NET-000364-ALG-000122

Rule Version

F5BI-AF-000223

Severity

CAT II

CCI(s)

• CCI-002403 - The information system only allows incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

Configure the BIG-IP AFM module to only allow incoming communications from authorized sources routed to authorized destinations.

Check Contents

If the BIG-IP AFM module is not used to support user access control intermediary services for virtual servers, this is not applicable.

Verify the BIG-IP AFM module is configured to only allow incoming communications from authorized sources routed to authorized destinations.

Navigate to the BIG-IP System manager >> Local Traffic >> Virtual Servers >> Virtual Servers List tab.

Select the applicable Virtual Servers(s) from the list to verify.

Navigate to the Security >> Policies tab.

Verify that "Network Firewall" is assigned a local Network Firewall Policy.

Verify configuration of the identified Network Firewall policy:

Navigate to the BIG-IP System manager >> Security >> Network Firewall >> Active Rules.

Select the Network Firewall policy that was assigned to the Virtual Server.

Review the configuration of the "Protocol", "Source", "Destination", and "Action" sections at a minimum to ensure that the policy is only allowing incoming communications from authorized sources enroute to authorized destinations.

If the BIG-IP AFM module is not configured to only allow incoming communications from unauthorized sources routed to unauthorized destinations, this is a finding.

Vulnerability Number

V-59925

Documentable

False

Rule Version

F5BI-AF-000223

Severity Override Guidance

If the BIG-IP AFM module is not used to support user access control intermediary services for virtual servers, this is not applicable.

Verify the BIG-IP AFM module is configured to only allow incoming communications from authorized sources routed to authorized destinations.

Navigate to the BIG-IP System manager >> Local Traffic >> Virtual Servers >> Virtual Servers List tab.

Select the applicable Virtual Servers(s) from the list to verify.

Navigate to the Security >> Policies tab.

Verify that "Network Firewall" is assigned a local Network Firewall Policy.

Verify configuration of the identified Network Firewall policy:

Navigate to the BIG-IP System manager >> Security >> Network Firewall >> Active Rules.

Select the Network Firewall policy that was assigned to the Virtual Server.

Review the configuration of the "Protocol", "Source", "Destination", and "Action" sections at a minimum to ensure that the policy is only allowing incoming communications from authorized sources enroute to authorized destinations.

If the BIG-IP AFM module is not configured to only allow incoming communications from unauthorized sources routed to unauthorized destinations, this is a finding.

Check Content Reference

M

Target Key

2839

Comments