Detections
Analytics

DISA F5 BIG-IP TMOS ALG STIG v1r2

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: DISA F5 BIG-IP TMOS ALG STIG v1r2

Updated: 9/15/2026

Authority: DISA STIG

Plugin: F5

Revision: 1.1

Estimated Item Count: 37

File Details

Filename: DISA_STIG_F5_BIG-IP_TMOS_ALG_v1r2.audit

Size: 94 kB

MD5: c553972ea0f171b0e8603312e3799a93
SHA256: 5b429355df1bde08fff4eb9cef697da09cfd0aadd4cf761b0d4ec1f1eb8cbb16

Audit Items

DescriptionCategories
F5BI-AP-300001 - The F5 BIG-IP appliance providing user access control intermediary services must limit the number of concurrent sessions to one or an organization-defined number for each access profile.

ACCESS CONTROL

F5BI-AP-300002 - The F5 BIG-IP appliance providing intermediary services for remote access communications traffic must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.

ACCESS CONTROL

F5BI-AP-300003 - The F5 BIG-IP appliance providing intermediary services for remote access must use FIPS-validated cryptographic algorithms, including TLS 1.2 at a minimum.

ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300006 - To protect against data mining, the F5 BIG-IP appliance providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

ACCESS CONTROL

F5BI-AP-300007 - To protect against data mining, the F5 BIG-IP appliance providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

ACCESS CONTROL

F5BI-AP-300008 - To protect against data mining, the F5 BIG-IP appliance providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

ACCESS CONTROL

F5BI-AP-300012 - The F5 BIG-IP appliance providing user access control intermediary services must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.

ACCESS CONTROL

F5BI-AP-300013 - The F5 BIG-IP appliance providing user access control intermediary services must implement attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.

ACCESS CONTROL

F5BI-AP-300015 - The F5 BIG-IP appliance providing user access control intermediary services must display the Standard Mandatory DOD-approved Notice and Consent Banner before granting access to the network.

ACCESS CONTROL

F5BI-AP-300018 - The F5 BIG-IP appliance must generate event log records that can be forwarded to the centralized events log.

AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

F5BI-AP-300041 - The F5 BIG-IP appliance that provides intermediary services for SMTP must inspect inbound and outbound SMTP and Extended SMTP communications traffic for protocol compliance and protocol anomalies.

CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300042 - The F5 BIG-IP appliance that intermediary services for FTP must inspect inbound and outbound FTP communications traffic for protocol compliance and protocol anomalies.

CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300043 - The F5 BIG-IP appliance that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.

CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300045 - The F5 BIG-IP appliance must be configured to prohibit or restrict the use of unnecessary or prohibited functions, ports, protocols, and/or services, including those defined in the PPSM CAL and vulnerability assessments.

CONFIGURATION MANAGEMENT

F5BI-AP-300047 - The F5 BIG-IP appliance providing user authentication intermediary services must uniquely identify and authenticate users using redundant authentication servers and multifactor authentication (MFA).

IDENTIFICATION AND AUTHENTICATION

F5BI-AP-300052 - The F5 BIG-IP appliance must configure certification path validation to ensure revoked machine credentials are prohibited from establishing an allowed session.

IDENTIFICATION AND AUTHENTICATION

F5BI-AP-300054 - The F5 BIG-IP appliance providing user authentication intermediary services using PKI-based user authentication must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.

IDENTIFICATION AND AUTHENTICATION

F5BI-AP-300056 - The F5 BIG-IP appliance must terminate all network connections associated with a communications session at the end of the session or after 15 minutes of inactivity.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300059 - The F5 BIG-IP appliance providing content filtering must employ rate-based attack prevention behavior analysis.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300061 - The F5 BIG-IP appliance providing content filtering must protect against or limit the effects of known and unknown types of denial-of-service (DoS) attacks by employing pattern recognition pre-processors.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300064 - The F5 BIG-IP appliance must check the validity of all data inputs except those specifically identified by the organization.

SYSTEM AND INFORMATION INTEGRITY

F5BI-AP-300065 - The F5 BIG-IP appliance providing content filtering must automatically update malicious code protection mechanisms.

SYSTEM AND INFORMATION INTEGRITY

F5BI-AP-300068 - The F5 BIG-IP appliance providing content filtering must detect use of network services that have not been authorized or approved by the information system security manager (ISSM) and information system security officer (ISSO), at a minimum.

SYSTEM AND INFORMATION INTEGRITY

F5BI-AP-300069 - The F5 BIG-IP appliance providing content filtering must generate a log record when unauthorized network services are detected.

SYSTEM AND INFORMATION INTEGRITY

F5BI-AP-300151 - When the Access Profile Type is LTM+APM and it is not using any connectivity resources (such as Network Access, Portal Access, etc.) in the VPE, the F5 BIG-IP appliance must be configured to enable the HTTP Only flag.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300152 - The F5 BIG-IP appliance must be configured to enable the secure cookie flag.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300153 - The F5 BIG-IP appliance must be configured to disable the persistent cookie flag.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300154 - The F5 BIG-IP appliance must configure certificate path validation to ensure revoked user credentials are prohibited from establishing an allowed session.

IDENTIFICATION AND AUTHENTICATION

F5BI-AP-300155 - The F5 BIG-IP appliance must not use the On-demand Cert Auth VPE agent as part of the APM Policy Profiles.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300156 - The F5 BIG-IP appliance must be configured to restrict a consistent inbound IP for the entire management session.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300157 - The F5 BIG-IP appliance must be configured to limit authenticated client sessions to initial session source IP.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300159 - The F5 BIG-IP appliance must be configured to use cryptographic algorithms approved by NSA to protect NSS for remote access to a classified network.

SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300160 - The F5 BIG-IP must be configured to identify and authenticate all endpoint devices or peers before establishing a connection.

CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

F5BI-AP-300161 - The F5 BIG-IP appliance providing remote access intermediary services must disable split-tunneling for remote clients' VPNs.

CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300162 - The F5 BIG-IP appliance providing remote access intermediary services must be configured to route sessions to an IDPS for inspection.

CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300163 - The VPN Gateway must use Always On VPN connections for remote computing.

CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

F5BI-AP-300164 - The F5 BIG-IP appliance must be configured to set the "Max In Progress Sessions per Client IP" value to 10 or an organizational-defined number.

ACCESS CONTROL