Configuring a pre-login or post-login message banner for the BIG-IP or Enterprise Manager system - Banner Enabled

800-53|AC-8a.

CAT|III

CCI|CCI-000048

Rule-ID|SV-74671r1_rule

STIG-ID|F5BI-DM-000033

Vuln-ID|V-60241

Configuring a pre-login or post-login message banner for the BIG-IP or Enterprise Manager system - Banner Text

Configuring a secure password policy for the BIG-IP system - Expiration Warning

800-53|IA-5(1)(d)

Configuring a secure password policy for the BIG-IP system - Maximum Duration

Configuring a secure password policy for the BIG-IP system - Maximum Login Failures

800-53|AC-7a.

Configuring a secure password policy for the BIG-IP system - Minimum Duration

Configuring a secure password policy for the BIG-IP system - Minimum Length

800-53|IA-5(1)(a)

Configuring a secure password policy for the BIG-IP system - Password Memory

800-53|IA-5(1)(e)

Configuring a secure password policy for the BIG-IP system - Required Lowercase Characters

Configuring a secure password policy for the BIG-IP system - Required Numeric Characters

Configuring a secure password policy for the BIG-IP system - Required Special Characters

Configuring a secure password policy for the BIG-IP system - Required Uppercase Characters

Configuring a secure password policy for the BIG-IP system - Secure Password Enforcement

800-53|IA-5

Configuring an automatic logout for idle sessions - Configuration utility

800-53|AC-11a.

CAT|II

CCI|CCI-000057

Rule-ID|SV-74523r2_rule

STIG-ID|F5BI-DM-000007

Vuln-ID|V-60093

Configuring an automatic logout for idle sessions - Console Sessions

Configuring an automatic logout for idle sessions - SSH

Configuring an automatic logout for idle sessions - TMSH

Configuring CIDR Network Addresses for the BIG-IP packet filter - Always accept ARP

800-53|AC-10

CCI|CCI-000054

Rule-ID|SV-74521r2_rule

STIG-ID|F5BI-DM-000003

Vuln-ID|V-60091

Configuring CIDR Network Addresses for the BIG-IP packet filter - Always accept important ICMP

Configuring CIDR Network Addresses for the BIG-IP packet filter - enabled

Configuring CIDR Network Addresses for the BIG-IP packet filter - Filter established connections

Configuring CIDR Network Addresses for the BIG-IP packet filter - Packet filter logging

Configuring CIDR Network Addresses for the BIG-IP packet filter - Review Packet-Filter Rules

Configuring CIDR Network Addresses for the BIG-IP packet filter - Send ICMP error on packet reject

Configuring CIDR Network Addresses for the BIG-IP packet filter - Unhandled Packet Action

Configuring cookie encryption within the HTTP profile

800-53|SC-5

CAT|I

CCI|CCI-002385

Rule-ID|SV-74797r1_rule

STIG-ID|F5BI-LT-000221

Vuln-ID|V-60367

Configuring LDAP remote authentication for Active Directory - Scope

800-53|AC-3(7)

800-53|CM-6b.

CCI|CCI-000366

CCI|CCI-002169

Rule-ID|SV-74623r1_rule

STIG-ID|F5BI-DM-000179

Vuln-ID|V-60193

Configuring LDAP remote authentication for Active Directory - Servers

Configuring LDAP remote authentication for Active Directory - SSL

Configuring LDAP remote authentication for Active Directory - SSL CA Cert

Configuring LDAP remote authentication for Active Directory - SSL Check Peer

Configuring LDAP remote authentication for Active Directory - SSL Client Cert

Configuring LDAP remote authentication for Active Directory - SSL Client Key

Configuring the BIG-IP system to enforce the use of strict passwords

Configuring the BIG-IP system to exclude inode information from Etags

Defining advanced NTP configurations on the BIG-IP system

800-53|AU-8(1)

800-53|AC-2f.

800-53|AC-17(4)

Rule-ID|SV-106833r1_rule

STIG-ID|F5BI-DM-000284

Vuln-ID|V-97729

Mitigating risk from SSH brute force login attacks - Monitor login attempts

Modifying the list of ciphers and MAC and key exchange algorithms used by the SSH service on the BIG-IP system or BIG-IQ system

Overview of BIG-IP administrative access controls

800-53|CM-5(1)

CCI|CCI-001813

Rule-ID|SV-74639r1_rule

STIG-ID|F5BI-DM-000213

Vuln-ID|V-60209

Preserving or modifying HTTP response headers removed by the BIG-IP ASM system

Restricting access to the Configuration utility by source IP address

Rule-ID|SV-74647r1_rule

STIG-ID|F5BI-DM-000239

Vuln-ID|V-60217

Settings to Lock Down your BIG-IP - Admin Terminal Access

Settings to Lock Down your BIG-IP - Remote Role

Specifying allowable IP ranges for SSH access

Tenable_Best_Practices_F5_BIG-IP_v1.0.0.audit from K53108777: Hardening your F5 system

The BIG-IP Core implementation must be configured to protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing pattern recognition pre-processors when providing content filtering to virtual servers.

Unable to limit Configuration utility access to clients using only TLSv1.1 or TLSv1.2

Detections

Analytics

Tenable F5 BIG-IP Best Practice Audit

Audit Details

File Details

Audit Changelog

Revision 1.7

Miscellaneous

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.7 Dec 22, 2023 Miscellaneous Metadata updated.
Revision 1.6 Mar 7, 2023 Miscellaneous Metadata updated. References updated.
Revision 1.5 Feb 21, 2023 Miscellaneous Metadata updated. Variables updated.
Revision 1.4 Dec 7, 2022 Miscellaneous Metadata updated.
Revision 1.3 Apr 25, 2022 Miscellaneous Metadata updated. References updated.
Revision 1.2 Feb 1, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.1 Sep 29, 2020 Miscellaneous References updated.

Detections

Analytics

Tenable F5 BIG-IP Best Practice Audit Download File

Audit Details

File Details

Audit Changelog

Revision 1.7

Miscellaneous

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

Tenable F5 BIG-IP Best Practice Audit