F5BI-FW-300001 - The F5 BIG-IP appliance that filters traffic from the VPN access points must be configured with organization-defined filtering rules that apply to the monitoring of remote access traffic.

800-53|AC-17(1)

CAT|II

CCI|CCI-000067

Rule-ID|SV-266254r1024572_rule

STIG-ID|F5BI-FW-300001

Vuln-ID|V-266254

F5BI-FW-300002 - The F5 BIG-IP appliance must be configured to use filters that use packet headers and packet attributes, including source and destination IP addresses and ports, to prevent the flow of unauthorized or suspicious traffic between interconnected networks with different security policies, including perimeter firewalls and server VLANs.

800-53|AC-4

CAT|I

CCI|CCI-001414

Rule-ID|SV-266255r1024867_rule

STIG-ID|F5BI-FW-300002

Vuln-ID|V-266255

F5BI-FW-300005 - The F5 BIG-IP appliance must generate traffic log entries containing information to establish the details of the event, including success or failure of the application of the firewall rule.

800-53|AU-3

800-53|AU-4(1)

800-53|AU-12c.

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000172

CCI|CCI-001851

Rule-ID|SV-266256r1024869_rule

STIG-ID|F5BI-FW-300005

Vuln-ID|V-266256

F5BI-FW-300012 - In the event that communication with the central audit server is lost, the F5 BIG-IP appliance must continue to queue traffic log records locally.

800-53|AU-5b.

CAT|III

CCI|CCI-000140

Rule-ID|SV-266257r1024871_rule

STIG-ID|F5BI-FW-300012

Vuln-ID|V-266257

F5BI-FW-300013 - The F5 BIG-IP appliance must be configured to use TCP when sending log records to the central audit server.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-266258r1024873_rule

STIG-ID|F5BI-FW-300013

Vuln-ID|V-266258

F5BI-FW-300015 - The F5 BIG-IP appliance must be configured to restrict itself from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

Rule-ID|SV-266259r1024876_rule

STIG-ID|F5BI-FW-300015

Vuln-ID|V-266259

F5BI-FW-300017 - The F5 BIG-IP appliance must employ filters that prevent or limit the effects of all types of commonly known denial-of-service (DoS) attacks, including flooding, packet sweeps, and unauthorized port scanning.

800-53|SC-5

800-53|SC-5(1)

800-53|SC-5(2)

CCI|CCI-001094

CCI|CCI-001095

CCI|CCI-002385

Rule-ID|SV-266260r1024878_rule

STIG-ID|F5BI-FW-300017

Vuln-ID|V-266260

F5BI-FW-300020 - The F5 BIG-IP appliance must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

800-53|SC-7(5)

CCI|CCI-001109

Rule-ID|SV-266261r1024579_rule

STIG-ID|F5BI-FW-300020

Vuln-ID|V-266261

F5BI-FW-300021 - The F5 BIG-IP appliance must generate an alert that can be forwarded to, at a minimum, the information system security officer (ISSO) and information system security manager (ISSM) when denial-of-service (DoS) incidents are detected.

800-53|SI-4(5)

CCI|CCI-002664

Rule-ID|SV-266262r1024580_rule

STIG-ID|F5BI-FW-300021

Vuln-ID|V-266262

F5BI-FW-300028 - The F5 BIG-IP appliance must be configured to inspect all inbound and outbound traffic at the application layer.

Rule-ID|SV-266263r1024879_rule

STIG-ID|F5BI-FW-300028

Vuln-ID|V-266263

F5BI-FW-300029 - The F5 BIG-IP appliance must be configured to filter inbound traffic on all external interfaces.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-266264r1024582_rule

STIG-ID|F5BI-FW-300029

Vuln-ID|V-266264

F5BI-FW-300030 - The F5 BIG-IP appliance must be configured to filter outbound traffic on all internal interfaces.

Rule-ID|SV-266265r1024583_rule

STIG-ID|F5BI-FW-300030

Vuln-ID|V-266265

F5BI-FW-300031 - The F5 BIG-IP appliance must be configured to block all outbound management traffic.

Rule-ID|SV-266266r1024584_rule

STIG-ID|F5BI-FW-300031

Vuln-ID|V-266266

F5BI-FW-300033 - The BIG-IP appliance perimeter firewall must be configured to filter traffic destined to the enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.

Detections

Analytics

DISA F5 BIG-IP TMOS Firewall STIG v1r1

Audit Details

File Details

Audit Changelog

No revisions found