F5BI-AP-300001 - The F5 BIG-IP appliance providing user access control intermediary services must limit the number of concurrent sessions to one or an organization-defined number for each access profile.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-266137r1024833_rule

STIG-ID|F5BI-AP-300001

Vuln-ID|V-266137

F5BI-AP-300002 - The F5 BIG-IP appliance providing intermediary services for remote access communications traffic must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.

800-53|AC-17(1)

CCI|CCI-000067

Rule-ID|SV-266138r1024835_rule

STIG-ID|F5BI-AP-300002

Vuln-ID|V-266138

F5BI-AP-300003 - The F5 BIG-IP appliance providing intermediary services for remote access must use FIPS-validated cryptographic algorithms, including TLS 1.2 at a minimum.

800-53|AC-17(2)

800-53|SC-23

800-53|SC-23(5)

CAT|I

CCI|CCI-000068

CCI|CCI-001184

CCI|CCI-001453

CCI|CCI-002470

Rule-ID|SV-266139r1024837_rule

STIG-ID|F5BI-AP-300003

Vuln-ID|V-266139

F5BI-AP-300006 - To protect against data mining, the F5 BIG-IP appliance providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

800-53|AC-23

CCI|CCI-002346

CCI|CCI-002347

Rule-ID|SV-266140r1024838_rule

STIG-ID|F5BI-AP-300006

Vuln-ID|V-266140

F5BI-AP-300007 - To protect against data mining, the F5 BIG-IP appliance providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

Rule-ID|SV-266141r1024839_rule

STIG-ID|F5BI-AP-300007

Vuln-ID|V-266141

F5BI-AP-300008 - To protect against data mining, the F5 BIG-IP appliance providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.

Rule-ID|SV-266142r1024368_rule

STIG-ID|F5BI-AP-300008

Vuln-ID|V-266142

F5BI-AP-300012 - The F5 BIG-IP appliance providing user access control intermediary services must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-266143r1024370_rule

STIG-ID|F5BI-AP-300012

Vuln-ID|V-266143

F5BI-AP-300013 - The F5 BIG-IP appliance providing user access control intermediary services must implement attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.

800-53|AC-4

CCI|CCI-001368

CCI|CCI-001414

Rule-ID|SV-266144r1024371_rule

STIG-ID|F5BI-AP-300013

Vuln-ID|V-266144

F5BI-AP-300015 - The F5 BIG-IP appliance providing user access control intermediary services must display the Standard Mandatory DOD-approved Notice and Consent Banner before granting access to the network.

800-53|AC-8a.

800-53|AC-8b.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-000048

CCI|CCI-000050

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-266145r1024372_rule

STIG-ID|F5BI-AP-300015

Vuln-ID|V-266145

F5BI-AP-300018 - The F5 BIG-IP appliance must generate event log records that can be forwarded to the centralized events log.

800-53|AU-3

800-53|AU-12c.

800-53|SC-7(9)(b)

800-53|SI-3c.2.

800-53|SI-4(1)

800-53|SI-4(5)

800-53|SI-4(22)

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000172

CCI|CCI-001243

CCI|CCI-001487

CCI|CCI-002400

CCI|CCI-002656

CCI|CCI-002664

CCI|CCI-002684

Rule-ID|SV-266146r1024841_rule

STIG-ID|F5BI-AP-300018

Vuln-ID|V-266146

F5BI-AP-300041 - The F5 BIG-IP appliance that provides intermediary services for SMTP must inspect inbound and outbound SMTP and Extended SMTP communications traffic for protocol compliance and protocol anomalies.

800-53|CM-6b.

800-53|SC-7(17)

CCI|CCI-000366

CCI|CCI-001125

Rule-ID|SV-266147r1024374_rule

STIG-ID|F5BI-AP-300041

Vuln-ID|V-266147

F5BI-AP-300042 - The F5 BIG-IP appliance that intermediary services for FTP must inspect inbound and outbound FTP communications traffic for protocol compliance and protocol anomalies.

Rule-ID|SV-266148r1024375_rule

STIG-ID|F5BI-AP-300042

Vuln-ID|V-266148

F5BI-AP-300043 - The F5 BIG-IP appliance that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.

Rule-ID|SV-266149r1024844_rule

STIG-ID|F5BI-AP-300043

Vuln-ID|V-266149

F5BI-AP-300045 - The F5 BIG-IP appliance must be configured to prohibit or restrict the use of unnecessary or prohibited functions, ports, protocols, and/or services, including those defined in the PPSM CAL and vulnerability assessments.

800-53|CM-7a.

800-53|CM-7b.

CCI|CCI-000381

CCI|CCI-000382

Rule-ID|SV-266150r1024377_rule

STIG-ID|F5BI-AP-300045

Vuln-ID|V-266150

F5BI-AP-300047 - The F5 BIG-IP appliance providing user authentication intermediary services must uniquely identify and authenticate users using redundant authentication servers and multifactor authentication (MFA).

