F5BI-DN-300011 - The F5 BIG-IP DNS implementation must prohibit recursion on authoritative name servers.

800-53|CM-6b.

CAT|II

CCI|CCI-000366

Rule-ID|SV-265980r1024486_rule

STIG-ID|F5BI-DN-300011

Vuln-ID|V-265980

F5BI-DN-300012 - The validity period for the RRSIGs covering a zone's DNSKEY RRSet must be no less than two days and no more than one week.

Rule-ID|SV-265981r1024487_rule

STIG-ID|F5BI-DN-300012

Vuln-ID|V-265981

F5BI-DN-300013 - An authoritative name server must be configured to enable DNSSEC Resource Records.

800-53|AU-10(1)(a)

800-53|AU-10(1)(b)

800-53|IA-3

800-53|SC-20(2)

800-53|SC-20a.

800-53|SC-20b.

800-53|SC-21

800-53|SC-23

CCI|CCI-000778

CCI|CCI-001184

CCI|CCI-001663

CCI|CCI-001901

CCI|CCI-001902

CCI|CCI-002462

CCI|CCI-002463

CCI|CCI-002464

CCI|CCI-002465

CCI|CCI-002466

CCI|CCI-002467

CCI|CCI-002468

Rule-ID|SV-265982r1024488_rule

STIG-ID|F5BI-DN-300013

Vuln-ID|V-265982

F5BI-DN-300014 - Primary authoritative name servers must be configured to only receive zone transfer requests from specified secondary name servers.

Rule-ID|SV-265983r1024490_rule

STIG-ID|F5BI-DN-300014

Vuln-ID|V-265983

F5BI-DN-300015 - The F5 BIG-IP DNS must use valid root name servers in the local root zone file.

Rule-ID|SV-265984r1024858_rule

STIG-ID|F5BI-DN-300015

Vuln-ID|V-265984

F5BI-DN-300016 - The platform on which the name server software is hosted must be configured to respond to DNS traffic only.

Rule-ID|SV-265985r1024493_rule

STIG-ID|F5BI-DN-300016

Vuln-ID|V-265985

F5BI-DN-300017 - The digital signature algorithm used for DNSSEC-enabled zones must be set to use RSA/SHA256 or RSA/SHA512.

CAT|I

Rule-ID|SV-265986r1024860_rule

STIG-ID|F5BI-DN-300017

Vuln-ID|V-265986

F5BI-DN-300020 - The F5 BIG-IP DNS server implementation must validate the binding of the other DNS server's identity to the DNS information for a server-to-server transaction (e.g., zone transfer).

800-53|AU-10(2)(a)

CCI|CCI-001904

Rule-ID|SV-265987r1024862_rule

STIG-ID|F5BI-DN-300020

Vuln-ID|V-265987

F5BI-DN-300028 - A BIG-IP DNS server implementation must provide additional data origin artifacts along with the authoritative data the system returns in response to external name/address resolution queries.

CCI|CCI-001178

Rule-ID|SV-265988r1024496_rule

STIG-ID|F5BI-DN-300028

Vuln-ID|V-265988

F5BI-DN-300030 - The validity period for the RRSIGs covering the DS RR for a zones delegated children must be no less than two days and no more than one week.

CCI|CCI-001179

Rule-ID|SV-265989r1024498_rule

STIG-ID|F5BI-DN-300030

Vuln-ID|V-265989

F5BI-DN-300036 - The F5 BIG-IP DNS implementation must protect the authenticity of communications sessions for zone transfers.

Rule-ID|SV-265990r1024864_rule

STIG-ID|F5BI-DN-300036

Vuln-ID|V-265990

F5BI-DN-300039 - The F5 BIG-IP DNS server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks.

Detections

Analytics

DISA F5 BIG-IP TMOS DNS STIG v1r1

Audit Details

File Details

Audit Changelog

No revisions found