STIGQter STIGQter: STIG Summary: Juniper SRX SG ALG Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 26 Jul 2019: The Juniper SRX Services Gateway Firewall must be configured to support centralized management and configuration of the audit log.

DISA Rule

SV-80797r1_rule

Vulnerability Number

V-66307

Group Title

SRG-NET-000333-ALG-000049

Rule Version

JUSX-AG-000057

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Logging for security-related sources such as screens and security policies must be configured separately.

The following example specifies that security log messages in structured-data format (syslog format) are sent from the source <MGT IP address> (e.g., the SRX's loopback or other interface IP address) to an external syslog server.

[edit]
set security log cache
set security log format syslog
set security log source-address <MGT IP Address>
set security log stream <stream name> host <syslog server IP Address>

To get traffic logs from permitted sessions, add "then log session-close" to the policy.
To get traffic logs from denied sessions, add "then log session-init" to the policy. Enable Logging on Security Policies:

[edit]
set security policies from-zone <zone-name> to-zone <zone-name> policy <policy-name> then log <event>

Example to log session init and session close events:
set security policies from-zone trust to-zone untrust policy default-permit then log session-init
set security policies from-zone trust to-zone untrust policy default-permit then log session-close

Check Contents

To verify that traffic logs are being sent to the syslog server, check the syslog server files.

If traffic logs are not being sent to the syslog server, this is a finding.

Vulnerability Number

V-66307

Documentable

False

Rule Version

JUSX-AG-000057

Severity Override Guidance

To verify that traffic logs are being sent to the syslog server, check the syslog server files.

If traffic logs are not being sent to the syslog server, this is a finding.

Check Content Reference

M

Target Key

3035

Comments