800-53|IA-2

800-53|IA-2(2)

800-53|IA-2(11)

800-53|IA-5(2)(c)

800-53|IA-8

CCI|CCI-000187

CCI|CCI-000764

CCI|CCI-000766

CCI|CCI-000804

CCI|CCI-001948

CCI|CCI-001951

Rule-ID|SV-266152r1024845_rule

STIG-ID|F5BI-AP-300047

Vuln-ID|V-266152

F5BI-AP-300052 - The F5 BIG-IP appliance must configure certification path validation to ensure revoked machine credentials are prohibited from establishing an allowed session.

800-53|IA-5(2)(a)

CCI|CCI-000185

Rule-ID|SV-266153r1024380_rule

STIG-ID|F5BI-AP-300052

Vuln-ID|V-266153

F5BI-AP-300054 - The F5 BIG-IP appliance providing user authentication intermediary services using PKI-based user authentication must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.

800-53|IA-5(2)(d)

CCI|CCI-001991

Rule-ID|SV-266154r1024381_rule

STIG-ID|F5BI-AP-300054

Vuln-ID|V-266154

F5BI-AP-300056 - The F5 BIG-IP appliance must terminate all network connections associated with a communications session at the end of the session or after 15 minutes of inactivity.

800-53|SC-10

CCI|CCI-001133

Rule-ID|SV-266155r1024382_rule

STIG-ID|F5BI-AP-300056

Vuln-ID|V-266155

F5BI-AP-300059 - The F5 BIG-IP appliance providing content filtering must employ rate-based attack prevention behavior analysis.

800-53|SC-5

800-53|SC-5(1)

CCI|CCI-001094

CCI|CCI-002385

Rule-ID|SV-266156r1024848_rule

STIG-ID|F5BI-AP-300059

Vuln-ID|V-266156

F5BI-AP-300061 - The F5 BIG-IP appliance providing content filtering must protect against or limit the effects of known and unknown types of denial-of-service (DoS) attacks by employing pattern recognition pre-processors.

Rule-ID|SV-266157r1024386_rule

STIG-ID|F5BI-AP-300061

Vuln-ID|V-266157

F5BI-AP-300064 - The F5 BIG-IP appliance must check the validity of all data inputs except those specifically identified by the organization.

800-53|SI-10

CCI|CCI-001310

Rule-ID|SV-266158r1024387_rule

STIG-ID|F5BI-AP-300064

Vuln-ID|V-266158

F5BI-AP-300065 - The F5 BIG-IP appliance providing content filtering must automatically update malicious code protection mechanisms.

800-53|SI-3(2)

CCI|CCI-001247

Rule-ID|SV-266159r1024388_rule

STIG-ID|F5BI-AP-300065

Vuln-ID|V-266159

F5BI-AP-300068 - The F5 BIG-IP appliance providing content filtering must detect use of network services that have not been authorized or approved by the information system security manager (ISSM) and information system security officer (ISSO), at a minimum.

CCI|CCI-002683

Rule-ID|SV-266160r1024389_rule

STIG-ID|F5BI-AP-300068

Vuln-ID|V-266160

F5BI-AP-300069 - The F5 BIG-IP appliance providing content filtering must generate a log record when unauthorized network services are detected.

Rule-ID|SV-266161r1024391_rule

STIG-ID|F5BI-AP-300069

Vuln-ID|V-266161

F5BI-AP-300151 - When the Access Profile Type is LTM+APM and it is not using any connectivity resources (such as Network Access, Portal Access, etc.) in the VPE, the F5 BIG-IP appliance must be configured to enable the HTTP Only flag.

800-53|SC-23(3)

CAT|III

CCI|CCI-001664

Rule-ID|SV-266162r1024392_rule

STIG-ID|F5BI-AP-300151

Vuln-ID|V-266162

F5BI-AP-300152 - The F5 BIG-IP appliance must be configured to enable the secure cookie flag.

Rule-ID|SV-266163r1024393_rule

STIG-ID|F5BI-AP-300152

Vuln-ID|V-266163

F5BI-AP-300153 - The F5 BIG-IP appliance must be configured to disable the persistent cookie flag.

Rule-ID|SV-266164r1024395_rule

STIG-ID|F5BI-AP-300153

Vuln-ID|V-266164

F5BI-AP-300154 - The F5 BIG-IP appliance must configure certificate path validation to ensure revoked user credentials are prohibited from establishing an allowed session.

Rule-ID|SV-266165r1024396_rule

STIG-ID|F5BI-AP-300154

Vuln-ID|V-266165

Detections

Analytics

DISA F5 BIG-IP TMOS ALG STIG v1r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous